diagonaldiagrams
PYPI · DIAGONALDIAGRAMS
Diagrams and charts for agents: Mermaid or a spec in, an audited SVG out.
Available components
Last scanned (14 hours ago)
Scores higher than 81% of PyPI servers
Category Design and Media
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- Runs setuptools.build_meta at install time, a recognised build step with no custom scripting around it. View diagnostics → Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to lucas19919/diagonaldiagrams). View diagnostics → Pass
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 3 days ago).Pass
- Security-disclosure policy not yet verified: we couldn't inspect the source repository.Unverified
Schema Quality & AI Usability67
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 1651 tokens (~183/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management13
- Stability observed for 4 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 9 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 9 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities60
- Spec-recency check failed: implements MCP spec 2025-06-18; the latest is 2026-07-28. See how to fix → Fail
Checks we ran (15)
- Malware scan
- Known CVEs
- Install scripts
- Dependency health
- Source repository
- Provenance
- License
- Maintenance
- Schema quality
- Stability
- Tool coverage
- Injection markers
- Destructive annotations
- Judged manipulation
- MCP protocol
Checks we could not complete (1)
These are gaps on our side, not findings about this package. We only credit what we can confirm, so a category made up entirely of them scores 0.
- Security disclosure in Provenance & TransparencySecurity-disclosure policy not yet verified: we couldn't inspect the source repository.
Does not apply to this package (2)
- Endpoint SecurityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
- Transport & ReachabilityScored on hosted endpoints only. A package has no live endpoint of its own for us to probe.
The score does not measure everything. What the score does not measure →
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 5 Nov 26 +16
- Malware scan: unverified → pass ▲ security
- Security disclosure: fail → unverified ▼ functional
- 3 Nov 26 −14
- Malware scan: pass → unverified ▼ security
- 1 Nov 26 78
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed pypi/diagonaldiagrams@0.9.1
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | pypi |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | lucas19919/diagonaldiagrams |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/lucas19919/diagonaldiagrams/.github/workflows/publish.yml@refs/tags/v0.9.1 |
| Rekor log index | 3634841557 |
| Predicate type | PyPI publish attestation https://docs.pypi.org/attestations/publish/v1 |
| Subject digest | sha256:c79e8e1946f07fbb08e27b9ddf613a7e2942b526f017364c674ab90df0f1455e |
Background: How many MCP packages publish verified provenance →
Install scripts 1 script
| Hook | Tier | Command |
|---|---|---|
| build_backend | Known build tool | setuptools.build_meta |
Background: Why install scripts are a supply-chain risk →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
apply Patch a spec file ~138
Edit a spec file with a patch instead of rewriting it: move or reorder items, rename text, change colors, add or remove things, or move them into a group, so a regenerated spec keeps the change. Changes the spec file in place and writes the patch beside it (SPEC.patch.json). Render the spec to the same out path again; changed in the result says what moved.
| Name | Type | Req | Description |
|---|---|---|---|
| patch | – | yes | A list of operations (place, order, style, text, add, remove, move-to-group), or the path of a patch file. |
| spec | string | yes | Path of the spec file to change. It is edited in place. |
No output schema declared.
No examples provided.
audit Audit an SVG ~127
Check a finished SVG or HTML figure for what you cannot see in your own output: text over text, arrows through boxes, text that spills out of its shape, low contrast, tiny text, and in 3D figures text hidden behind a nearer face. Works on any SVG on disk, not only ones this tool drew. Returns JSON: ok, errors with a fix, and warnings. Read-only. render already audits its own output, so use this after hand edits or on a figure from elsewhere.
| Name | Type | Req | Description |
|---|---|---|---|
| path | string | yes | Path of the .svg or .html figure to check. |
No output schema declared.
No examples provided.
describe Describe a figure type ~100
Look up how to write a spec. With a figure type it returns that type's spec shape, rules, size budgets and an example; with no type it lists every type. Also takes style and story. Read-only, writes nothing. Call it before render when you are unsure of the shape.
| Name | Type | Req | Description |
|---|---|---|---|
| type | string | – | Figure type to describe, e.g. flow, arch, iso, bar, style or story. Omit to list all types. |
No output schema declared.
No examples provided.
diff Compare two drawings ~92
Say what changed between two drawings of the same figure (.svg or .html): items added, removed, renamed, moved, reordered or recolored, as JSON and plain sentences. Read-only. Use it after apply or an edit to confirm the change did what you meant.
| Name | Type | Req | Description |
|---|---|---|---|
| new | string | yes | The later drawing (.svg or .html). |
| old | string | yes | The earlier drawing (.svg or .html). |
No output schema declared.
No examples provided.
export Export a figure to another format ~194
Redraw a rendered figure as png, pdf, svg, drawio or excalidraw. It reads the receipt (OUT.graph.json) that render wrote beside the figure, so the figure must have been drawn by this tool. Writes the new file next to it, or at out, and returns the path as a line of text. png and pdf need cairosvg or headless Edge or Chrome. Overwrites an existing file at the same path.
| Name | Type | Req | Description |
|---|---|---|---|
| layout | string | – | Page preset for png and pdf: figure (760 px wide, default), wide (1120), slide (1280) or social (1080). |
| out | string | – | Where to write the file. Default: beside the figure. |
| path | string | yes | The figure's base path, or its .html or .svg. OUT.graph.json must sit beside it. |
| to | string | – | Output format. Default png. |
No output schema declared.
No examples provided.
infer Suggest a scatter spec from a CSV ~92
Propose a starting spec for a scatter chart from a CSV. Returns the spec as JSON to edit and pass to render. Read-only: it suggests and draws nothing. Only for scatter charts; for other charts, describe the type and write the spec yourself.
| Name | Type | Req | Description |
|---|---|---|---|
| data | string | – | CSV text, inline. Give this or path. |
| path | string | – | A CSV file on disk. Give this or data. |
No output schema declared.
No examples provided.
render Draw and audit a figure ~446
Draw one figure and audit it in a single call. Validates the input, lays it out, writes OUT.svg, OUT.html and a receipt (OUT.graph.json) side by side, then checks the drawing. Returns one JSON line: ok, the file paths, a layout outline and any warnings. When ok is false, each error has a fix: change the spec or options and call render again. Overwrites files at the same out path. Use validate to check an input without drawing, and audit for an SVG this tool did not just draw.
| Name | Type | Req | Description |
|---|---|---|---|
| data | string | – | CSV, GeoJSON or Mermaid text, inline. Give exactly one of spec, scene, data or path. |
| options | object | – | CLI flags without dashes, e.g. {"x": "month", "y": "signups", "group": "product", "title": "...", "highlight": ["Atlas"]}. describe lists them. Diagrams also take "style": a stylesheet object (or a l… |
| out | string | – | Output path ending .html (default diagonaldiagrams-out.html). The .svg and the receipt are written beside it. |
| path | string | – | A spec, scene, CSV or Mermaid file on disk, instead of inline input. |
| scene | object | – | A v2 scene, inline: {"preset": "flow", "nodes": [...], "edges": [...], "groups": [...]}; type names its preset. Give exactly one of spec, scene, data or path. |
| spec | object | – | The figure as a JSON object, inline, in the shape `describe <type>` prints. Give exactly one of spec, scene, data or path. |
| type | string | yes | Figure type: mermaid (data is Mermaid text), flow, arch, seq, schema, iso (3D layer stack), bar, line, scatter, geo, or any chart type that describe lists. |
No output schema declared.
No examples provided.
story Build an animated story page ~106
Present one figure as a story: a story file lists views that focus, dim, highlight and reveal parts of it, and one HTML page animates between them. Writes OUT.html and returns JSON with ok, the path and the views; overwrites an existing page. describe story shows the story file's shape. For a plain figure use render.
| Name | Type | Req | Description |
|---|---|---|---|
| out | string | yes | The page to write, ending .html. |
| story | string | yes | Path of the story file (JSON). |
No output schema declared.
No examples provided.
validate Validate a spec ~356
Check an input without drawing anything: a spec, scene or CSV. Returns JSON with ok and, on failure, errors that each carry a fix. Read-only, and cheaper than render while you are still shaping the spec. For a finished drawing use audit.
| Name | Type | Req | Description |
|---|---|---|---|
| data | string | – | CSV, GeoJSON or Mermaid text, inline. Give exactly one of spec, scene, data or path. |
| options | object | – | CLI flags without dashes, e.g. {"x": "month", "y": "signups", "group": "product", "title": "...", "highlight": ["Atlas"]}. describe lists them. Diagrams also take "style": a stylesheet object (or a l… |
| path | string | – | A spec, scene, CSV or Mermaid file on disk, instead of inline input. |
| scene | object | – | A v2 scene, inline: {"preset": "flow", "nodes": [...], "edges": [...], "groups": [...]}; type names its preset. Give exactly one of spec, scene, data or path. |
| spec | object | – | The figure as a JSON object, inline, in the shape `describe <type>` prints. Give exactly one of spec, scene, data or path. |
| type | string | yes | Figure type: mermaid (data is Mermaid text), flow, arch, seq, schema, iso (3D layer stack), bar, line, scatter, geo, or any chart type that describe lists. |
No output schema declared.
No examples provided.
How do I install the diagonaldiagrams MCP server?
diagonaldiagrams runs locally as a PyPI package, launched with uvx diagonaldiagrams mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
pypi · diagonaldiagrams
claude mcp add lucas19919-diagonaldiagrams -- uvx diagonaldiagrams mcp
What is the diagonaldiagrams MCP server?
diagonaldiagrams is an MCP server listed in the public MCP registry as io.github.lucas19919/diagonaldiagrams. Diagrams and charts for agents: Mermaid or a spec in, an audited SVG out. This page covers its PyPI package (diagonaldiagrams).
Is the diagonaldiagrams MCP server safe to use?
diagonaldiagrams scores 80 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 5 November 2026. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the diagonaldiagrams MCP server expose?
diagonaldiagrams exposes 9 tools: describe, render, validate, audit, export, and 4 more. Their descriptions and schemas cost roughly 1,651 tokens of context every time the server is loaded.
Is the diagonaldiagrams MCP server still maintained?
diagonaldiagrams is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the diagonaldiagrams MCP server under?
diagonaldiagrams declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.
What did VerifyMCP test on the diagonaldiagrams MCP server?
VerifyMCP ran 15 checks on diagonaldiagrams, covering Malware scan, Known CVEs, Install scripts, Dependency health and 11 more. One item could not be completed, a gap on our side rather than a finding about diagonaldiagrams: Security disclosure. Endpoint Security and Transport & Reachability do not apply to a PyPI package, so they were not tested. The score does not measure everything, and the scoring documentation lists what it leaves out.