# io.github.hj1003862396/draw-flow-mcp-server (npm · @io.github.hj1003862396/draw-flow-mcp-server)
MCP server for Next AI Draw.io - AI-powered diagram generation with real-time browser preview
- Trust score: 64/100 (medium)
- Change this week: +13
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03
## Components
- npm · `@io.github.hj1003862396/draw-flow-mcp-server`: 64/100 (this document), [markdown](https://verifymcp.io/servers/hj1003862396-draw-flow-mcp-server/io-github-hj1003862396-draw-flow-mcp-server.md), [page](https://verifymcp.io/servers/hj1003862396-draw-flow-mcp-server/io-github-hj1003862396-draw-flow-mcp-server)
## Channel facts
- Registry: `npm`
- Package: `@io.github.hj1003862396/draw-flow-mcp-server`
- Version: `1.0.2`
- Transport: `stdio`
## Trust breakdown
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)
Scored 2026-08-03.
- **Supply Chain Security**: 87/100
- No malware found by supply-chain analysis.
- Only part of the dependency tree could be resolved (126 of 130), so this covers what we could see, not the whole tree.
- No install/post-install scripts declared.
- Only part of the dependency tree could be resolved (126 of 130), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
- Source repository is publicly reachable at the declared URL.
- Provenance check failed: no build-provenance attestation is published.
- Clear OSI-approved license (Apache-2.0).
- Actively maintained (last published 203 days ago).
- Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 71/100
- 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
- AI-judged instruction clarity (good).
- Context-footprint check failed: tool/resource definitions use about 1008 tokens (~201/item across 5 items; 5 tools + 0 resources), over budget; trim descriptions and params.
- Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
- Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).
- 100% of tool parameters carry a description.
- **Capabilities**: 100/100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.
**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
## Install
### Claude
```bash
claude mcp add hj1003862396-draw-flow-mcp-server -- npx -y @io.github.hj1003862396/draw-flow-mcp-server
```
### Codex
```bash
codex mcp add hj1003862396-draw-flow-mcp-server -- npx -y @io.github.hj1003862396/draw-flow-mcp-server
```
### opencode
```json
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"hj1003862396-draw-flow-mcp-server": {
"type": "local",
"command": [
"npx",
"-y",
"@io.github.hj1003862396/draw-flow-mcp-server"
],
"enabled": true
}
}
}
```
### OpenClaw
```bash
openclaw mcp add hj1003862396-draw-flow-mcp-server --command npx --arg -y --arg @io.github.hj1003862396/draw-flow-mcp-server
```
### Hermes
```yaml
mcp_servers:
hj1003862396-draw-flow-mcp-server:
command: "npx"
args: ["-y", "@io.github.hj1003862396/draw-flow-mcp-server"]
```
### Other
```json
{
"mcpServers": {
"hj1003862396-draw-flow-mcp-server": {
"command": "npx",
"args": [
"-y",
"@io.github.hj1003862396/draw-flow-mcp-server"
]
}
}
}
```
## Changelog
Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.
### 2026-08-03 (score 64, +44)
- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] License: unverified → pass
- [functional improvement] Schema quality: unverified → 100
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Schema quality: unverified → good
- [functional improvement] Tool coverage: unverified → 100
- [functional] Licence: Apache-2.0
### 2026-08-02 (score 20, −5)
- [security improvement] Malware scan: unverified → pass
- [functional regression] Tool coverage: 100 → unverified
- [functional regression] Schema quality: 100 → unverified
### 2026-07-31 (score 25, −26)
- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server
### 2026-07-27 (score 51)
First indexed and scored.
## MCP tools (5)
### `start_session` (~45 tokens)
Start a new diagram session and open the browser for real-time preview. Starts an embedded server and opens a browser window with draw.io. The browser will show diagram updates as they happen.
### `create_new_diagram` (~488 tokens)
Create a NEW diagram from mxGraphModel XML. Use this when creating a diagram from scratch or replacing the current diagram entirely.
CRITICAL: You MUST provide the 'xml' argument in EVERY call. Do NOT call this tool without xml.
When to use this tool:
\- Creating a new diagram from scratch
\- Replacing the current diagram with a completely different one
\- Major structural changes that require regenerating the diagram
When to use edit_diagram instead:
\- Small modifications to existing diagram
\- Adding/removing individual elements
\- Changing labels, colors, or positions
XML FORMAT - Full mxGraphModel structure:
\
\
\
\
LAYOUT CONSTRAINTS:
\- Keep all elements within x=0-800, y=0-600 (single page viewport)
\- Start from margins (x=40, y=40), keep elements grouped closely
\- Use unique IDs starting from "2" (0 and 1 are reserved)
\- Set parent="1" for top-level shapes
\- Space shapes 150-200px apart for clear edge routing
EDGE ROUTING RULES:
\- Never let multiple edges share the same path - use different exitY/entryY values
\- For bidirectional connections (A↔B), use OPPOSITE sides
\- Always specify exitX, exitY, entryX, entryY explicitly in edge style
\- Route edges AROUND obstacles using waypoints (add 20-30px clearance)
\- Use natural connection points based on flow (not corners)
COMMON STYLES:
\- Shapes: rounded=1; fillColor=#hex; strokeColor=#hex
\- Edges: endArrow=classic; edgeStyle=orthogonalEdgeStyle; curved=1
\- Text: fontSize=14; fontStyle=1 (bold); align=center
Input parameters:
- `xml` (string, required): REQUIRED: The complete mxGraphModel XML. Must always be provided.
### `edit_diagram` (~381 tokens)
Edit the current diagram by ID-based operations (update/add/delete cells).
⚠️ REQUIRED: You MUST call get_diagram BEFORE this tool!
This fetches the latest state from the browser including any manual user edits.
Skipping get_diagram WILL cause user's changes to be LOST.
Workflow:
1\. Call get_diagram to see current cell IDs and structure
2\. Use the returned XML to construct your edit operations
3\. Call edit_diagram with your operations
Operations:
\- add: Add a new cell. Provide cell_id (new unique id) and new_xml.
\- update: Replace an existing cell by its id. Provide cell_id and complete new_xml.
\- delete: Remove a cell by its id. Only cell_id is needed.
For add/update, new_xml must be a complete mxCell element including mxGeometry.
Example - Add a rectangle:
{"operations": [{"operation": "add", "cell_id": "rect-1", "new_xml": ""}]}
Example - Update a cell:
{"operations": [{"operation": "update", "cell_id": "3", "new_xml": ""}]}
Example - Delete a cell:
{"operations": [{"operation": "delete", "cell_id": "rect-1"}]}
Input parameters:
- `operations` (array, required): Array of operations to apply
### `get_diagram` (~53 tokens)
Get the current diagram XML (fetches latest from browser, including user's manual edits). Call this BEFORE edit_diagram if you need to update or delete existing elements, so you can see the current cell IDs and structure.
### `export_diagram` (~41 tokens)
Export the current diagram to a .drawio file.
Input parameters:
- `path` (string, required): File path to save the diagram (e.g., ./diagram.drawio)
## Diagnostics
Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/hj1003862396-draw-flow-mcp-server/io-github-hj1003862396-draw-flow-mcp-server#diagnostics
## Score history
- 2026-08-03: 64
- 2026-08-02: 20
- 2026-08-01: 25
- 2026-07-31: 25
- 2026-07-30: 51
- 2026-07-28: 51
- 2026-07-27: 51
## Links
- npm package: https://www.npmjs.com/package/@io.github.hj1003862396/draw-flow-mcp-server
- Socket report: https://socket.dev/npm/package/@io.github.hj1003862396/draw-flow-mcp-server
- Repository: https://github.com/hj1003862396/draw-flow-mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/hj1003862396-draw-flow-mcp-server/io-github-hj1003862396-draw-flow-mcp-server/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/hj1003862396-draw-flow-mcp-server/io-github-hj1003862396-draw-flow-mcp-server/changelog.json
- HTML version of this page: https://verifymcp.io/servers/hj1003862396-draw-flow-mcp-server/io-github-hj1003862396-draw-flow-mcp-server