MCP server · Audited from source

Next AI Draw.io MCP server

by dayuanjiang/next-ai-draw-ioApache-2.0 licenceAudited 19 Sep 2026 · source f10d7ec0d34d

npm @next-ai-drawio/mcp-server 0.2.3stdio★ 35,946

✕BLOCKGrade D · 69/100 · 19 Sep 2026 · f10d7ec

Safer alternatives View source on GitHub ↗

Is it safe? No — BLOCK, grade D (69/100). It exposes 11 tools: 4 read, 6 write and 1 destructive. The audit recorded 16 findings (0 critical, 1 high, 7 medium, 7 low). Maintainer's description: A next.js web application that integrates AI capabilities with draw.io diagrams. This app allows you to create, modify, and enhance diagrams through natural language commands and AI-assisted visualization.

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Next AI Draw.io MCP server (dayuanjiang/next-ai-draw-io)”. Retrieved 19 Sep 2026. https://modelsatlas.com/mcp/dayuanjiang/next-ai-draw-io

Why this is BLOCK. The audit found 0 critical and 1 high findings; the most severe is Network egress at lib/ssrf-protection.ts:69. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 19 Sep 2026

Trust score69/100✕BLOCK D

0 critical1 high7 medium7 low1 info

16 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemDeclared2 observations
NetworkDeclared11 observations
ShellDeclared1 observation
DependenciesNot pinnedSome ranges float
SecretsFoundSee the findings

Findings (16)

Sorted by severity

HIGHNetwork egressnet.metadata_ip · lib/ssrf-protection.ts:69

F-04 Network egressCWE-200 · CWE-319Layer L1

if (host === "169.254.169.254" || host === "metadata.google.internal") {

Why: cloud metadata endpoint: the classic SSRF credential grab
Fix: —

MEDIUMNetwork egressnet.raw_ip · app/api/validate-model/route.ts:252

F-04 Network egressCWE-200 · CWE-319Layer L1

baseURL: baseUrl || "http://127.0.0.1:8000/v1",

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · electron/main/index.ts:98

F-04 Network egressCWE-200 · CWE-319Layer L1

url.startsWith("http://127.0.0.1")

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · electron/main/port-manager.ts:144

F-04 Network egressCWE-200 · CWE-319Layer L1

return `http://127.0.0.1:${allocatedPort}`

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · env.example:96

F-04 Network egressCWE-200 · CWE-319Layer L1

# SGLANG_BASE_URL=http://127.0.0.1:8000/v1  # Your SGLang endpoint

Why: No further detail recorded for this rule.
Fix: —

MEDIUMNetwork egressnet.raw_ip · lib/types/model-config.ts:168

F-04 Network egressCWE-200 · CWE-319Layer L1

defaultBaseUrl: "http://127.0.0.1:8000/v1",

Why: No further detail recorded for this rule.
Fix: —

MEDIUMHard-coded secretssecret.generic · electron/main/config-manager.ts:344

F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why: No further detail recorded for this rule.
Fix: —

MEDIUMFilesystem / pathmcp.destructive_tools

F-05 Filesystem / pathCWE-22 · CWE-59Layer L3

delete_page

Why: 1 tool(s) can delete or overwrite
Fix: prefer a read-only mode or scoped tokens; the page states the blast radius

LOWFilesystem / pathfs.traversal · electron/main/window-manager.ts:24

F-05 Filesystem / pathCWE-22 · CWE-59Layer L1

return path.join(__dirname, "../../resources/icon.png")

Why: No further detail recorded for this rule.
Fix: —

LOWNetwork egressnet.metadata_ip · tests/unit/ssrf-protection.test.ts:33

F-04 Network egressCWE-200 · CWE-319Layer L1

expect(await isPrivateUrl("http://169.254.169.254/")).toBe(true)

Why: cloud metadata endpoint: the classic SSRF credential grab
Fix: —

LOWObfuscation / stealthobf.decode_call · lib/utils.ts:1679

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

const svgString = atob(xml_svg_string.slice(26))

Why: No further detail recorded for this rule.
Fix: —

LOWObfuscation / stealthobf.decode_call · lib/utils.ts:1717

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

const binaryString = atob(base64EncodedData)

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainsupply.unpinned · package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@ai-sdk/amazon-bedrock, @ai-sdk/anthropic, @ai-sdk/azure, @ai-sdk/deepseek, @ai-sdk/gateway, @ai-sdk/google, @ai-sdk/google-vertex, @ai-sdk/openai

Why: 97 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWSupply chainsupply.unpinned · packages/mcp-server/package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@modelcontextprotocol/sdk, linkedom, open, zod, @types/node, tsx, typescript, vitest

Why: 8 dependency range(s) float
Fix: pin exact versions or ship a lockfile

LOWPrompt injectionprompt.credential_read · docs/en/admin-panel.md:22

F-01 Prompt injectionCWE-94 · CWE-1427Layer L2

- On serverless platforms (Vercel, Cloudflare Workers) there is no persistent disk, so the panel is read-only — configure via environment variables there.

Why: asks the agent to read credentials
Fix: —

INFOInventory / provenanceinv.oversize · package-lock.json

F-13 Inventory / provenanceCWE-1104Layer L0

package-lock.json

Why: 1067097 bytes not read
Fix: —

Tools it exposes

11 declared in source · 1 destructive

4 read6 write1 destructive

1 tool can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

Tool	What it does	Risk
`delete_page`	No description in the source	destructive
`AIDraw.io`	Create AWS architecture diagrams, flowcharts, and technical diagrams using AI. Free online tool integrating draw.io with AI assistance for professional diagram creation.	write
`add_page`	No description in the source	write
`create_new_diagram`	No description in the source	write
`edit_diagram`	No description in the source	write
`rename_page`	No description in the source	write
`start_session`	No description in the source	write
`export_diagram`	No description in the source	read
`get_diagram`	No description in the source	read
`list_pages`	No description in the source	read
`load_diagram`	No description in the source	read

Safer alternatives

All calendar & office servers →

Evernote✓SAFE

verygoodplugins/mcp-evernote

MCP server for Evernote integration with note management and synchronization

2 destructiveGrade B

Apple Books✓SAFE

vgnshiyer/apple-books-mcp

Apple Books MCP Server

9 readGrade B

Agent Reachout✓SAFE

vibe-with-me-tools/agent-reachout

Let Claude Code reach you on Telegram when it finishes work or needs decisions

4 writeGrade B

Audit history

2026-09-19
✕BLOCK D 69 / 100
Source changed, verdict held · f10d7ec0d34d

README badge

Badges show the current verdict, BLOCK included

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Next AI Draw.io MCP server

What is the Next AI Draw.io MCP server?

A next.js web application that integrates AI capabilities with draw.io diagrams. This app allows you to create, modify, and enhance diagrams through natural language commands and AI-assisted visualization.

What tools does Next AI Draw.io expose?

11 in total: 4 read-only, 6 that write, and 1 that can delete or overwrite (delete_page). Every one is listed on this page with its risk.

Is Next AI Draw.io safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Next AI Draw.io need?

It reads ADMIN_PASSWORD, AIHUBMIX_API_KEY, ANTHROPIC_API_KEY, ANTHROPIC_AUTH_TOKEN, ANTHROPIC_THINKING_BUDGET_TOKENS, ATLASCLOUD_API_KEY, BEDROCK_REASONING_BUDGET_TOKENS, DAILY_TOKEN_LIMIT, GOOGLE_VERTEX_API_KEY, KIMI_API_KEY, LANGFUSE_PUBLIC_KEY and LANGFUSE_SECRET_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Next AI Draw.io run?

It speaks stdio, so it runs as a local process your client starts. It is published on npm as @next-ai-drawio/mcp-server at 0.2.3.

How current is this page?

The grade is for one exact copy of the source (f10d7ec0d34d), read on 2026-09-19. The repository is watched and re-audited when it changes.

I already installed Next AI Draw.io. What should I do?

Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.

Can the verdict change?

Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

dayuanjiang/next-ai-draw-io on GitHub — the source we read, its licence, stars and activityObserved · 19 Sep 2026
ModelsAtlas trust audit — BLOCK verdict for commit f10d7ec0d34dObserved · 19 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Next AI Draw.io MCP server?
GChatGPT CClaude PPerplexity
What tools does Next AI Draw.io expose?
GChatGPT CClaude PPerplexity
Is Next AI Draw.io safe to connect to an agent?
GChatGPT CClaude PPerplexity