MermaidBLOCK
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
AI-powered Mermaid diagram generation using Model Context Protocol (MCP)
[](https://www.npmjs.com/package/@narasimhaponnada/mermaid-mcp-server) [](https://www.npmjs.com/package/@narasimhaponnada/mermaid-mcp-server) [](https://nodejs.org/) [](LICENSE) [](https://modelcontextprotocol.io/) [](https://mermaid.js.org/)
🎯 Overview
The Mermaid MCP Server enables AI assistants like GitHub Copilot, Claude, and custom LLM applications to generate professional architecture diagrams, flowcharts, sequence diagrams, and more using natural language. It provides a Model Context Protocol interface for seamless integration with AI coding assistants.
✨ Key Features
- 🤖 AI-Powered Generation: Create diagrams using natural language with GitHub Copilot or Claude
- 🎨 Production-Ready SVGs: XML-compliant, validated SVG files ready for any use
- 📦 50+ Pre-built Templates: Architecture patterns, workflows, and data models
- 🔧 Multiple Integrations: VS Code, Claude Desktop, Cursor IDE, CLI, and custom apps
- 🚀 22+ Diagram Types: Flowcharts, sequences, ERDs, state machines, Gantt charts, and more
- ⚡ Fast & Reliable: Browser-based rendering with Puppeteer for consistent output
📋 What's Included
Mermaid/ ├── mermaid-mcp-server/ # Main MCP server │ ├── src/ # TypeScript source code │ ├── dist/ # Compiled JavaScript │ ├── examples/architectures/ # 5 production-ready SVG samples │ ├── package.json # Dependencies │ └── README.md #
cd3151439532OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.
claude mcp add mermaid-mcp-server -- npx -y @narasimhaponnada/[email protected]
{
"mcpServers": {
"mermaid-mcp-server": {
"command": "npx",
"args": [
"-y",
"@narasimhaponnada/[email protected]"
]
}
}
}Exposed tools (9)
8 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
convertDiagram | read | Convert diagram to different formats. Currently supports SVG (PNG/PDF coming soon). |
createCustomTemplate | write | Create a custom template from diagram code for reuse in current session. |
generateDiagram | read | Generate and render a Mermaid diagram to SVG file. Supports all 22+ diagram types with advanced layout options. |
getDiagramInfo | read | Analyze diagram code and return metadata (type, complexity, node/edge count, estimated render time). |
getTemplate | read | Get a specific diagram template by ID with complete code and metadata. |
listSupportedTypes | read | List all supported Mermaid diagram types (22+ types including flowchart, sequence, class, etc.). |
listTemplates | read | List available pre-built diagram templates (50+ templates) by category or type. |
searchTemplates | read | Search templates by keyword (name, description, type, tags, or code content). |
validateDiagram | read | Validate Mermaid diagram syntax and provide detailed error messages and suggestions. |
Trust audit
BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | FAIL |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (2 observation(s))
- Network
- declared (5 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (10)
const testModule = new Function('return typeof DOMPurify !== "undefined" && typeof DOMPurify.addHook === "function"');<!-- Generate architecture for [SYSTEM] -->
.connector.pid
const mermaidPath = join(__dirname, '../../node_modules/mermaid/dist/mermaid.min.js');
const compressed = Uint8Array.from(atob(serialized), c => c.charCodeAt(0));
@modelcontextprotocol/sdk, express, cors, ws, dotenv, @types/node, @types/express, @types/cors
@modelcontextprotocol/sdk, @types/dompurify, dompurify, jsdom, pako, puppeteer, @types/jsdom, @types/node
- **Full Permission**: You can build commercial or open-source tools using Mermaid
1. **Legally Clear**: MIT license gives you full permissions
- ✅ **Powerful** - Full access to Mermaid MCP features
Gates applied: no_behavioural_pass.
cd3151439532full audit observations/trust-audit/mcp-server/narasimhaponnada__mermaid-2.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | cd3151439532 | BLOCK | D | 69 | first audit |
Questions
What tools does Mermaid expose?
9 in total: 8 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Mermaid safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (69/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Mermaid need?
No credential environment variables were found in its source, so it appears to need none.
How does Mermaid run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as @narasimhaponnada/mermaid-mcp-server at 1.0.2.
How current is this page?
The grade is for one exact copy of the source (cd3151439532), read on 2026-10-08. The repository is watched and re-audited when it changes.