Next AI Draw.io

Name: Next AI Draw.io
Author: dayuanjiang

BLOCKgrade D · trust 69/100

A next.js web application that integrates AI capabilities with draw.io diagrams. This app allows you to create, modify, and enhance diagrams through natural language commands and AI-assisted visualization.

aidiagramsproductivity

Overview

From the repository's own README, as read at the audited commit.

# Next AI Draw.io<div align="center">**AI-Powered Diagram Creation Tool - Chat, Draw, Visualize**English | [中文](./docs/cn/README_CN.md) | [日本語](./docs/ja/README_JA.md)[![TrendShift](https://trendshift.io/api/badge/repositories/15449)](https://next-ai-drawio.jiang.jp/)[![License: Apache 2.0](https://img.shields.io/badge/License-Apache%202.0-blue.svg)](https://opensource.org/licenses/Apache-2.0)[![Next.js](https://img.shields.io/badge/Next.js-16.x-black)](https://nextjs.org/)[![React](https://img.shields.io/badge/React-19.x-61dafb)](https://react.dev/)[![Sponsor](https://img.shields.io/badge/Sponsor-❤-ea4aaa)](https://github.com/sponsors/DayuanJiang)[![Live Demo](./public/live-demo-button.svg)](https://next-ai-drawio.jiang.jp/)</div>A Next.js web application that integrates AI capabilities with draw.io diagrams. Create, modify, and enhance diagrams through natural language commands and AI-assisted visualization.> Note: Thanks to <img src="https://raw.githubusercontent.com/DayuanJiang/next-ai-draw-io/main/public/doubao-color.png" alt="" height="20" /> [ByteDance Doubao](https://www.volcengine.com/activity/codingplan?ac=MMAP8JTTCAQ2&rc=Z9Z3LDTJ&utm_campaign=drawio&utm_content=drawio&utm_medium=devrel&utm_source=OWO&utm_term=drawio) sponsorship, the demo site now uses the powerful glm-4.7 model!<p align="center">  <a href="https://www.atlascloud.ai/?utm_source=github&utm_medium=link&utm_campaign=next-ai-draw-io">    <picture>      <source media="(prefers-color-scheme: dark)" srcset="./public/atlas-cloud-logo-white.svg">      <img src="./public/atlas-cloud-logo.svg" alt="Atlas Cloud" width="200">    </picture>  </a></p>> 🎁 Thanks to **[Atlas Cloud](https://www.atlascloud.ai/?utm_source=github&utm_medium=link&utm_campaign=next-ai-draw-io)** for sponsoring next-ai-draw-io. Its OpenAI-compatible API gives diagram workflows one provider connection for DeepSeek, Qwen, GLM, Kimi, MiniMax, and more. Budget-friendly access is available through the [Coding Plan](https://www.atlasc

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add mcp-server --env ADMIN_PASSWORD=${ADMIN_PASSWORD} --env AIHUBMIX_API_KEY=${AIHUBMIX_API_KEY} --env ANTHROPIC_API_KEY=${ANTHROPIC_API_KEY} --env ANTHROPIC_AUTH_TOKEN=${ANTHROPIC_AUTH_TOKEN} -- npx -y @next-ai-drawio/[email protected]

claude-desktop

{
  "mcpServers": {
    "mcp-server": {
      "command": "npx",
      "args": [
        "-y",
        "@next-ai-drawio/[email protected]"
      ],
      "env": {
        "ADMIN_PASSWORD": "${ADMIN_PASSWORD}",
        "AIHUBMIX_API_KEY": "${AIHUBMIX_API_KEY}",
        "ANTHROPIC_API_KEY": "${ANTHROPIC_API_KEY}",
        "ANTHROPIC_AUTH_TOKEN": "${ANTHROPIC_AUTH_TOKEN}"
      }
    }
  }
}

Exposed tools (11) 4 read · 6 write · 1 destructive

Blast radius: 1 tool can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`AIDraw.io`	write	Create AWS architecture diagrams, flowcharts, and technical diagrams using AI. Free online tool integrating draw.io with AI assistance for professional diagram creation.
`add_page`	write
`create_new_diagram`	write
`delete_page`	destructive
`edit_diagram`	write
`export_diagram`	read
`get_diagram`	read
`list_pages`	read
`load_diagram`	read
`rename_page`	write
`start_session`	write

Details

Source: dayuanjiang/next-ai-draw-io
npm: @next-ai-drawio/mcp-server@0.2.3
Transports: stdio
Credentials it reads: ADMIN_PASSWORDAIHUBMIX_API_KEYANTHROPIC_API_KEYANTHROPIC_AUTH_TOKENANTHROPIC_THINKING_BUDGET_TOKENSATLASCLOUD_API_KEYBEDROCK_REASONING_BUDGET_TOKENSDAILY_TOKEN_LIMITGOOGLE_VERTEX_API_KEYKIMI_API_KEYLANGFUSE_PUBLIC_KEYLANGFUSE_SECRET_KEY
License: Apache-2.0
Stars: 35,812 · pushed 0d ago

Trust audit

Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	PASS
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (2 observation(s))
Network: declared (11 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: found

Findings (16)

HIGHNetwork egress · net.metadata_ip · CWE-200, CWE-319

lib/ssrf-protection.ts:69

if (host === "169.254.169.254" || host === "metadata.google.internal") {

Why it matters. cloud metadata endpoint: the classic SSRF credential grab