Mermaid Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Mermaid Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP server that renders Mermaid diagram markup to PNG images, using @mermaid-js/mermaid-cli (Puppeteer/Chromium) under the hood.
Give it AI-generated Mermaid — flowcharts, sequence, class, ER, gantt, state diagrams — and get back a rendered image, returned inline so the host can preview it and/or written to a file on disk.
render_mermaid| Parameter | Type | Required | Description | |||
|---|---|---|---|---|---|---|
diagram | string | yes | Mermaid diagram source, e.g. graph TD; A-->B; | |||
outputPath | string | no | Absolute path ending in .png to also save the image to. Omit to only return inline. | |||
theme | enum | no | default \ | dark \ | forest \ | neutral (default default) |
backgroundColor | string | no | e.g. white, transparent, #ffffff (default white) | |||
width | number | no | Output width in pixels | |||
height | number | no | Output height in pixels | |||
scale | number | no | Device scale factor; higher = sharper/larger PNG (default 1) |
Returns a short text summary plus the PNG as inline MCP image content. When outputPath is supplied, the file is written there and the path is included in the summary.
npm install
npm run buildMermaid renders inside a real browser (it needs a DOM for layout), so Google Chrome / Chromium is required. Puppeteer resolves it, in this order:
@mermaid-js/mermaid-cli during npm install.channel: "chrome") if the bundledbrowser can't be launched.
If none can be launched, the tool returns an actionable error: install Chrome, run npx puppeteer browsers install chrome, or set PUPPETEER_EXECUTABLE_PATH.
If Puppeteer's automatic Chromium download is blocked (a locked-down network, or — on some Windows machines — a stalled extraction), just install Google Chrome and the renderer falls back to it.
npm testIntegration tests using Node's built-in test runner (node:test). They exercise the renderer (input validation, inline render, render-to-file) and a full MCP stdio round-trip (spawn the server, list tools, call render_mermaid). The render tests launch headless Chromium, so they need the Chromium install above and take a few seconds each.
After npm run build, point your MCP client at the built entry over stdio.
# From a local build:
claude mcp add mermaid -- node /absolute/path/to/mermaid-mcp/dist/index.js
# Or from the published package:
claude mcp add mermaid -- npx -y @volare-consulting/mermaid-mcpmcpServers config{
"mcpServers": {
"mermaid": {
"command": "node",
"args": ["/absolute/path/to/mermaid-mcp/dist/index.js"]
}
}
}npm run dev # run the server from TypeScript source via tsxPublished to the public npm registry as @volare-consulting/mermaid-mcp via a tag-driven GitHub Actions release (.github/workflows/publish.yml), which calls the org's shared publish-npm-public reusable workflow.
version in package.json on a PR and merge to main. git tag v0.1.0 && git push origin v0.1.0The tag must equal the package.json version or the job fails. Pushing a v* tag builds and publishes the package (tests are skipped — they need headless Chromium the publish runner doesn't provide). Authentication uses the org-level NPM_TOKEN secret.
MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.