Diagrams.so
NPM · @DIAGRAMS-SO/MCP
Generate and edit AWS, Azure, GCP and Kubernetes architecture diagrams as editable draw.io files.
Available components
Last scanned (26 minutes ago)
Scores higher than 86% of npm servers
Category Cloud Infrastructure
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 31 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency48
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 7 days ago).Pass
- Publishes a security disclosure policy (SECURITY.md).Pass
Schema Quality & AI Usability79
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 1995 tokens (~86/item across 23 items; 23 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.Pass
- An AI judge read all 24 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 17 Oct 26 +3
- Stability: 0.77 → pass security
- 16 Oct 26 −3
- Stability: pass → 0.77 functional
- 15 Oct 26 0
- Stability: 0.97 → pass security
- 14 Oct 26 +46
- Injection markers: unverified → pass ▲ security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- Stability: unverified → 0.97 ▲ functional
- Package version: 1.4.6 → 1.4.7 functional
- 12 Oct 26 +1
- Security disclosure: unverified → pass ▲ functional
- 11 Oct 26 −45
- Stability: 0.83 → unverified ▼ security
- Tool safety: pass → unverified ▼ security
- Capabilities: pass → unverified ▼ functional
- Tool coverage: 100 → unverified ▼ functional
- Security disclosure: pass → unverified ▼ functional
- Package version: 1.4.6 → 1.4.7 functional
- 3 Oct 26 −3
- Stability: pass → 0.80 functional
- 2 Oct 26 +1
- Stability: 0.97 → pass security
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 17 Oct 2026 · Analysed npm/@diagrams-so/mcp@1.4.7
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 93 packages
| Packages resolved | 93 |
|---|---|
| Stale | 31 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
clarify_prompt Clarify a vague prompt ~42
Get 1–3 clarifying questions (and a suggested diagram type) for a vague prompt, before generating. Free.
| Name | Type | Req | Description |
|---|---|---|---|
| prompt | string | yes | Your prompt |
No output schema declared.
No examples provided.
delete_diagram Delete a diagram ~55
Delete (soft-delete) a diagram you own. It stops appearing in list_diagrams and can no longer be fetched. Confirm with the user before calling — this is destructive.
| Name | Type | Req | Description |
|---|---|---|---|
| diagram_id | string | yes | The diagram id |
No output schema declared.
No examples provided.
edit_diagram Edit a diagram ~99
Apply a natural-language change to an existing diagram (e.g. 'add a Redis cache'). Creates a new version and returns the updated XML (Paid plan; Free gets a link to the watermarked image). Confirm with the user before calling: it mutates the diagram.
| Name | Type | Req | Description |
|---|---|---|---|
| diagram_id | string | yes | The id returned by generate_diagram / list_diagrams |
| edit_prompt | string | yes | The change to make, in plain language |
No output schema declared.
No examples provided.
enhance_prompt Enhance a prompt ~63
Turn a rough idea into a detailed generation prompt. Free.
| Name | Type | Req | Description |
|---|---|---|---|
| cloud_provider | string | – | aws | azure | gcp | kubernetes | oci | general — biases the enhanced prompt toward that provider's services |
| prompt | string | yes | Your rough prompt |
No output schema declared.
No examples provided.
export_diagram Export a diagram ~104
Export a diagram as a raw file: `drawio` (open at app.diagrams.net) or `svg`. Returns the file content directly. `svg` works on every plan; Free-plan images carry a watermark. The editable `drawio` file needs the Paid plan: on Free, asking for `drawio` returns the watermarked SVG instead.
| Name | Type | Req | Description |
|---|---|---|---|
| diagram_id | string | yes | The diagram id |
| format | string | – | drawio or svg |
No output schema declared.
No examples provided.
fix_warning Fix one warning ~103
Resolve a single Well-Architected warning (from get_warnings), leaving the rest of the diagram untouched. Creates a new version.
| Name | Type | Req | Description |
|---|---|---|---|
| component | string | – | The warning's `component`, if any |
| diagram_id | string | yes | The diagram id |
| message | string | yes | The warning's `message` (as returned by get_warnings) |
| warning_type | string | – | The warning's `type`, e.g. no_encryption_transit |
No output schema declared.
No examples provided.
fork_template Fork a public diagram ~52
Copy a PUBLIC gallery diagram or curated library template into your own account (private) so you can edit it. Returns the new diagram id.
| Name | Type | Req | Description |
|---|---|---|---|
| diagram_id | string | yes | A public/library diagram id from search_gallery |
No output schema declared.
No examples provided.
generate_diagram Generate a diagram ~179
Create a new cloud architecture diagram from a natural-language prompt. Returns the diagram id, Well-Architected warnings and score, and its draw.io XML on the Paid plan (on Free, a link to the watermarked image instead).
| Name | Type | Req | Description |
|---|---|---|---|
| cloud_provider | string | – | aws | azure | gcp | kubernetes | oci | general (default: general) |
| diagram_type | string | – | Leave out to let Diagrams pick the kind of diagram from the prompt; or set one of: auto | architecture | flowchart | sequence | data_pipeline | ... |
| opinionated | boolean | – | Apply best-practice hardening suggestions during generation (paid plans only). |
| prompt | string | yes | What to draw, e.g. 'AWS 3-tier web app with ALB, EC2 Auto Scaling and RDS Multi-AZ' |
No output schema declared.
No examples provided.
get_diagram Get a diagram ~57
Fetch a diagram by id. Returns its title, Well-Architected score, and draw.io XML on the Paid plan (on Free, a link to the watermarked image instead).
| Name | Type | Req | Description |
|---|---|---|---|
| diagram_id | string | yes | The diagram id |
No output schema declared.
No examples provided.
get_relayout_status Poll a re-layout job ~81
Check the status of an async re-layout job started by relayout_diagram. Returns pending/done/failed; when done+applied it includes the re-laid XML + fresh warnings/score. Free.
| Name | Type | Req | Description |
|---|---|---|---|
| diagram_id | string | yes | The diagram id |
| job_id | string | yes | The job_id returned by relayout_diagram |
No output schema declared.
No examples provided.
get_usage Get usage & plan ~25
Show your current plan and usage. Every plan has unlimited diagrams and edits. Free.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_usage_history Task history ~168
List past tasks (generate/edit/fix/relayout), newest first, with the diagram each one touched and the surface (api/sdk/mcp) that ran it. Use this to check whether a task already ran. Also shows a running tally of tasks performed in THIS session. Free (read-only).
| Name | Type | Req | Description |
|---|---|---|---|
| action | string | – | Filter to one task type. |
| cursor | string | – | Pagination cursor from a previous call's next_cursor. |
| diagram_id | string | – | Only tasks that touched this diagram. |
| limit | integer | – | Max rows to return (default 20). |
| since | string | – | ISO-8601 lower bound (inclusive). |
| source | string | – | Filter to one surface. |
| until | string | – | ISO-8601 upper bound (exclusive). |
No output schema declared.
No examples provided.
get_version Get a diagram version ~74
Fetch a specific version's Well-Architected score and XML (XML on the Paid plan; Free gets a link to the watermarked image), e.g. to inspect before reverting. No charge.
| Name | Type | Req | Description |
|---|---|---|---|
| diagram_id | string | yes | The diagram id |
| version_id | string | yes | The version id (from list_versions) |
No output schema declared.
No examples provided.
get_warnings Get Well-Architected warnings ~41
List the Well-Architected findings for a diagram (each has type, component, message). Free.
| Name | Type | Req | Description |
|---|---|---|---|
| diagram_id | string | yes | The diagram id |
No output schema declared.
No examples provided.
import_diagram Import a diagram ~116
Import an existing draw.io (mxGraphModel/mxfile) XML document as a new diagram in your account. Validated and sanitized. Free (no AI).
| Name | Type | Req | Description |
|---|---|---|---|
| cloud_provider | string | – | aws | azure | gcp | ... (default: general) |
| diagram_type | string | – | Kind of diagram: architecture | flowchart | ... Leave out to use the server default. |
| title | string | – | Optional title (derived if omitted) |
| xml | string | yes | draw.io mxGraphModel/mxfile XML |
No output schema declared.
No examples provided.
list_capabilities List capabilities ~41
Discover the valid diagram types, cloud providers, and export formats the API supports — so you pass valid values to generate_diagram / export_diagram. Free.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_diagrams List my diagrams ~57
List your diagrams (newest first, cursor-paginated). Returns id, title, cloud, type.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | next_cursor from a previous call |
| limit | integer | – | Page size (default 20) |
No output schema declared.
No examples provided.
list_versions List diagram versions ~72
List a diagram's version history (ascending; `is_current` marks the live one). Use with revert_diagram / get_version.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | – | next_cursor from a previous call |
| diagram_id | string | yes | The diagram id |
| limit | integer | – | Page size (default 20) |
No output schema declared.
No examples provided.
relayout_diagram Re-arrange layout with AI ~111
Automatically re-arrange a diagram's layout for readability (async). Starts the job and waits for it to finish, returning the re-laid XML + fresh warnings/score. Requires confirm=true, because it replaces the current layout. If the job is still running when the wait elapses, returns a job_id you can poll with get_relayout_status.
| Name | Type | Req | Description |
|---|---|---|---|
| confirm | boolean | – | Confirm you want the layout re-arranged (required to start). |
| diagram_id | string | yes | The diagram id |
No output schema declared.
No examples provided.
revert_diagram Revert to a version ~80
Revert a diagram to an earlier version (from list_versions). Pass either version_id or version_number. Free (no AI).
| Name | Type | Req | Description |
|---|---|---|---|
| diagram_id | string | yes | The diagram id |
| version_id | string | – | The version's id (from list_versions) |
| version_number | integer | – | Or the version number, e.g. 2 |
No output schema declared.
No examples provided.
search_gallery Search the gallery ~124
Search public community diagrams and curated library templates to reuse as a starting point. Returns id, title, and source (community/library). Fork one with fork_template.
| Name | Type | Req | Description |
|---|---|---|---|
| cloud_provider | string | – | Filter by provider |
| cursor | string | – | next_cursor from a previous call (community feed is paginated) |
| diagram_type | string | – | Filter by diagram type |
| limit | integer | – | Page size (default 20) |
| q | string | – | Search text (matches title/description) |
| source | string | – | all (default) · community · library |
No output schema declared.
No examples provided.
update_diagram Update a diagram ~105
Update a diagram's metadata or XML: rename it, change visibility (public/private — paid plans for private), or replace its XML. Pass only the fields you want to change. Free (no AI).
| Name | Type | Req | Description |
|---|---|---|---|
| diagram_id | string | yes | The diagram id |
| is_public | boolean | – | true = public in the gallery, false = private (paid) |
| title | string | – | New title |
| xml | string | – | Replace the diagram XML (validated + sanitized) |
No output schema declared.
No examples provided.
whoami Who am I ~28
Show the account, plan, scopes, and live/test mode of the configured API key. Free.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
How do I install the Diagrams.so MCP server?
Diagrams.so runs locally as an npm package, launched with npx -y @diagrams-so/mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · @diagrams-so/mcp
claude mcp add redhold-diagrams-so-mcp -- npx -y @diagrams-so/mcp
What is the Diagrams.so MCP server?
Diagrams.so is an MCP server listed in the public MCP registry as io.github.RedHold/diagrams-so-mcp. Generate and edit AWS, Azure, GCP and Kubernetes architecture diagrams as editable draw.io files. This page covers its npm package (@diagrams-so/mcp).
Is the Diagrams.so MCP server safe to use?
Diagrams.so scores 85 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 17 October 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the Diagrams.so MCP server expose?
Diagrams.so exposes 23 tools: generate_diagram, edit_diagram, fix_warning, relayout_diagram, import_diagram, and 18 more. Their descriptions and schemas cost roughly 1,877 tokens of context every time the server is loaded.
Is the Diagrams.so MCP server still maintained?
Diagrams.so is still listed as active in the MCP registry. We last reached this channel on 17 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the Diagrams.so MCP server under?
Diagrams.so declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.