Draw.io MCP ServerBLOCK
Create diagrams in chat, rendered as live interactive draw.io diagrams. 10,000+ searchable shapes.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
The official draw.io MCP (Model Context Protocol) server that enables LLMs to create and open diagrams in the draw.io editor.
Four Ways to Create Diagrams
This repository offers four approaches for integrating draw.io with AI assistants. Pick the one that fits your setup:
MCP App Server
The MCP App server renders draw.io diagrams inline in AI chat interfaces using the MCP Apps protocol. Instead of opening a browser tab, diagrams appear directly in the conversation as interactive iframes.
The official hosted endpoint
fa851ea12103OBSERVED · 2026-10-12Exposed tools (7)
6 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
get_page | read | Reads one page (diagram) from a local .drawio file and returns its raw mxGraphModel |
list_pages | read | Lists the pages (diagrams) in a local .drawio file without loading full page content. |
open_drawio_csv | read | Opens the draw.io editor with a diagram generated from CSV data. |
open_drawio_mermaid | read | Opens the draw.io editor with a diagram generated from Mermaid.js syntax. |
open_drawio_xml | read | Opens the draw.io editor with a diagram from XML content. |
search_shapes | read | Search the draw.io shape library by keywords. Returns matching shapes with |
set_page | write | Replaces the content of one page (diagram) in a local .drawio file with new |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | WARN |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (5 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (6 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (15)
${l}`;let[v,y]=[p,l];return t=new Function(...v,y)(...n),we(e,t)}for(var je=(e,t)=>{for(var r=[],n=0;n<e;n++)r.push(h[t+4*n>>2]);return r},Ot=e=>{e=e.trim();let t=e.indexOf("(");return t===-1?e:(c(e.e`),e=new Function(...s,i+`};
libavoid.wasm
import { resolveIconServiceUrl } from "../../shared/icon-search.js";import { buildTagMap } from "../../shared/shape-search.js";import { searchShapesAndIcons, DEFAULT_ICON_SERVICE_URL } from "../../shared/icon-search.js";import { withElkLayout, isFlowchartSource } from "../../shared/mermaid-elk.js";import { normalizeDiagram } from "../../shared/normalize-model.js";base = "http://127.0.0.1:" + server.address().port;
const bytes = Uint8Array.from(atob(faviconBase64), function(c) { return c.charCodeAt(0); });@modelcontextprotocol/ext-apps, @modelcontextprotocol/sdk, express, pako, zod
@modelcontextprotocol/sdk, pako
jsdom
mcp-app-server/public/demo/drawio-plugin-demo.mp4
shape-search/search-index.json
Gates applied: no_behavioural_pass.
fa851ea12103full audit observations/trust-audit/mcp-server/jgraph__drawio-mcp.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-12 | fa851ea12103 | BLOCK | D | 69 | first audit |
Questions
What is the @drawio/mcp MCP server?
Create diagrams in chat, rendered as live interactive draw.io diagrams. 10,000+ searchable shapes.
What tools does @drawio/mcp expose?
7 in total: 6 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @drawio/mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does @drawio/mcp need?
No credential environment variables were found in its source, so it appears to need none.
How does @drawio/mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts.
How current is this page?
The grade is for one exact copy of the source (fa851ea12103), read on 2026-10-12. The repository is watched and re-audited when it changes.