AI Diagram Maker MCP vs Excalidraw

AI Diagram Maker MCP 45

Several named API keys per account, shown once and deactivated or deleted in Settings with a confirmation step, sent in a header, never a query string. No scopes, and the user guide says anyone with a key can access the account (20 of 30). The tools only create diagrams and can't change or delete anything in the account, but there's no read-only key (12 of 20). Tools return diagrams built from the caller's own input. Image inputs can be any public URL (10 of 15). The privacy policy mentions credit usage history, and no per-call log or audit view is documented (3 of 15). No security.txt, disclosure policy, bug bounty or certification found (0). 20 + 12 + 10 + 3 + 0 = 45.

Excalidraw 73

API keys are workspace-bound, take read or full permission or specific routes, carry an expiry and can be rotated or soft-deleted. Personal and workspace keys differ in access to private collections (30). Read-only keys expose only read tools and deletes go to trash, with no confirmation step found (14). Scene text written by collaborators returns to the model and add_image fetches a public URL, with no injection guidance found (3). GET /logs returns the workspace audit log with filters by user, action and operation (13). Excalidraw states SOC 2 Type 1 and Type 2, yearly penetration tests and Vanta scanning, and publishes advisories on GitHub (OSV lists five for the editor, the newest on 24 April 2026). That newest one, GHSA-39h7-pwv7-rc3x, covers Mermaid's own sequence-diagram flaw (CVE-2025-54881, published by Mermaid on 19 August 2025), fixed in 0.18.1 by a dependency update, so it takes no deduction; the other four are older than twelve months. No security.txt, bug bounty or SECURITY.md was found, and the trust centre report was not read (13). Docs readings per the 9 October check, not re-read on 4 November. 30 + 14 + 3 + 13 + 13 = 73.

AI Diagram Maker MCP 35

The MCP server is MIT (package.json and LICENSE, added 18 March 2026). The service is closed, under terms last updated 24 September 2025 that name the operator only as AI Diagram Maker (20 of 30). The privacy policy of the same date keeps diagrams, revisions and chat prompts and responses 'as long as necessary', and the terms license user input 'to provide and improve our services', with no retention periods and no word on model training or the AI providers used (8 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations named (0). The MCP server's source sends no telemetry of its own. 20 + 8 + 0 + 0 = 28.

Excalidraw 63

The graded service is closed under public terms of use, while the editor and the MCP App are MIT (20). The privacy policy of 29 April 2021 says servers are in the United States and data is kept at most one month after an account ends. The DPA of 13 January 2026 says cancelling a subscription does not delete data and retention follows internal policies. Neither names AI providers (14). No deprecation policy, only the beta warning that contracts may break (3). The DPA points to a sub-processor list at trust.excalidraw.com, which is script-drawn and was not read, and says some sub-processors are in the United States (8). The terms were re-read on 4 November (published 30 May 2022, in effect 1 June 2022); the other documents per the 9 October check. 20 + 14 + 3 + 8 = 45.

AI Diagram Maker MCP 17

Last release v3.0.8, published to npm on 10 April 2026, 210 days before this check (0). No release since 8 August (0). Four issues in all. The two open ones, from 4 May (hosted MCP credit usage) and 13 October 2026, show no reply, and one closed issue had a comment (5 of 25). In the official MCP registry under the GitHub-verified namespace io.github.erajasekar, but the entry is 1.0.0 from 19 March 2026 while npm is on 3.0.8 (10 of 15). The only workflow publishes to the registry. No tests or CI, and the MCP SDK floor is ^1.9.0 (2 of 10). 0 + 0 + 5 + 10 + 2 = 17.

Excalidraw 44

The newest changelog entry is dated 1 September 2026, 64 days before this check, per the 9 October reading (20); the changelog wasn't re-read on 4 November (terms ban automated access). The editor package @excalidraw/excalidraw has no release since 0.18.1 (20 April 2026), and the MCP App's newest tag is v0.3.2 (9 February 2026), both read from clones. Of the dated entries recorded, only 1 September falls in the 90 days from 6 August (0). A public changelog, a roadmap, a Discord server and support@excalidraw.com exist, and the editor repository had commits up to 3 November 2026 (12). There is no SDK for the API, and the editor package on npm is the vendor's only official package (5). The editor repository runs test, lint and size workflows, and the MCP App repository has no CI and no commit since 24 March 2026 (7). 20 + 0 + 12 + 5 + 7 = 44.

AI Diagram Maker MCP 20

No x402, MPP or L402 (0). Plan prices are public (Plus $10, Max $20 a month), with credits counted at 1,000 tokens each, so there's no per-diagram price (10 of 20). Basic is free forever with 50 credits a month, but the page doesn't say whether a card is needed or whether API and MCP calls are included (10 of 20, half as with an unstated card rule). A person signs up in the app and creates the key (0). 0 + 10 + 10 + 0 = 20.

Excalidraw 35

No x402, MPP or L402 (0). Plan prices are public, Free at $0 and Plus at $6 a user a month, with no per-call price (10). The free editor and the keyless MCP App need no card, while the API needs the Plus plan, whose 14-day trial does not say whether a card is taken; the terms (re-read 4 November) say the account is charged when the trial ends (15). The MCP App's README gives https://mcp.excalidraw.com as a remote server to add as a custom connector, with no key, but an API key is created by a person in workspace settings (10). Pricing per the 9 October check, not re-read on 4 November. 0 + 10 + 15 + 10 = 35.

AI Diagram Maker MCP 75

All five tools have zod input schemas in src/tools, and the repository ships an OpenAPI 3 file for POST /api/v2/diagrams/generate (25). No llms.txt (404) and no docs site for agents beyond the README (0). Each description says what the tool does and when to use it, listing trigger phrases and the diagram types, without saying when another tool fits better (16 of 20). content has a minimum length and diagramType an eight-value enum; the OpenAPI adds inputType and format enums (13 of 15). Examples in the parameter descriptions and README, and the OpenAPI documents 400, 401, 402, 422 (D2 failed to compile) and 429 with typed error bodies (13 of 15). Git tags from v1.1.1 to v3.0.8 and a /api/v2 path, with no changelog or release notes (8 of 15). 25 + 0 + 16 + 13 + 13 + 8 = 75.

Excalidraw 65

The endpoint reference is generated from an OpenAPI schema, but no file is linked from the docs, and the MCP tool definitions could not be read without a key (10). llms.txt and llms-full.txt are published (10). The tools page says when to use search_scene_content over get_scene_content, label over text and create_diagram over edit_scene_content (16). Parameters carry ranges and enums in the reference, while edit_scene_content takes its elements as a JSON array string (9). Each endpoint has samples in six languages and error bodies for 400, 401 and 403 (12). The path is versioned as /api/v1 and a monthly product changelog carries API and MCP items, with no API changelog of its own (8). Per the 9 October check, not re-read on 4 November (terms ban automated access). 10 + 10 + 16 + 9 + 12 + 8 = 65.

AI Diagram Maker MCP 66

Five compact tools (25). Output can be SVG or PNG and the API can return the D2 source with debug, but there's nothing to page or trim, and results carry the rendered image (10 of 20). Typed error bodies with codes, a 422 that returns the failing D2 code, and retryAfter on 429 (16 of 20). No readOnlyHint or other annotations in the source and no idempotency key, and every call spends credits (5 of 20). Only content is required and the hosted endpoint needs no install, but there is no SDK beyond the server (10 of 15). 25 + 10 + 16 + 5 + 10 = 66.

Excalidraw 58

The docs list 37 MCP tools (5). The server shows a key only the tools its routes allow, so a read-only or route-restricted key cuts the list (7). Lists take offset and limit up to 100, logs take a cursor and filters, and search_scene_content returns only matching elements (18). Errors are JSON with statusCode, error and message, and seven status codes are documented (13). No idempotency keys. Deletes of scenes and collections move them to trash, and MCP annotations could not be read (8). create_diagram measures labels and routes arrows, but there is no SDK for the API (7). Per the 9 October check, not re-read on 4 November. 5 + 7 + 18 + 13 + 8 + 7 = 58.