ArchySAFE
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://mseep.ai/app/phxdev1-archy-mcp)
Archy is an MCP (Model Context Protocol) server that generates architectural diagrams using Mermaid syntax. It can process both natural language descriptions and GitHub repository URLs to create various types of diagrams.
Features
- Generate diagrams from text descriptions
- Generate diagrams from GitHub repositories
- Support for all Mermaid diagram types:
- Flowcharts
- Sequence Diagrams
- Class Diagrams
- State Diagrams
- Entity Relationship Diagrams
- User Journeys
- Gantt Charts
- Pie Charts
- Quadrant Charts
- Requirement Diagrams
- Git Graphs
- C4 Diagrams
Installation
Prerequisites
- Node.js (v16 or higher)
- npm (v7 or higher)
- TypeScript (v5.8 or higher, included in dependencies)
Install from Source
- Clone the repository:
git clone https://github.com/phxdev1/archy.git cd archy
- Install dependencies:
npm install
- Build the project:
npm run build
This compiles the TypeScript source files to JavaScript in the build directory.
Automated MCP Installation
Archy includes a convenient installation script that automatically configures the MCP server for both VS Code and Claude:
npm run install-mcp
This script:
- Automatically detects the correct MCP settings locations for your operating system
- Updates the MCP configuration files for VS Code and Claude
- Prompts for a GitHub token for repository analysis (optional)
- Makes the server executable
No need to manually edit JSON configuration files like some kind of cave-dwelling animal! The script handles all the tedious configuration work for you,
538daef2cf51OBSERVED · 2026-10-08Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add archy --env GITHUB_TOKEN=${GITHUB_TOKEN} --env OPENROUTER_API_KEY=${OPENROUTER_API_KEY} -- npx -y [email protected]{
"mcpServers": {
"archy": {
"command": "npx",
"args": [
"-y",
"[email protected]"
],
"env": {
"GITHUB_TOKEN": "${GITHUB_TOKEN}",
"OPENROUTER_API_KEY": "${OPENROUTER_API_KEY}"
}
}
}
}Exposed tools (9)
9 read · 0 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
export_diagram_to_image | read | Export a Mermaid diagram to an image format (PNG, SVG, or PDF) |
generate_diagram_from_code | read | Generate a Mermaid diagram from code using AI |
generate_diagram_from_github | read | Generate a Mermaid diagram from a GitHub repository |
generate_diagram_from_text | read | Generate a Mermaid diagram from a text description |
generate_diagram_from_text_with_ai | read | Generate a Mermaid diagram from a text description using AI (LangChain with OpenRouter) |
generate_diff_diagram | read | Generate a Mermaid diagram showing differences between two versions of code |
generate_repository_evolution_diagram | read | Generate a diagram showing the evolution of a repository over time |
list_supported_diagram_types | read | List all supported diagram types with descriptions |
test_tool | read | A test tool |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (1 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (1)
@modelcontextprotocol/sdk, axios, isomorphic-git, langchain, memfs, mermaid, openai, puppeteer
Gates applied: no_behavioural_pass.
538daef2cf51full audit observations/trust-audit/mcp-server/phxdev1__archy.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | 538daef2cf51 | SAFE | B | 89 | first audit |
Questions
What tools does Archy expose?
9 in total: 9 read-only, 0 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Archy safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does Archy need?
It reads GITHUB_TOKEN and OPENROUTER_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Archy run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as archy at 1.0.0.
How current is this page?
The grade is for one exact copy of the source (538daef2cf51), read on 2026-10-08. The repository is watched and re-audited when it changes.