Draw.io MCP ServerSAFE
A Model Context Protocol (MCP) server for programmatic diagram generation using Draw.io (Diagrams.net). This server generates Draw.io XML directly — no browser extension or Draw.io instance required.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
A Model Context Protocol (MCP) server for programmatic diagram generation using Draw.io (Diagrams.net). This server generates Draw.io XML directly — no browser extension or Draw.io instance required.
[](https://github.com/simonkurtz-MSFT/drawio-mcp-server/actions/workflows/ci.yml)
[](https://hub.docker.com/r/simonkurtzmsft/drawio-mcp-server)
[](https://agentseal.org/mcp/https-githubcom-simonkurtz-msft-drawio-mcp-server)
Demo Video
[](https://youtu.be/YAz-qjDPVZI)
Acknowledgements
This project would not exist in this manner if it weren't for the following repositories and their authors. Thank you!
- Original drawio-mcp-server by Ladislav (lgazo): lgazo/drawio-mcp-server
- Azure icons source (
dwarfered): dwarfered/azure-architecture-icons-for-drawio - VS Code Drawio extension by hediet: hediet/vscode-drawio
Features
- 700+ Azure Architecture Icons — Official Microsoft icons with embedded SVG data, organized into ~20 categories (Compute, Networking, Storage, Databases, AI + ML, Security, and more)
- Basic Shapes — Rectangles, ellipses, diamonds, parallelograms, and other flowchart primitives
- Fuzzy Search — Find shapes by partial name across the entire icon library
- Batch Operations — Create and update multiple cells in a single call for better performance
- **Layer
249665e1e36aOBSERVED · 2026-10-07Exposed tools (21)
9 read · 9 write · 3 destructive. Blast radius: 3 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
add-cells-to-group | write | Assign one or more cells to groups. Prefer transactional: true for multi-step workflows; finalize with finish-diagram. Always pass ALL assignments in a single call — never call this tool repeatedly. Supports assigning cells to different groups in a single call. |
clear-diagram | destructive | Clear all cells and layers, resetting the diagram to its initial empty state. Prefer transactional: true for multi-step workflows; finalize with finish-diagram. |
create-layer | write | Create a new layer in the diagram. Layers organize cells into separate visual planes that can be shown or hidden. |
delete-cell-by-id | destructive | Delete a cell (vertex or edge) by its ID. Prefer transactional: true for multi-step workflows; finalize with finish-diagram. When a vertex is deleted, all connected edges are automatically cascade-deleted and reported in the response. |
edit-cells | write | Edit one or more vertex cells. Prefer transactional: true for multi-step workflows; finalize with finish-diagram. Always pass ALL updates in a single call — never call this tool repeatedly. Only updates specified properties on each cell. |
edit-edges | write | Edit one or more edges. Prefer transactional: true for multi-step workflows; finalize with finish-diagram. Always pass ALL updates in a single call — never call this tool repeatedly. Only updates specified properties on each edge. |
export-diagram | read | Export the diagram as Draw.io XML with diagram statistics. The XML is in the response payload |
get-diagram-stats | read | Get comprehensive statistics about the current diagram including cell counts, bounds, layer distribution, and more. Useful for understanding diagram state before making changes. |
get-shape-categories | read | Get available shape categories (General, Flowchart, Azure icons). For discovering specific shapes, prefer search-shapes. |
get-shapes-in-category | write | List all shapes in a category. Returns shape names and styles for use with add-cells. |
get-style-presets | read | Get style presets (Azure colors, flowchart shapes, edges) for consistent styling. |
import-diagram | write | Import a Draw.io XML string, replacing the current diagram. Prefer transactional: true for multi-step workflows; finalize with finish-diagram. Multi-page documents are supported — all pages are merged into a single flat model. Use this to load and modify existing .drawio files. |
list-group-children | read | List all cells that are children of a group/container. Prefer transactional: true for multi-step workflows; finalize with finish-diagram. |
list-layers | read | List all layers in the diagram with IDs and names. Also returns the active layer ID. |
list-paged-model | read | Get a paginated list of cells in the diagram. Returns layer context alongside results. Use this to inspect diagram structure or find cells by type. |
move-cell-to-layer | write | Move a cell to a different layer. Updates the cell |
remove-cell-from-group | destructive | Remove a cell from its group, returning it to the active layer. Prefer transactional: true for multi-step workflows; finalize with finish-diagram. |
set-active-layer | write | Set the active layer for new elements. |
set-cell-shape | write | Update one or more cells |
suggest-group-sizing | read | Suggest group/container width and height based on vertically stacked children, spacing, and padding. Use before create-groups to avoid overflow. |
validate-group-containment | read | Validate that all child cells of a group are visually inside the group |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (1 observation(s))
- Network
- declared (1 observation(s))
- Shell
- none-observed
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (2)
clear-diagram, delete-cell-by-id, remove-cell-from-group
assets/azure-public-service-icons/000 all azure public service icons.xml
Gates applied: no_behavioural_pass.
249665e1e36afull audit observations/trust-audit/mcp-server/simonkurtz-msft__draw-io-2.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-07 | 249665e1e36a | SAFE | B | 89 | first audit |
Questions
What is the Draw.io MCP server?
A Model Context Protocol (MCP) server for programmatic diagram generation using Draw.io (Diagrams.net). This server generates Draw.io XML directly — no browser extension or Draw.io instance required.
What tools does Draw.io expose?
21 in total: 9 read-only, 9 that write, and 3 that can delete or overwrite (clear-diagram, delete-cell-by-id, remove-cell-from-group). Every one is listed on this page with its risk.
Is Draw.io safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B. Separately from the audit: 3 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does Draw.io need?
No credential environment variables were found in its source, so it appears to need none.
How does Draw.io run?
It speaks stdio and streamable-http, so it runs as a local process your client starts.
How current is this page?
The grade is for one exact copy of the source (249665e1e36a), read on 2026-10-07. The repository is watched and re-audited when it changes.