Draw Flow Mcp Server — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Draw Flow Mcp Server (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP (Model Context Protocol) server that enables AI agents like Claude Desktop and Cursor to generate and edit draw.io diagrams with real-time browser preview.
Self-contained - includes an embedded HTTP server, no external dependencies required.
{
"mcpServers": {
"drawio": {
"command": "npx",
"args": ["@next-ai-drawio/mcp-server@latest"]
}
}
}Add to your Claude Desktop config (~/Library/Application Support/Claude/claude_desktop_config.json on macOS):
{
"mcpServers": {
"drawio": {
"command": "npx",
"args": ["@next-ai-drawio/mcp-server@latest"]
}
}
}Add to your VS Code settings (.vscode/mcp.json in workspace or user settings):
{
"mcpServers": {
"drawio": {
"command": "npx",
"args": ["@next-ai-drawio/mcp-server@latest"]
}
}
}Add to Cursor MCP config (~/.cursor/mcp.json):
{
"mcpServers": {
"drawio": {
"command": "npx",
"args": ["@next-ai-drawio/mcp-server@latest"]
}
}
}cline_mcp_settings.json{
"mcpServers": {
"drawio": {
"command": "npx",
"args": ["@next-ai-drawio/mcp-server@latest"]
}
}
}claude mcp add drawio -- npx @next-ai-drawio/mcp-server@latestUse the standard MCP configuration with:
npx["@next-ai-drawio/mcp-server@latest"]"Create a flowchart showing user authentication with login, MFA, and session management"
.drawio filesembed.diagrams.net by default, configurable via DRAWIO_BASE_URL)| Tool | Description |
|---|---|
start_session | Opens browser with real-time diagram preview |
create_new_diagram | Create a new diagram from XML (requires xml argument) |
edit_diagram | Edit diagram by ID-based operations (update/add/delete cells) |
get_diagram | Get the current diagram XML |
export_diagram | Save diagram to a .drawio file |
┌─────────────────┐ stdio ┌─────────────────┐
│ Claude Desktop │ <───────────> │ MCP Server │
│ (AI Agent) │ │ (this package) │
└─────────────────┘ └────────┬────────┘
│
┌────────▼────────┐
│ Embedded HTTP │
│ Server (:6002) │
└────────┬────────┘
│
┌────────▼────────┐
│ User's Browser │
│ (draw.io embed) │
└─────────────────┘| Variable | Default | Description |
|---|---|---|
PORT | 6002 | Port for the embedded HTTP server |
DRAWIO_BASE_URL | https://embed.diagrams.net | Base URL for the draw.io embed. Set this to use a self-hosted draw.io instance for private deployments. |
For security-sensitive environments that require private deployment of draw.io:
{
"mcpServers": {
"drawio": {
"command": "npx",
"args": ["@next-ai-drawio/mcp-server@latest"],
"env": {
"DRAWIO_BASE_URL": "https://drawio.your-company.com"
}
}
}
}You can deploy your own draw.io instance using the official Docker image:
docker run -d -p 8080:8080 jgraph/drawioThen set DRAWIO_BASE_URL=http://localhost:8080 (or your server's URL).
If port 6002 is in use, the server will automatically try the next available port (up to 6020).
Or set a custom port:
{
"mcpServers": {
"drawio": {
"command": "npx",
"args": ["@next-ai-drawio/mcp-server@latest"],
"env": { "PORT": "6003" }
}
}
}Call start_session first to open the browser window.
Check that the browser URL has the ?mcp= query parameter. The MCP session ID connects the browser to the server.
Apache-2.0
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.