MCP server · Org-owned · Audited from source

Excalidraw MCP server

by excalidraw/excalidraw-mcpNo licenceAudited 21 Sep 2026 · source 4424dc27570f

npm @mcp-demos/excalidraw-server 0.3.2stdiostreamable-http★ 5,340

!CAUTIONGrade B · 89/100 · 21 Sep 2026 · 4424dc2

5,340GitHub stars

Is it safe? With care — CAUTION, grade B (89/100). It exposes 1 tool: 1 read, 0 write and 0 destructive. The audit recorded 7 findings (0 critical, 0 high, 2 medium, 4 low). Maintainer's description: Fast and streamable Excalidraw MCP App

Ask an AI about this pageGChatGPT CClaude PPerplexity GeGemini XGrok

CoCopilot AIGoogle AI Mode

Cite

Cite this page

ModelsAtlas. “Excalidraw MCP server (excalidraw/excalidraw-mcp)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/excalidraw/excalidraw-4

3 MCP servers are called Excalidraw. This is the one we pick. Compare all 3 →

excalidraw/excalidraw-mcp Org-owned★ 5,340!CAUTION
i-tozer/excalidraw-mcp★ 45✓SAFE
yctimlin/mcp_excalidraw★ 2,457!CAUTION

Trust audit

Audit 0.4.1 · full source read 21 Sep 2026

Trust score89/100!CAUTION B

0 critical0 high2 medium4 low1 info

7 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

FilesystemNone observedNothing seen in the source
NetworkDeclared1 observation
ShellDeclared2 observations
DependenciesNot pinnedSome ranges float
SecretsNone foundNo keys in source

“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.

Five audit layers

Layer	What we check	Result
`L0` Provenance	Repo owner, licence, archive status, activity	PASS 3 findings
`L1` Static source	Secrets, path traversal, supply chain	WARN 4 findings
`L2` Instructions	Prompt injection and authority framing in docs and tool descriptions	PASS
`L3` Inventory	Declared tools match the source	PASS
`L4` Sandbox	Run in isolation and watch behaviour	SKIPPED

Provenance & runtime

Who published it, and what the audit could and could not run

Provenance

Repository owner excalidrawOrganizationAccount type recorded when we read the repository.
PackagePublished on npm@mcp-demos/excalidraw-server at version 0.3.2
LicenceNone declaredFrom the repository, as read at the audited commit.
Last push6 months agoActivity of the repository when we read it.
Source commit read4424dc27570fThe audit covers exactly this commit, read on 21 Sep 2026.

Runtime

Sandbox runNot run yetThis audit read the source only; it did not execute the server.
Tool inventory1 declaredRead from the source and classed read, write or destructive.

Every value here is read from the record's own repository and audit.Suggest a correction

Findings (7)

Sorted by severity

MEDIUMObfuscation / stealthobf.base64_blob · src/sounds.ts:2

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

export const PENCIL_STROKE_SOFT = "SUQzBAAAAAAAI1RTU0UAAAAPAAADTGF2ZjU4LjIwLjEwMAAAAAAAAAAAAAAA//tQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAASW5mbwAAAA8AAAA6AABfgQAGCgoPDxMYGBwcICAlKSktLTI2Njs7Pz9DS

Why: No further detail recorded for this rule.
Fix: —

MEDIUMObfuscation / stealthobf.base64_blob · src/sounds.ts:4

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

export const PENCIL_LINE_DRAG = "SUQzBAAAAAAAI1RTU0UAAAAPAAADTGF2ZjU4LjIwLjEwMAAAAAAAAAAAAAAA//tQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAASW5mbwAAAA8AAAAoAABCHgAJCQ8PFhYWHBwiIiIpKS8vLzU1PDw8QkJISEh

Why: No further detail recorded for this rule.
Fix: —

LOWInventory / provenanceinv.hidden_file · .mcpbignore

F-13 Inventory / provenanceCWE-1104Layer L0

.mcpbignore

Why: hidden member outside the usual dotfiles
Fix: review its purpose

LOWInventory / provenanceinv.no_license

F-13 Inventory / provenanceCWE-1104Layer L0

Why: no LICENSE file and no repo licence
Fix: add a licence

LOWObfuscation / stealthobf.decode_call · src/pencil-audio.ts:24

F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1

const binary = atob(base64);

Why: No further detail recorded for this rule.
Fix: —

LOWSupply chainsupply.unpinned · package.json

F-08 Supply chainCWE-829 · CWE-1357Layer L1

@excalidraw/excalidraw, @modelcontextprotocol/ext-apps, cors, express, morphdom, react, react-dom, @upstash/redis

Why: 31 dependency range(s) float
Fix: pin exact versions or ship a lockfile

INFOInventory / provenanceinv.oversize · docs/demo.gif

F-13 Inventory / provenanceCWE-1104Layer L0

docs/demo.gif

Why: 10343437 bytes not read
Fix: —

Tools it exposes

1 declared in source · 0 destructive

1 read0 write0 destructive

Tool	Risk	What it does
`read_me`	read	No description in the source

Install

Package version 0.3.2 · audited commit 4424dc2

Read the findings first. The most severe is Obfuscation / stealth (medium) at src/sounds.ts.

Add to Cursor Add to VS Code

One-click links open your editor with the config below filled in, exactly as the snippets show it, pinned to version 0.3.2. The audit covers commit 4424dc2 only.

claude mcp add excalidraw-server --env KV_REST_API_TOKEN=${KV_REST_API_TOKEN} --env UPSTASH_REDIS_REST_TOKEN=${UPSTASH_REDIS_REST_TOKEN} -- npx -y @mcp-demos/[email protected]

{
  "mcpServers": {
    "excalidraw-server": {
      "command": "npx",
      "args": [
        "-y",
        "@mcp-demos/[email protected]"
      ],
      "env": {
        "KV_REST_API_TOKEN": "${KV_REST_API_TOKEN}",
        "UPSTASH_REDIS_REST_TOKEN": "${UPSTASH_REDIS_REST_TOKEN}"
      }
    }
  }
}

The command pins the package version recorded in the source (0.3.2); the audit covers commit 4424dc27570f. Transport: stdio · streamable-http. Reads these environment variables: KV_REST_API_TOKEN, UPSTASH_REDIS_REST_TOKEN. Give it the narrowest token it needs.

Audit history

2026-09-21
!CAUTION B 89 / 100
Source changed, verdict held · 4424dc27570f

README badge

For maintainers · updates on every re-audit

[![ModelsAtlas: CAUTION B](https://modelsatlas.com/mcp/excalidraw/excalidraw-4/badge.svg)](https://modelsatlas.com/mcp/excalidraw/excalidraw-4/)

The badge always shows the latest audit; a maintainer cannot pin an old verdict.

Other ratings

Cited, never blended into our score

No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.

Questions about Excalidraw MCP server

What is the Excalidraw MCP server?

Fast and streamable Excalidraw MCP App

What tools does Excalidraw expose?

1 in total: 1 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.

Is Excalidraw safe to connect to an agent?

With care. The audit graded it B (89/100) and found 7 things worth knowing before you trust this server, listed below with the exact line each was found on.

What credentials does Excalidraw need?

It reads KV_REST_API_TOKEN and UPSTASH_REDIS_REST_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Excalidraw run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @mcp-demos/excalidraw-server at 0.3.2.

How current is this page?

The grade is for one exact copy of the source (4424dc27570f), read on 2026-09-21. The repository is watched and re-audited when it changes.

Which Excalidraw MCP server is the right one?

excalidraw/excalidraw-mcp (this page). 3 servers share the name; see the side-by-side comparison.

Sources

excalidraw/excalidraw-mcp on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
ModelsAtlas trust audit — CAUTION verdict for commit 4424dc27570fObserved · 21 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.

What is the Excalidraw MCP server?
GChatGPT CClaude PPerplexity
What tools does Excalidraw expose?
GChatGPT CClaude PPerplexity
Is Excalidraw safe to connect to an agent?
GChatGPT CClaude PPerplexity