AI Diagram Maker MCP vs Diagrams.so API + MCP

AI Diagram Maker MCP 17

Last release v3.0.8, published to npm on 10 April 2026, 210 days before this check (0). No release since 8 August (0). Four issues in all. The two open ones, from 4 May (hosted MCP credit usage) and 13 October 2026, show no reply, and one closed issue had a comment (5 of 25). In the official MCP registry under the GitHub-verified namespace io.github.erajasekar, but the entry is 1.0.0 from 19 March 2026 while npm is on 3.0.8 (10 of 15). The only workflow publishes to the registry. No tests or CI, and the MCP SDK floor is ^1.9.0 (2 of 10). 0 + 0 + 5 + 10 + 2 = 17.

Diagrams.so API + MCP 81

MCP server v1.4.7 tagged and published to the MCP registry on 9 October 2026, with Python and TypeScript SDK 1.4.0 tagged the same day, 26 days ago (30). In the 90 days from 6 August, MCP tags v1.4.3 and v1.4.4 (6 August), v1.4.5 (7 August), v1.4.6 (19 August) and v1.4.7 (9 October), plus the two SDK tags at half (20). Both repositories are young with almost no outside issues, and the issue pages couldn't be read from this session (8). Listed in the official MCP registry as io.github.RedHold/diagrams-so-mcp, latest 1.4.7, under the GitHub-verified namespace (15). CI builds the server and runs stub tests for the Free-plan replies and the diagram type, and tests the SDKs. Two runtime dependencies (8). 30 + 20 + 8 + 15 + 8 = 81.

AI Diagram Maker MCP 35

The MCP server is MIT (package.json and LICENSE, added 18 March 2026). The service is closed, under terms last updated 24 September 2025 that name the operator only as AI Diagram Maker (20 of 30). The privacy policy of the same date keeps diagrams, revisions and chat prompts and responses 'as long as necessary', and the terms license user input 'to provide and improve our services', with no retention periods and no word on model training or the AI providers used (8 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations named (0). The MCP server's source sends no telemetry of its own. 20 + 8 + 0 + 0 = 28.

Diagrams.so API + MCP 76

MCP server and SDKs are Apache 2.0, the service is closed with clear terms (20). Privacy policy effective 12 October 2026. Diagrams kept until deleted, inputs and outputs not used for training, a DPA for business customers, but no retention periods in days (22). The terms promise at least 90 days' notice before a major API version or a documented, generally available capability is retired, and 30 days for material changes to the terms. The 9 October plan change gave no such notice (it is a negative event) (18). Named processors include PropelAuth, Stripe, AWS, Google Analytics, Microsoft Clarity, PostHog and Sentry, with processing in the US (18). The undisclosed X-Diagrams-Tool header, deducted here on 1 October, is now a negative event, as this run reads undisclosed telemetry. 20 + 22 + 18 + 18 = 78.

AI Diagram Maker MCP 45

Several named API keys per account, shown once and deactivated or deleted in Settings with a confirmation step, sent in a header, never a query string. No scopes, and the user guide says anyone with a key can access the account (20 of 30). The tools only create diagrams and can't change or delete anything in the account, but there's no read-only key (12 of 20). Tools return diagrams built from the caller's own input. Image inputs can be any public URL (10 of 15). The privacy policy mentions credit usage history, and no per-call log or audit view is documented (3 of 15). No security.txt, disclosure policy, bug bounty or certification found (0). 20 + 12 + 10 + 3 + 0 = 45.

Diagrams.so API + MCP 67

Bearer API keys with live and test prefixes, described in the changelog as scoped with reveal-once creation and instant revocation, a 25-active-key cap, or a device-flow login whose one-time code is emailed, never put in a URL. Which scopes exist isn't documented (28). Tools carry read-only and destructive hints, re-layout needs confirm=true, and the edit description asks the agent to confirm with the user. No read-only key type found (14). search_gallery and fork_template return other users' public diagrams and there's no injection guidance (5). Usage history lists every task and responses carry a request ID (10). security.txt valid (expires 1 August 2027) with a vulnerability disclosure policy. No bug bounty or SOC 2 (10). 28 + 14 + 5 + 10 + 10 = 67.

AI Diagram Maker MCP 66

Five compact tools (25). Output can be SVG or PNG and the API can return the D2 source with debug, but there's nothing to page or trim, and results carry the rendered image (10 of 20). Typed error bodies with codes, a 422 that returns the failing D2 code, and retryAfter on 429 (16 of 20). No readOnlyHint or other annotations in the source and no idempotency key, and every call spends credits (5 of 20). Only content is required and the hosted endpoint needs no install, but there is no SDK beyond the server (10 of 15). 25 + 10 + 16 + 5 + 10 = 66.

Diagrams.so API + MCP 85

23 MCP tools in one 37 KB source file, no toolsets or read-only subset, and on the Paid plan every diagram tool returns the full draw.io XML (15). Cursor pagination on list endpoints (15). Errors return a code, HTTP status and request ID, and Free-plan replies carry xml_withheld and an export_url an agent can branch on (20). Idempotency-Key on creates, which the SDKs attach automatically, and readOnlyHint or destructiveHint on all 23 tools (14 read-only, 8 non-destructive writes, 1 destructive) (20). Only prompt is required to generate, and diagram_type may be left out. Official Python and TypeScript SDKs (15). 15 + 15 + 20 + 20 + 15 = 85.

AI Diagram Maker MCP 30

Hosted lines, because every tool call is generated on the AI Diagram Maker service, through the hosted endpoint or the npx server. No status page found on the site or in the README (0). No readable incident history (5). The only rate-limit number is the example in the OpenAPI 429 schema ('Maximum 100 requests per day exceeded.'), which isn't stated as the limit (5 of 15). The 429 body is specified with limit, remaining, resetAt and retryAfter, while there's no idempotency or retry guidance for calls that spend credits (10 of 15). No SLA found (0). Nothing labels the service or server beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.

Diagrams.so API + MCP 45

No status page yet. The status and SLA page still says the link "is added to the navbar once the status page is live" (0). No readable incident history (5). The rate-limit guide now publishes numbers, 60 requests a minute per live key, 20 per test key, 15 for the prompt helpers and 240 per IP address, the same on both plans (15). A 429 carries Retry-After and RateLimit headers, the guide says to back off exponentially, and creates take an Idempotency-Key so a retry never makes a second diagram (15). The terms say "we offer no service-level commitment" (0). /api/v2 is a public API, not a beta (10). 0 + 5 + 15 + 15 + 0 + 10 = 45.

AI Diagram Maker MCP 75

All five tools have zod input schemas in src/tools, and the repository ships an OpenAPI 3 file for POST /api/v2/diagrams/generate (25). No llms.txt (404) and no docs site for agents beyond the README (0). Each description says what the tool does and when to use it, listing trigger phrases and the diagram types, without saying when another tool fits better (16 of 20). content has a minimum length and diagramType an eight-value enum; the OpenAPI adds inputType and format enums (13 of 15). Examples in the parameter descriptions and README, and the OpenAPI documents 400, 401, 402, 422 (D2 failed to compile) and 429 with typed error bodies (13 of 15). Git tags from v1.1.1 to v3.0.8 and a /api/v2 path, with no changelog or release notes (8 of 15). 25 + 0 + 16 + 13 + 13 + 8 = 75.

Diagrams.so API + MCP 85

OpenAPI 3.1 (version 2.0.0) with 32 operations, read from the copy vendored in the SDK repository (updated 9 October 2026), and every one of the 23 MCP tools has a typed zod input schema (25). llms.txt (10). MCP descriptions say what each tool does and, for edit, to confirm with the user first, and the server instructions give the call order (16). Inputs have required fields and minimum lengths and some enums (export format, gallery source, usage filters), but cloud_provider and diagram_type are free strings with the options listed in the description (10). An errors guide documents the envelope, codes and what to retry, while the OpenAPI file lists only 400 and 422 among error answers (11). Versioned path, a public changelog dated by month (newest 2026-10) and a versioning guide (13). 25 + 10 + 16 + 10 + 11 + 13 = 85.