# Enterprise Architect (npm · enterprise-architect-mcp)

Read-only search and navigation of Sparx Enterprise Architect .qea model exports

- Trust score: 89/100 (high trust)
- Change this week: +3
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-09-21

## Components

- npm · `enterprise-architect-mcp`: 89/100 (this document), [markdown](https://verifymcp.io/servers/mm6502-enterprise-architect-mcp/enterprise-architect-mcp.md), [page](https://verifymcp.io/servers/mm6502-enterprise-architect-mcp/enterprise-architect-mcp)

## Channel facts

- Registry: `npm`
- Package: `enterprise-architect-mcp`
- Version: `3.0.0`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-09-21.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 35 of 120 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 97/100
  - Source repository is publicly reachable at the declared URL.
  - Cryptographically verified build provenance (signed, bound to mm6502/enterprise-architect-mcp).
  - Clear OSI-approved license (EUPL-1.2).
  - Actively maintained (last published 12 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 66/100
  - AI-judged instruction clarity (excellent).
  - Context-footprint check failed: tool/resource definitions use about 3812 tokens (~317/item across 12 items; 12 tools + 0 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 75/100
  - Stability check failed: the tool surface changed between 2.2.0 and 3.0.0: 0 tool removals, 1 breaking changes, 1 additions.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - We read all 12 captured tool definition(s), and no name or description among them implies an irreversible operation.
  - An AI judge read all 13 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### How do I install the Enterprise Architect MCP server?

Enterprise Architect runs locally as an npm package, launched with npx -y enterprise-architect-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add mm6502-enterprise-architect-mcp -- npx -y enterprise-architect-mcp
```

### Cursor

```json
{
  "mcpServers": {
    "mm6502-enterprise-architect-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "enterprise-architect-mcp"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "mm6502-enterprise-architect-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "enterprise-architect-mcp"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add mm6502-enterprise-architect-mcp -- npx -y enterprise-architect-mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "mm6502-enterprise-architect-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "enterprise-architect-mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add mm6502-enterprise-architect-mcp --command npx --arg -y --arg enterprise-architect-mcp
```

### Hermes

```yaml
mcp_servers:
  mm6502-enterprise-architect-mcp:
    command: "npx"
    args: ["-y", "enterprise-architect-mcp"]
```

### Netclaw

```json
{
  "McpServers": {
    "mm6502-enterprise-architect-mcp": {
      "Transport": "stdio",
      "Command": "npx",
      "Arguments": [
        "-y",
        "enterprise-architect-mcp"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add mm6502-enterprise-architect-mcp -t stdio -c npx -a -y enterprise-architect-mcp
```

### Other

```json
{
  "mcpServers": {
    "mm6502-enterprise-architect-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "enterprise-architect-mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-09-20 (score 89, +1)

No change was recorded against any check on this day. Stability & Change Management went from 69 to 72.

### 2026-09-18 (score 88, +1)

No change was recorded against any check on this day. Stability & Change Management went from 62 to 65.

### 2026-09-16 (score 87, +1)

No change was recorded against any check on this day. Stability & Change Management went from 55 to 59.

### 2026-09-13 (score 86, +1)

No change was recorded against any check on this day. Stability & Change Management went from 45 to 49.

### 2026-09-11 (score 85, +1)

No change was recorded against any check on this day. Stability & Change Management went from 39 to 42.

### 2026-09-09 (score 84, +1)

No change was recorded against any check on this day. Stability & Change Management went from 32 to 35.

### 2026-09-08 (score 83, 0)

- [security regression] Tool safety: pass → unverified
- [security regression] Stability: 0.33 → unverified
- [security regression] Stability: 0.33 → fail
- [functional regression] Schema quality: 278 → 317
- [functional regression] Capabilities: pass → unverified
- [functional regression] Tool coverage: 100 → unverified
- [functional] First check of Schema quality: unverified
- [functional] Package version: 2.4.0 → 3.0.0

### 2026-09-05 (score 83, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

## MCP tools (12)

### `ea_search` (~689 tokens)

Search Enterprise Architect model elements by name, alias, notes, attribute names/notes, operation names/notes, or constraint notes. Matching is case- and diacritic-insensitive across European Latin alphabets and sees through entity-encoded text. `requiredTerms` is a list of terms every one of which must occur somewhere in an element's searchable text (conjunction) — terms need not share a field, but sharing one ranks higher; each term is matched as a contiguous substring exactly as a single term is, so a term carrying whitespace is a phrase and is never split. A one-entry list behaves exactly as a single search term always has. `boostAnyOf` is an optional list of further terms: a result also matching at least one of them ranks ahead of one that does not, but nothing is ever excluded on that basis — for narrowing to only elements matching an alternative too, use `ea_search_and_any_of` instead. When no element matches, `termMatches` reports, per supplied term, whether that term matched anywhere in the corpus at all — so a caller can tell which term emptied the result rather than re-guessing the whole call. Matching elements are returned in `results`, strongest match first, each with a decoded note preview and a truncation flag; equally strong matches fall back to the model's internal identity, a stable but artificial order. Each result also carries `matches`, the evidence for why it was returned: the field that matched, the id and name of the attribute, operation or constraint it came from, and a snippet of the author's own text around the match. Evidence is strongest-first and capped, and `_meta.matches` on the result reports how many matches were found and how many were withheld. The note preview centres on the match when the element's own note is what matched. `packageScope` restricts results to a package (given as its id or its name) and its descendants. Walk a large result set with `offset` rather than a larger `limit`; while rows remain, `continuation` names t…

Input parameters:

- `boostAnyOf` (array): Terms that promote a result's rank when also present; never excludes. Use ea_search_and_any_of to narrow instead.
- `limit` (integer): Maximum number of results to return (default 25)
- `objectType` (string): Filter by object type (e.g., Class, UseCase, Activity, Screen, Requirement, Interface, Component)
- `offset` (integer): Zero-based index of the first result to return (default 0). Page by re-calling with the offset carried in continuation.
- `packageScope`: Restrict results to this package and its descendants, given as a package id or name
- `requiredTerms` (array, required): Terms every one of which must occur somewhere in the element's searchable text (names, notes, aliases, attributes, operations, constraints); terms need not share a field; capped at 10
- `stereotype` (string): Filter by stereotype

### `ea_search_and_any_of` (~509 tokens)

Search Enterprise Architect model elements the same way `ea_search` does, plus `andAnyOf`: a required-and-alternative filter. `requiredTerms` still works exactly as it does on `ea_search` (conjunction, contiguous substring, terms need not share a field). `andAnyOf` is an optional list of further terms; when supplied, a result must contain `requiredTerms` AND at least one `andAnyOf` term, so it can only ever narrow — it never returns a result `requiredTerms` alone would not. An empty `andAnyOf` array applies no filter. For promoting rather than narrowing, use `ea_search` instead, which offers the same alternatives idea as a rank boost. When no element matches the required terms at all, `termMatches` reports, per supplied term, whether it matched anywhere in the corpus. Matching elements are returned in `results`, strongest first, each with a decoded note preview, a truncation flag, and `matches` — the evidence for why it was returned, capped and strongest-first, with `_meta.matches` reporting how many were found and withheld. `packageScope` restricts results to a package and its descendants. Walk a large result set with `offset`; while rows remain, `continuation` names the next call. When far more elements match than one window can hold, `breakdown` reports how they distribute by `objectType`, `stereotype`, or `packageScope`.

Input parameters:

- `andAnyOf` (array): Terms a result must also contain at least one of, in addition to requiredTerms; never adds results. Use ea_search's boostAnyOf to only reorder instead.
- `limit` (integer): Maximum number of results to return (default 25)
- `objectType` (string): Filter by object type (e.g., Class, UseCase, Activity, Screen, Requirement, Interface, Component)
- `offset` (integer): Zero-based index of the first result to return (default 0). Page by re-calling with the offset carried in continuation.
- `packageScope`: Restrict results to this package and its descendants, given as a package id or name
- `requiredTerms` (array, required): Terms every one of which must occur somewhere in the element's searchable text (names, notes, aliases, attributes, operations, constraints); terms need not share a field; capped at 10
- `stereotype` (string): Filter by stereotype

### `ea_get_element` (~176 tokens)

Get full details of an Enterprise Architect element by its ID, including its `Note`, `attributes`, `operations`, the `diagrams` it appears on, and its `constraints`. Attribute multiplicity supports a requiredness inference only when the element uses multiplicities contrastively; read `_meta.attributes.multiplicityIsUniform` before making that inference — when it is true the element's attributes carry no multiplicity contrast, so a value like 1..1 is not evidence of requiredness. Attributes and operations are capped inline: `attributesTruncated`/`operationsTruncated` say whether the returned list is partial, and `attributesTotal`/`operationsTotal` give the full counts, so never infer a count from the inline list alone.

Input parameters:

- `elementId` (number, required): The Object_ID of the element to retrieve

### `ea_list_elements` (~228 tokens)

List elements within a package, optionally filtered by object type. `elements` is a lightweight list (ID, type, name, alias, stereotype), grouped by element type and then ordered by the model's internal identity. That order is stable but artificial — neither alphabetical nor the analyst's tree order — so adjacency carries no meaning. Walk a large package with `offset` rather than a larger `limit`; while rows remain, `continuation` names the next call. When far more elements match than one window can hold, `breakdown` reports how many each type holds, so the next call can narrow by `objectType` instead of paging.

Input parameters:

- `limit` (integer): Maximum number of results to return (default 50)
- `objectType` (string): Filter by object type (e.g., Class, UseCase, Activity, Screen)
- `offset` (integer): Zero-based index of the first result to return (default 0). Page by re-calling with the offset carried in continuation.
- `packageId` (number, required): The Package_ID to list elements from

### `ea_get_connectors` (~223 tokens)

Get all relationships (connectors) for a given element. `connectors` lists what the element is connected to and how (Realisation, Dependency, Association, etc.), each entry naming its `source` and `dest` ends. For Generalization connectors, `source` is always the specific (child) type and `dest` the general (parent) type — each end also carries a `role` making this explicit without needing to reason about direction. Filter by `connectorType` and `direction` to list an element's direct children (incoming Generalization) or direct parent(s) (outgoing Generalization) without a diagram. Feature links show which specific attribute or operation each end attaches to.

Input parameters:

- `connectorType` (string): Filter by connector type (e.g., Realisation, Dependency, Association, InformationFlow, Generalization)
- `direction` (string): Filter direction: outgoing (element is source), incoming (element is target), or both
- `elementId` (number, required): The Object_ID of the element to get connectors for

### `ea_get_package_tree` (~101 tokens)

Navigate the package hierarchy. Without parameters, returns top-level `packages`. With a `packageId`, returns that package's children up to the specified depth. Each node carries `id`, `name`, `parentId`, and `elementCount`.

Input parameters:

- `depth` (number): How many levels deep to recurse (max 3, default 1)
- `packageId` (number): Package ID to get children of. Omit for top-level packages.

### `ea_get_diagram_elements` (~118 tokens)

Get all elements and connectors placed on a specific diagram: the `diagram` itself, plus `elements` and `connectors`. `elements` already includes free-text `Note` diagram objects, which often carry a legend or abbreviation definitions an agent would otherwise miss. Connectors include feature-link resolution showing which attribute or operation each end attaches to. The connector list is the union of explicit t_diagramlinks rows and implied connectors (both ends on the diagram).

Input parameters:

- `diagramId` (number, required): The Diagram_ID to get elements for

### `ea_list_diagrams` (~270 tokens)

List diagrams in the model, optionally filtered by package, diagram type, and/or name substring. Each entry in `results` carries `diagramId`, `name`, `type`, `packagePath`, and `eaGuid`. Diagrams are ordered by the model's internal identity — stable but artificial, neither alphabetical nor the analyst's tree order — so adjacency carries no meaning. Walk a large result set with `offset` rather than a larger `limit`; while rows remain, `continuation` names the next call. When far more diagrams match than one window can hold, `breakdown` reports how many each type holds, so the next call can narrow by `diagramType` instead of paging.

Input parameters:

- `diagramType` (string): Filter by diagram type (e.g., Logical, Use Case, Sequence, Activity, Component)
- `limit` (integer): Maximum number of results to return (default 50)
- `nameContains` (string): Filter to diagrams whose name contains this substring (case- and diacritic-insensitive across European Latin alphabets)
- `offset` (integer): Zero-based index of the first result to return (default 0). Page by re-calling with the offset carried in continuation.
- `packageId` (number): Filter to diagrams in this package

### `ea_get_scenarios` (~167 tokens)

Get use case scenario flows for an element. `scenarios` holds the parsed flows; each has `name`, `type`, `notes`, and `steps`, and each step carries `stepNumber` plus its attributes (`trigger`, `uses`, `result`, `state`, `link`). Steps are numbered within each scenario. Scenarios ordered by type: Basic Path first, then Alternate, then Exception. A step's `uses` may name a business rule or constraint by code; that code is not independently searchable or resolvable — look it up among this same elementId's own constraints via `ea_get_element`, not by a separate lookup.

Input parameters:

- `elementId` (number, required): The Object_ID of the element (typically a UseCase) to get scenarios for

### `ea_get_schema` (~143 tokens)

List the model's database tables in `tables`, or pass a `tableName` to get that table's `columns` and `indexes` instead. That form echoes the `table` name and adds `rowidAlias` — the INTEGER PRIMARY KEY aliasing SQLite's rowid, so the fastest lookup path, or null when the table has none — with `rowidNote` saying which case applies. Use this to discover what data the model holds beyond what the typed ea_* tools return. See ea_get_model_info for the export's identity.

Input parameters:

- `tableName` (string): Table name to inspect. Omit to list all tables with row counts.

### `ea_get_model_info` (~174 tokens)

Report which .qea export file the server has open: `fileName` is the citable identity, alongside `fileSizeBytes`, `lastModified`, and the `serverVersion` that produced the answer. The full local path is also returned as `resolvedPath`, with `resolvedPathNote` explaining why it is environment detail rather than something to cite. `configuration` says where that path came from — `source` in words, `sourceId` as one of argument/environment/dotenv/remembered/prompt, and the `configured` value behind it — plus any `skipped` settings, each with the `reason` it could not be opened, and `shadowed` ones a higher-priority source outranked; `configurationNote` says how much of that is safe to repeat.

### `ea_resolve` (~238 tokens)

Resolve an analyst reference (braced GUID or plain name) to model candidates: the input is echoed as `reference` and the hits are in `candidates`. A braced GUID is matched exactly. A plain name is matched against the full name first; only if nothing matches exactly is the reference retried as a name prefix, which resolves analyst codes like UC_ABC_2079 or OA_ABC_2280 to elements named 'CODE: description'. An exact hit is returned alone and is never diluted by prefix hits. Each candidate reports its `type` (element, diagram, package), `id`, `name`, `fullPackagePath`, `eaGuid`, and a `match` field that is always present with value "guid", "exact", or "prefix" — a "prefix" candidate is an inexact match and must not be treated as a confirmed identity. Use the optional `kind` filter to narrow results.

Input parameters:

- `kind` (string): Filter candidates to a specific kind
- `reference` (string, required): The reference to resolve: a braced GUID like {ABC-123} or a plain name

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/mm6502-enterprise-architect-mcp/enterprise-architect-mcp#diagnostics

## Score history

- 2026-09-21: 89
- 2026-09-20: 89
- 2026-09-19: 88
- 2026-09-18: 88
- 2026-09-17: 87
- 2026-09-16: 87
- 2026-09-15: 86
- 2026-09-14: 86
- 2026-09-13: 86
- 2026-09-12: 85
- 2026-09-11: 85
- 2026-09-10: 84
- 2026-09-09: 84
- 2026-09-08: 83
- 2026-09-07: 83
- 2026-09-06: 83
- 2026-09-05: 83
- 2026-09-04: 82
- 2026-09-03: 82
- 2026-09-02: 56
- 2026-09-01: 79
- 2026-08-31: 79
- 2026-08-30: 79
- 2026-08-29: 79
- 2026-08-28: 64

## Common questions

### What is the Enterprise Architect MCP server?

Enterprise Architect is an MCP server listed in the public MCP registry as io.github.mm6502/enterprise-architect-mcp. Read-only search and navigation of Sparx Enterprise Architect .qea model exports. This page covers its npm package (enterprise-architect-mcp).

### Is the Enterprise Architect MCP server safe to use?

Enterprise Architect scores 89 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 21 September 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the Enterprise Architect MCP server expose?

Enterprise Architect exposes 12 tools: ea_search, ea_search_and_any_of, ea_get_element, ea_list_elements, ea_get_connectors, and 7 more. Their descriptions and schemas cost roughly 3,036 tokens of context every time the server is loaded.

### Is the Enterprise Architect MCP server still maintained?

Enterprise Architect is still listed as active in the MCP registry. We last reached this channel on 21 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the Enterprise Architect MCP server under?

Enterprise Architect declares the EUPL-1.2 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- npm package: https://www.npmjs.com/package/enterprise-architect-mcp
- Socket report: https://socket.dev/npm/package/enterprise-architect-mcp
- Repository: https://github.com/mm6502/enterprise-architect-mcp
- Changelog RSS feed: https://verifymcp.io/servers/mm6502-enterprise-architect-mcp/enterprise-architect-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/mm6502-enterprise-architect-mcp/enterprise-architect-mcp.json
- HTML version of this page: https://verifymcp.io/servers/mm6502-enterprise-architect-mcp/enterprise-architect-mcp