Excalidraw

Overview

From the repository's own README, as read at the audited commit.

# Excalidraw MCP App ServerMCP server that streams hand-drawn Excalidraw diagrams with smooth viewport camera control and interactive fullscreen editing.![Demo](docs/demo.gif)## InstallWorks with any client that supports [MCP Apps](https://modelcontextprotocol.io/docs/extensions/apps) — Claude, ChatGPT, VS Code, Goose, and others. If something doesn't work, please [open an issue](https://github.com/antonpk1/excalidraw-mcp-app/issues).### Remote (recommended)### `https://mcp.excalidraw.com`For apps that don't yet have an official integration, you can add a custom MCP / connector (naming can vary between apps).### Local**Option A: Download Extension**1. Download `excalidraw-mcp-app.mcpb` from [Releases](https://github.com/antonpk1/excalidraw-mcp-app/releases)2. Double-click to install in Claude Desktop**Option B: Build from Source**```bashgit clone https://github.com/excalidraw/excalidraw-mcp.gitcd excalidraw-mcp-apppnpm install && pnpm run build```Add to `~/Library/Application Support/Claude/claude_desktop_config.json`:```json{  "mcpServers": {    "excalidraw": {      "command": "node",      "args": ["/path/to/excalidraw-mcp-app/dist/index.js", "--stdio"]    }  }}```Restart Claude Desktop.## UsageExample prompts:- "Draw a cute cat using excalidraw"- "Draw an architecture diagram showing a user connecting to an API server which talks to a database"## What are MCP Apps and how can I build one?Text responses can only go so far. Sometimes users need to interact with data, not just read about it. [MCP Apps](https://github.com/modelcontextprotocol/ext-apps/) is an official Model Context Protocol extension that lets servers return interactive HTML interfaces (data visualizations, forms, dashboards) that render directly in the chat.- **Getting started for humans**: [documentation](https://modelcontextprotocol.io/docs/extensions/apps)- **Getting started for AIs**: [skill](https://github.com/modelcontextprotocol/ext-apps/blob/main/plugins/mcp-apps/skills/create-mcp-app/SKILL.m

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude mcp add excalidraw-server --env KV_REST_API_TOKEN=${KV_REST_API_TOKEN} --env UPSTASH_REDIS_REST_TOKEN=${UPSTASH_REDIS_REST_TOKEN} -- npx -y @mcp-demos/[email protected]

{
  "mcpServers": {
    "excalidraw-server": {
      "command": "npx",
      "args": [
        "-y",
        "@mcp-demos/[email protected]"
      ],
      "env": {
        "KV_REST_API_TOKEN": "${KV_REST_API_TOKEN}",
        "UPSTASH_REDIS_REST_TOKEN": "${UPSTASH_REDIS_REST_TOKEN}"
      }
    }
  }
}

Exposed tools (1) 1 read · 0 write · 0 destructive

Details

Source

excalidraw/excalidraw-mcp

npm

@mcp-demos/excalidraw-server@0.3.2

Transports

stdio · streamable-http

Credentials it reads

KV_REST_API_TOKENUPSTASH_REDIS_REST_TOKEN

Stars

5,295 · pushed 172d ago

Trust audit

Install with care. The audit found things worth knowing before you trust its output.

What the source does

Filesystem

none-observed

Network

declared (1 observation(s))

Shell

declared (2 observation(s))

Dependencies

not all pinned

Secrets in source

none-found

Findings (7)

export const PENCIL_STROKE_SOFT = "SUQzBAAAAAAAI1RTU0UAAAAPAAADTGF2ZjU4LjIwLjEwMAAAAAAAAAAAAAAA//tQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAASW5mbwAAAA8AAAA6AABfgQAGCgoPDxMYGBwcICAlKSktLTI2Njs7Pz9DS

export const PENCIL_LINE_DRAG = "SUQzBAAAAAAAI1RTU0UAAAAPAAADTGF2ZjU4LjIwLjEwMAAAAAAAAAAAAAAA//tQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAASW5mbwAAAA8AAAAoAABCHgAJCQ8PFhYWHBwiIiIpKS8vLzU1PDw8QkJISEh

.mcpbignore

const binary = atob(base64);

@excalidraw/excalidraw, @modelcontextprotocol/ext-apps, cors, express, morphdom, react, react-dom, @upstash/redis

docs/demo.gif

Gates applied: no_behavioural_pass, no_license.

Audited 2026-09-13 · audit v0.4.0 · source sha 4424dc27570f · full audit: observations/trust-audit/mcp-server/excalidraw__excalidraw-4.json · Report an issue or request a re-scan

Audit history

Also audited

Servers with a similar trust profile.

Questions