Enterprise Architect
NPM · ENTERPRISE-ARCHITECT-MCP · SCANNED SEP 21
Read-only search and navigation of Sparx Enterprise Architect .qea model exports
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 35 of 120 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to mm6502/enterprise-architect-mcp). View diagnostics → Pass
- Clear OSI-approved license (EUPL-1.2).Pass
- Actively maintained (last published 12 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability66
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3812 tokens (~317/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management75
- Stability check failed: the tool surface changed between 2.2.0 and 3.0.0: 0 tool removals, 1 breaking changes, 1 additions. See how to fix → Fail
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the Enterprise Architect MCP server?
Enterprise Architect runs locally as an npm package, launched with npx -y enterprise-architect-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · enterprise-architect-mcp
claude mcp add mm6502-enterprise-architect-mcp -- npx -y enterprise-architect-mcp
{
"mcpServers": {
"mm6502-enterprise-architect-mcp": {
"command": "npx",
"args": [
"-y",
"enterprise-architect-mcp"
]
}
}
} {
"servers": {
"mm6502-enterprise-architect-mcp": {
"command": "npx",
"args": [
"-y",
"enterprise-architect-mcp"
]
}
}
} codex mcp add mm6502-enterprise-architect-mcp -- npx -y enterprise-architect-mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"mm6502-enterprise-architect-mcp": {
"type": "local",
"command": [
"npx",
"-y",
"enterprise-architect-mcp"
],
"enabled": true
}
}
} openclaw mcp add mm6502-enterprise-architect-mcp --command npx --arg -y --arg enterprise-architect-mcp
mcp_servers:
mm6502-enterprise-architect-mcp:
command: "npx"
args: ["-y", "enterprise-architect-mcp"] {
"McpServers": {
"mm6502-enterprise-architect-mcp": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"enterprise-architect-mcp"
]
}
}
} assistant mcp add mm6502-enterprise-architect-mcp -t stdio -c npx -a -y enterprise-architect-mcp
{
"mcpServers": {
"mm6502-enterprise-architect-mcp": {
"command": "npx",
"args": [
"-y",
"enterprise-architect-mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 69 to 72.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 62 to 65.
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 55 to 59.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 45 to 49.
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 39 to 42.
- 9 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 32 to 35.
- 8 Sept 26 0
- Tool safety: pass → unverified ▼ security
- Stability: 0.33 → unverified ▼ security
- Stability: 0.33 → fail ▼ security
- Schema quality: 278 → 317 ▼ functional
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- First check of Schema quality: unverified functional
- Package version: 2.4.0 → 3.0.0 functional
- 5 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 21 Sept 2026 · Analysed npm/enterprise-architect-mcp@3.0.0
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | mm6502/enterprise-architect-mcp |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/mm6502/enterprise-architect-mcp/.github/workflows/release.yml@refs/heads/main |
| Rekor log index | 2762439332 |
| Predicate type | https://slsa.dev/provenance/v1 |
| Subject digest | sha512:baac77cf92a46a9591399dca422b4e250f62fffb21634e244b76af3fb54c52d97b412c530b62e1cf96dc3a2c0e315b72753f4e7793851af2a71e22a74 |
Background: How many MCP packages publish verified provenance →
Dependencies 120 packages
| Packages resolved | 120 |
|---|---|
| Stale | 35 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
ea_get_connectors ~223
Get all relationships (connectors) for a given element. `connectors` lists what the element is connected to and how (Realisation, Dependency, Association, etc.), each entry naming its `source` and `dest` ends. For Generalization connectors, `source` is always the specific (child) type and `dest` the general (parent) type — each end also carries a `role` making this explicit without needing to reason about direction. Filter by `connectorType` and `direction` to list an element's direct children (incoming Generalization) or direct parent(s) (outgoing Generalization) without a diagram. Feature links show which specific attribute or operation each end attaches to.
| Name | Type | Req | Description |
|---|---|---|---|
| connectorType | string | – | Filter by connector type (e.g., Realisation, Dependency, Association, InformationFlow, Generalization) |
| direction | string | – | Filter direction: outgoing (element is source), incoming (element is target), or both |
| elementId | number | yes | The Object_ID of the element to get connectors for |
No output schema declared.
No examples provided.
ea_get_diagram_elements ~118
Get all elements and connectors placed on a specific diagram: the `diagram` itself, plus `elements` and `connectors`. `elements` already includes free-text `Note` diagram objects, which often carry a legend or abbreviation definitions an agent would otherwise miss. Connectors include feature-link resolution showing which attribute or operation each end attaches to. The connector list is the union of explicit t_diagramlinks rows and implied connectors (both ends on the diagram).
| Name | Type | Req | Description |
|---|---|---|---|
| diagramId | number | yes | The Diagram_ID to get elements for |
No output schema declared.
No examples provided.
ea_get_element ~176
Get full details of an Enterprise Architect element by its ID, including its `Note`, `attributes`, `operations`, the `diagrams` it appears on, and its `constraints`. Attribute multiplicity supports a requiredness inference only when the element uses multiplicities contrastively; read `_meta.attributes.multiplicityIsUniform` before making that inference — when it is true the element's attributes carry no multiplicity contrast, so a value like 1..1 is not evidence of requiredness. Attributes and operations are capped inline: `attributesTruncated`/`operationsTruncated` say whether the returned list is partial, and `attributesTotal`/`operationsTotal` give the full counts, so never infer a count from the inline list alone.
| Name | Type | Req | Description |
|---|---|---|---|
| elementId | number | yes | The Object_ID of the element to retrieve |
No output schema declared.
No examples provided.
ea_get_model_info ~174
Report which .qea export file the server has open: `fileName` is the citable identity, alongside `fileSizeBytes`, `lastModified`, and the `serverVersion` that produced the answer. The full local path is also returned as `resolvedPath`, with `resolvedPathNote` explaining why it is environment detail rather than something to cite. `configuration` says where that path came from — `source` in words, `sourceId` as one of argument/environment/dotenv/remembered/prompt, and the `configured` value behind it — plus any `skipped` settings, each with the `reason` it could not be opened, and `shadowed` ones a higher-priority source outranked; `configurationNote` says how much of that is safe to repeat.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
ea_get_package_tree ~101
Navigate the package hierarchy. Without parameters, returns top-level `packages`. With a `packageId`, returns that package's children up to the specified depth. Each node carries `id`, `name`, `parentId`, and `elementCount`.
| Name | Type | Req | Description |
|---|---|---|---|
| depth | number | – | How many levels deep to recurse (max 3, default 1) |
| packageId | number | – | Package ID to get children of. Omit for top-level packages. |
No output schema declared.
No examples provided.
ea_get_scenarios ~167
Get use case scenario flows for an element. `scenarios` holds the parsed flows; each has `name`, `type`, `notes`, and `steps`, and each step carries `stepNumber` plus its attributes (`trigger`, `uses`, `result`, `state`, `link`). Steps are numbered within each scenario. Scenarios ordered by type: Basic Path first, then Alternate, then Exception. A step's `uses` may name a business rule or constraint by code; that code is not independently searchable or resolvable — look it up among this same elementId's own constraints via `ea_get_element`, not by a separate lookup.
| Name | Type | Req | Description |
|---|---|---|---|
| elementId | number | yes | The Object_ID of the element (typically a UseCase) to get scenarios for |
No output schema declared.
No examples provided.
ea_get_schema ~143
List the model's database tables in `tables`, or pass a `tableName` to get that table's `columns` and `indexes` instead. That form echoes the `table` name and adds `rowidAlias` — the INTEGER PRIMARY KEY aliasing SQLite's rowid, so the fastest lookup path, or null when the table has none — with `rowidNote` saying which case applies. Use this to discover what data the model holds beyond what the typed ea_* tools return. See ea_get_model_info for the export's identity.
| Name | Type | Req | Description |
|---|---|---|---|
| tableName | string | – | Table name to inspect. Omit to list all tables with row counts. |
No output schema declared.
No examples provided.
ea_list_diagrams ~270
List diagrams in the model, optionally filtered by package, diagram type, and/or name substring. Each entry in `results` carries `diagramId`, `name`, `type`, `packagePath`, and `eaGuid`. Diagrams are ordered by the model's internal identity — stable but artificial, neither alphabetical nor the analyst's tree order — so adjacency carries no meaning. Walk a large result set with `offset` rather than a larger `limit`; while rows remain, `continuation` names the next call. When far more diagrams match than one window can hold, `breakdown` reports how many each type holds, so the next call can narrow by `diagramType` instead of paging.
| Name | Type | Req | Description |
|---|---|---|---|
| diagramType | string | – | Filter by diagram type (e.g., Logical, Use Case, Sequence, Activity, Component) |
| limit | integer | – | Maximum number of results to return (default 50) |
| nameContains | string | – | Filter to diagrams whose name contains this substring (case- and diacritic-insensitive across European Latin alphabets) |
| offset | integer | – | Zero-based index of the first result to return (default 0). Page by re-calling with the offset carried in continuation. |
| packageId | number | – | Filter to diagrams in this package |
No output schema declared.
No examples provided.
ea_list_elements ~228
List elements within a package, optionally filtered by object type. `elements` is a lightweight list (ID, type, name, alias, stereotype), grouped by element type and then ordered by the model's internal identity. That order is stable but artificial — neither alphabetical nor the analyst's tree order — so adjacency carries no meaning. Walk a large package with `offset` rather than a larger `limit`; while rows remain, `continuation` names the next call. When far more elements match than one window can hold, `breakdown` reports how many each type holds, so the next call can narrow by `objectType` instead of paging.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | – | Maximum number of results to return (default 50) |
| objectType | string | – | Filter by object type (e.g., Class, UseCase, Activity, Screen) |
| offset | integer | – | Zero-based index of the first result to return (default 0). Page by re-calling with the offset carried in continuation. |
| packageId | number | yes | The Package_ID to list elements from |
No output schema declared.
No examples provided.
ea_resolve ~238
Resolve an analyst reference (braced GUID or plain name) to model candidates: the input is echoed as `reference` and the hits are in `candidates`. A braced GUID is matched exactly. A plain name is matched against the full name first; only if nothing matches exactly is the reference retried as a name prefix, which resolves analyst codes like UC_ABC_2079 or OA_ABC_2280 to elements named 'CODE: description'. An exact hit is returned alone and is never diluted by prefix hits. Each candidate reports its `type` (element, diagram, package), `id`, `name`, `fullPackagePath`, `eaGuid`, and a `match` field that is always present with value "guid", "exact", or "prefix" — a "prefix" candidate is an inexact match and must not be treated as a confirmed identity. Use the optional `kind` filter to narrow results.
| Name | Type | Req | Description |
|---|---|---|---|
| kind | string | – | Filter candidates to a specific kind |
| reference | string | yes | The reference to resolve: a braced GUID like {ABC-123} or a plain name |
No output schema declared.
No examples provided.
ea_search ~689
Search Enterprise Architect model elements by name, alias, notes, attribute names/notes, operation names/notes, or constraint notes. Matching is case- and diacritic-insensitive across European Latin alphabets and sees through entity-encoded text. `requiredTerms` is a list of terms every one of which must occur somewhere in an element's searchable text (conjunction) — terms need not share a field, but sharing one ranks higher; each term is matched as a contiguous substring exactly as a single term is, so a term carrying whitespace is a phrase and is never split. A one-entry list behaves exactly as a single search term always has. `boostAnyOf` is an optional list of further terms: a result also matching at least one of them ranks ahead of one that does not, but nothing is ever excluded on that basis — for narrowing to only elements matching an alternative too, use `ea_search_and_any_of` instead. When no element matches, `termMatches` reports, per supplied term, whether that term matched anywhere in the corpus at all — so a caller can tell which term emptied the result rather than re-guessing the whole call. Matching elements are returned in `results`, strongest match first, each with a decoded note preview and a truncation flag; equally strong matches fall back to the model's internal identity, a stable but artificial order. Each result also carries `matches`, the evidence for why it was returned: the field that matched, the id and name of the attribute, operation or constraint it came from, and a snippet of the author's own text around the match. Evidence is strongest-first and capped, and `_meta.matches` on the result reports how many matches were found and how many were withheld. The note preview centres on the match when the element's own note is what matched. `packageScope` restricts results to a package (given as its id or its name) and its descendants. Walk a large result set with `offset` rather than a larger `limit`; while rows remain, `continuation` names t…
| Name | Type | Req | Description |
|---|---|---|---|
| boostAnyOf | array | – | Terms that promote a result's rank when also present; never excludes. Use ea_search_and_any_of to narrow instead. |
| limit | integer | – | Maximum number of results to return (default 25) |
| objectType | string | – | Filter by object type (e.g., Class, UseCase, Activity, Screen, Requirement, Interface, Component) |
| offset | integer | – | Zero-based index of the first result to return (default 0). Page by re-calling with the offset carried in continuation. |
| packageScope | – | – | Restrict results to this package and its descendants, given as a package id or name |
| requiredTerms | array | yes | Terms every one of which must occur somewhere in the element's searchable text (names, notes, aliases, attributes, operations, constraints); terms need not share a field; capped at 10 |
| stereotype | string | – | Filter by stereotype |
No output schema declared.
No examples provided.
ea_search_and_any_of ~509
Search Enterprise Architect model elements the same way `ea_search` does, plus `andAnyOf`: a required-and-alternative filter. `requiredTerms` still works exactly as it does on `ea_search` (conjunction, contiguous substring, terms need not share a field). `andAnyOf` is an optional list of further terms; when supplied, a result must contain `requiredTerms` AND at least one `andAnyOf` term, so it can only ever narrow — it never returns a result `requiredTerms` alone would not. An empty `andAnyOf` array applies no filter. For promoting rather than narrowing, use `ea_search` instead, which offers the same alternatives idea as a rank boost. When no element matches the required terms at all, `termMatches` reports, per supplied term, whether it matched anywhere in the corpus. Matching elements are returned in `results`, strongest first, each with a decoded note preview, a truncation flag, and `matches` — the evidence for why it was returned, capped and strongest-first, with `_meta.matches` reporting how many were found and withheld. `packageScope` restricts results to a package and its descendants. Walk a large result set with `offset`; while rows remain, `continuation` names the next call. When far more elements match than one window can hold, `breakdown` reports how they distribute by `objectType`, `stereotype`, or `packageScope`.
| Name | Type | Req | Description |
|---|---|---|---|
| andAnyOf | array | – | Terms a result must also contain at least one of, in addition to requiredTerms; never adds results. Use ea_search's boostAnyOf to only reorder instead. |
| limit | integer | – | Maximum number of results to return (default 25) |
| objectType | string | – | Filter by object type (e.g., Class, UseCase, Activity, Screen, Requirement, Interface, Component) |
| offset | integer | – | Zero-based index of the first result to return (default 0). Page by re-calling with the offset carried in continuation. |
| packageScope | – | – | Restrict results to this package and its descendants, given as a package id or name |
| requiredTerms | array | yes | Terms every one of which must occur somewhere in the element's searchable text (names, notes, aliases, attributes, operations, constraints); terms need not share a field; capped at 10 |
| stereotype | string | – | Filter by stereotype |
No output schema declared.
No examples provided.
What is the Enterprise Architect MCP server?
Enterprise Architect is an MCP server listed in the public MCP registry as io.github.mm6502/enterprise-architect-mcp. Read-only search and navigation of Sparx Enterprise Architect .qea model exports. This page covers its npm package (enterprise-architect-mcp).
Is the Enterprise Architect MCP server safe to use?
Enterprise Architect scores 89 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Enterprise Architect MCP server expose?
Enterprise Architect exposes 12 tools: ea_search, ea_search_and_any_of, ea_get_element, ea_list_elements, ea_get_connectors, and 7 more. Their descriptions and schemas cost roughly 3,036 tokens of context every time the server is loaded.
Is the Enterprise Architect MCP server still maintained?
Enterprise Architect is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Enterprise Architect MCP server under?
Enterprise Architect declares the EUPL-1.2 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.