# Diagrams.so (npm · @diagrams-so/mcp)

Generate and edit AWS, Azure, GCP and Kubernetes architecture diagrams as editable draw.io files.

- Trust score: 75/100 (medium)
- Change this week: +4
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-14

## Components

- npm · `@diagrams-so/mcp`: 75/100 (this document), [markdown](https://verifymcp.io/servers/redhold-diagrams-so-mcp/diagrams-so-mcp.md), [page](https://verifymcp.io/servers/redhold-diagrams-so-mcp/diagrams-so-mcp)

## Channel facts

- Registry: `npm`
- Package: `@diagrams-so/mcp`
- Version: `1.4.5`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-14.

- **Supply Chain Security**: 98/100
  - No malware found by supply-chain analysis.
  - No known CVEs affecting this package version or its production dependencies.
  - No install/post-install scripts declared.
  - 30 of 96 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 6 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 82/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 1894 tokens (~82/item across 23 items; 23 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 33/100
  - Stability observed for 10 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

## Install

### Claude

```bash
claude mcp add redhold-diagrams-so-mcp -- npx -y @diagrams-so/mcp
```

### Codex

```bash
codex mcp add redhold-diagrams-so-mcp -- npx -y @diagrams-so/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "redhold-diagrams-so-mcp": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@diagrams-so/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add redhold-diagrams-so-mcp --command npx --arg -y --arg @diagrams-so/mcp
```

### Hermes

```yaml
mcp_servers:
  redhold-diagrams-so-mcp:
    command: "npx"
    args: ["-y", "@diagrams-so/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "redhold-diagrams-so-mcp": {
      "command": "npx",
      "args": [
        "-y",
        "@diagrams-so/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-14 (score 75, +1)

No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-12 (score 74, +1)

No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-11 (score 73, +1)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-08-09 (score 72, +1)

No change was recorded against any check on this day. Stability & Change Management went from 13 to 17. That category is still filling its 30-day observation window: 4 days of observed history at the previous scan, 5 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-08-07 (score 71, +43)

- [security improvement] Known CVEs: unverified → pass
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] Stability: unverified → 0.10
- [functional improvement] MCP protocol: unverified → pass
- [functional improvement] Dependency health: unverified → 0.85
- [functional] First check of Tool coverage: 100
- [functional] First check of Schema quality: fail
- [functional] First check of Schema quality: excellent
- [functional] First check of Tool coverage: 98
- [functional] First check of Schema quality: pass
- [functional] Package version: 1.4.4 → 1.4.5

### 2026-08-06 (score 28, −7)

- [security regression] Known CVEs: partial → unverified
- [functional regression] Dependency health: partial → unverified
- [functional] Package version: 1.4.2 → 1.4.4
- [functional] Package version: 1.4.2 → 1.4.3

### 2026-08-05 (score 35, 0)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] MCP protocol: unverified → pass
- [functional] First check of Schema quality: pass
- [functional] First check of Tool coverage: 98
- [functional] First check of Schema quality: excellent
- [functional] First check of Schema quality: fail
- [functional] Package version: 1.4.1 → 1.4.2

### 2026-08-04 (score 35)

First indexed and scored.

## MCP tools (23)

### `generate_diagram` (~152 tokens)

Generate a diagram

Create a new cloud architecture diagram from a natural-language prompt. Returns the diagram id, its draw.io XML, Well-Architected warnings, score, and credits used. Costs credits.

Input parameters:

- `cloud_provider` (string): aws | azure | gcp | kubernetes | oci | general (default: general)
- `diagram_type` (string): architecture | flowchart | sequence | data_pipeline | ... (default: architecture)
- `opinionated` (boolean): Apply best-practice hardening suggestions during generation (paid plans only).
- `prompt` (string, required): What to draw, e.g. 'AWS 3-tier web app with ALB, EC2 Auto Scaling and RDS Multi-AZ'

### `edit_diagram` (~89 tokens)

Edit a diagram

Apply a natural-language change to an existing diagram (e.g. 'add a Redis cache'). Creates a new version and returns the updated XML. Costs credits. Confirm with the user before calling — it mutates the diagram.

Input parameters:

- `diagram_id` (string, required): The id returned by generate_diagram / list_diagrams
- `edit_prompt` (string, required): The change to make, in plain language

### `fix_warning` (~106 tokens)

Fix one warning

Resolve a single Well-Architected warning (from get_warnings), leaving the rest of the diagram untouched. Creates a new version. Costs credits.

Input parameters:

- `component` (string): The warning's `component`, if any
- `diagram_id` (string, required): The diagram id
- `message` (string, required): The warning's `message` (as returned by get_warnings)
- `warning_type` (string): The warning's `type`, e.g. no_encryption_transit

### `relayout_diagram` (~120 tokens)

Re-arrange layout with AI

Automatically re-arrange a diagram's layout for readability (async). Starts the job and waits for it to finish, returning the re-laid XML + fresh warnings/score. Every re-layout costs credits based on the tokens it uses (like edit/fix) and requires confirm=true. If the job is still running when the wait elapses, returns a job_id you can poll with get_relayout_status.

Input parameters:

- `confirm` (boolean): Consent to the token-based charge (required to start).
- `diagram_id` (string, required): The diagram id

### `import_diagram` (~109 tokens)

Import a diagram

Import an existing draw.io (mxGraphModel/mxfile) XML document as a new diagram in your account. Validated and sanitized. Free (no AI).

Input parameters:

- `cloud_provider` (string): aws | azure | gcp | ... (default: general)
- `diagram_type` (string): architecture | flowchart | ... (default: architecture)
- `title` (string): Optional title (derived if omitted)
- `xml` (string, required): draw.io mxGraphModel/mxfile XML

### `update_diagram` (~105 tokens)

Update a diagram

Update a diagram's metadata or XML: rename it, change visibility (public/private — paid plans for private), or replace its XML. Pass only the fields you want to change. Free (no AI).

Input parameters:

- `diagram_id` (string, required): The diagram id
- `is_public` (boolean): true = public in the gallery, false = private (paid)
- `title` (string): New title
- `xml` (string): Replace the diagram XML (validated + sanitized)

### `delete_diagram` (~55 tokens)

Delete a diagram

Delete (soft-delete) a diagram you own. It stops appearing in list_diagrams and can no longer be fetched. Confirm with the user before calling — this is destructive.

Input parameters:

- `diagram_id` (string, required): The diagram id

### `revert_diagram` (~80 tokens)

Revert to a version

Revert a diagram to an earlier version (from list_versions). Pass either version_id or version_number. Free (no AI).

Input parameters:

- `diagram_id` (string, required): The diagram id
- `version_id` (string): The version's id (from list_versions)
- `version_number` (integer): Or the version number, e.g. 2

### `get_diagram` (~41 tokens)

Get a diagram

Fetch a diagram by id — returns its title, draw.io XML, and Well-Architected score.

Input parameters:

- `diagram_id` (string, required): The diagram id

### `list_diagrams` (~57 tokens)

List my diagrams

List your diagrams (newest first, cursor-paginated). Returns id, title, cloud, type.

Input parameters:

- `cursor` (string): next_cursor from a previous call
- `limit` (integer): Page size (default 20)

### `get_warnings` (~41 tokens)

Get Well-Architected warnings

List the Well-Architected findings for a diagram (each has type, component, message). Free.

Input parameters:

- `diagram_id` (string, required): The diagram id

### `export_diagram` (~77 tokens)

Export a diagram

Export a diagram as a raw file: `drawio` (open at app.diagrams.net) or `svg`. Returns the file content directly. Exports are free on every plan. Free-plan SVG exports carry a watermark.

Input parameters:

- `diagram_id` (string, required): The diagram id
- `format` (string): drawio or svg

### `list_versions` (~72 tokens)

List diagram versions

List a diagram's version history (ascending; `is_current` marks the live one). Use with revert_diagram / get_version.

Input parameters:

- `cursor` (string): next_cursor from a previous call
- `diagram_id` (string, required): The diagram id
- `limit` (integer): Page size (default 20)

### `get_version` (~57 tokens)

Get a diagram version

Fetch a specific version's XML + Well-Architected score (e.g. to inspect before reverting). Free.

Input parameters:

- `diagram_id` (string, required): The diagram id
- `version_id` (string, required): The version id (from list_versions)

### `get_relayout_status` (~81 tokens)

Poll a re-layout job

Check the status of an async re-layout job started by relayout_diagram. Returns pending/done/failed; when done+applied it includes the re-laid XML + fresh warnings/score. Free.

Input parameters:

- `diagram_id` (string, required): The diagram id
- `job_id` (string, required): The job_id returned by relayout_diagram

### `search_gallery` (~124 tokens)

Search the gallery

Search public community diagrams and curated library templates to reuse as a starting point. Returns id, title, and source (community/library). Fork one with fork_template.

Input parameters:

- `cloud_provider` (string): Filter by provider
- `cursor` (string): next_cursor from a previous call (community feed is paginated)
- `diagram_type` (string): Filter by diagram type
- `limit` (integer): Page size (default 20)
- `q` (string): Search text (matches title/description)
- `source` (string): all (default) · community · library

### `fork_template` (~52 tokens)

Fork a public diagram

Copy a PUBLIC gallery diagram or curated library template into your own account (private) so you can edit it. Returns the new diagram id.

Input parameters:

- `diagram_id` (string, required): A public/library diagram id from search_gallery

### `enhance_prompt` (~63 tokens)

Enhance a prompt

Turn a rough idea into a detailed generation prompt. Free.

Input parameters:

- `cloud_provider` (string): aws | azure | gcp | kubernetes | oci | general — biases the enhanced prompt toward that provider's services
- `prompt` (string, required): Your rough prompt

### `clarify_prompt` (~42 tokens)

Clarify a vague prompt

Get 1–3 clarifying questions (and a suggested diagram type) for a vague prompt, before generating. Free.

Input parameters:

- `prompt` (string, required): Your prompt

### `get_usage` (~24 tokens)

Get usage & credits

Show your current plan, credits remaining, and per-action cost estimates. Free.

### `get_usage_history` (~176 tokens)

Credit consumption history

List how much credit each past task (generate/edit/fix/relayout) charged — newest first, with the diagram it touched and the surface (api/sdk/mcp) that ran it. Use this to answer 'how much did each task cost?'. Also shows a running tally of tasks performed in THIS session. Free (read-only).

Input parameters:

- `action` (string): Filter to one task type.
- `cursor` (string): Pagination cursor from a previous call's next_cursor.
- `diagram_id` (string): Only tasks that touched this diagram.
- `limit` (integer): Max rows to return (default 20).
- `since` (string): ISO-8601 lower bound (inclusive).
- `source` (string): Filter to one surface.
- `until` (string): ISO-8601 upper bound (exclusive).

### `whoami` (~28 tokens)

Who am I

Show the account, plan, scopes, and live/test mode of the configured API key. Free.

### `list_capabilities` (~41 tokens)

List capabilities

Discover the valid diagram types, cloud providers, and export formats the API supports — so you pass valid values to generate_diagram / export_diagram. Free.

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/redhold-diagrams-so-mcp/diagrams-so-mcp#diagnostics

## Score history

- 2026-08-14: 75
- 2026-08-13: 74
- 2026-08-12: 74
- 2026-08-11: 73
- 2026-08-10: 72
- 2026-08-09: 72
- 2026-08-08: 71
- 2026-08-07: 71
- 2026-08-06: 28
- 2026-08-05: 35
- 2026-08-04: 35

## Links

- npm package: https://www.npmjs.com/package/@diagrams-so/mcp
- Socket report: https://socket.dev/npm/package/@diagrams-so/mcp
- Repository: https://github.com/RedHold/diagrams-mcp-app-core
- Website: https://diagrams.so/developers
- Changelog RSS feed: https://verifymcp.io/servers/redhold-diagrams-so-mcp/diagrams-so-mcp.xml
- Changelog JSON feed: https://verifymcp.io/servers/redhold-diagrams-so-mcp/diagrams-so-mcp.json
- HTML version of this page: https://verifymcp.io/servers/redhold-diagrams-so-mcp/diagrams-so-mcp