AI Diagram Maker MCP vs Kroki

AI Diagram Maker MCP 17

Last release v3.0.8, published to npm on 10 April 2026, 210 days before this check (0). No release since 8 August (0). Four issues in all. The two open ones, from 4 May (hosted MCP credit usage) and 13 October 2026, show no reply, and one closed issue had a comment (5 of 25). In the official MCP registry under the GitHub-verified namespace io.github.erajasekar, but the entry is 1.0.0 from 19 March 2026 while npm is on 3.0.8 (10 of 15). The only workflow publishes to the registry. No tests or CI, and the MCP SDK floor is ^1.9.0 (2 of 10). 0 + 0 + 5 + 10 + 2 = 17.

Kroki 86

Version 0.34.0 on 25 October 2026, 10 days before the check (30). Three versions in the 90 days from 6 August, 0.32.1 on 12 August, 0.33.0 on 5 October and 0.34.0 on 25 October, each with code changes (20). Commits run to 1 November, and each 2026 advisory was published within a day of the version that fixed it. Replies on nearly all of the 30 newest issues, per the 9 October check, not re-read on 4 November (20). No official SDKs, and the CLI has had no release since December 2022 (7). Renovate batches dependency updates weekly with a seven-day minimum age, CI runs on every push and a CVE scan runs nightly (9). 30 + 20 + 20 + 7 + 9 = 86.

AI Diagram Maker MCP 20

No x402, MPP or L402 (0). Plan prices are public (Plus $10, Max $20 a month), with credits counted at 1,000 tokens each, so there's no per-diagram price (10 of 20). Basic is free forever with 50 credits a month, but the page doesn't say whether a card is needed or whether API and MCP calls are included (10 of 20, half as with an unstated card rule). A person signs up in the app and creates the key (0). 0 + 10 + 10 + 0 = 20.

Kroki 60

Read with the self-hosted rule. Free software with nothing to buy and no payment protocol (0). No price to publish (20). No card or trial needed (20). An agent can pull the Docker image, or call the public instance, with no signup (20).

AI Diagram Maker MCP 35

The MCP server is MIT (package.json and LICENSE, added 18 March 2026). The service is closed, under terms last updated 24 September 2025 that name the operator only as AI Diagram Maker (20 of 30). The privacy policy of the same date keeps diagrams, revisions and chat prompts and responses 'as long as necessary', and the terms license user input 'to provide and improve our services', with no retention periods and no word on model training or the AI providers used (8 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations named (0). The MCP server's source sends no telemetry of its own. 20 + 8 + 0 + 0 = 28.

Kroki 70

MIT licence, with every component in one public repository (30). No terms for the software or the public instance. Since 25 October 2026 kroki.io has a privacy policy for the website and the public instance. It says diagram sources are processed in memory and not stored, POST bodies aren't logged, access logs (with GET URLs and so the encoded source) are kept under 30 days, and it names Cloudflare, Exoscale, Netlify and Carbon Ads, with a contact and the CNIL. It agrees with the docs' statement that the server is stateless. No DPA (22 of 30, 15 on 9 October). KROKI_PORT is marked deprecated with the reason and a replacement, and no removal date. Removed behaviour is recorded in the changelog (8). OpenTelemetry tracing is configured by environment variable. The 0.32.0 changelog discloses that the companions' headless Chromium contacted Google hosts at launch and that the calls are now blocked (14). 30 + 22 + 8 + 14 = 74.

AI Diagram Maker MCP 30

Hosted lines, because every tool call is generated on the AI Diagram Maker service, through the hosted endpoint or the npx server. No status page found on the site or in the README (0). No readable incident history (5). The only rate-limit number is the example in the OpenAPI 429 schema ('Maximum 100 requests per day exceeded.'), which isn't stated as the limit (5 of 15). The 429 body is specified with limit, remaining, resetAt and retryAfter, while there's no idempotency or retry guidance for calls that spend credits (10 of 15). No SLA found (0). Nothing labels the service or server beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.

Kroki 64

Read with the local-software lines, because the listing grades the server an owner runs. The free public instance has no status page, SLA or published limit. Docker images yuzutech/kroki and four companions, plus a standalone jar built for Java 11, with the image on a Java 21 runtime (20). The main.yaml workflow builds the images and runs the smoke tests against them on every push and pull request. It passed on the last ten pushes to main on 9 October, but GitHub's pages and API answer 403 for our reader on 4 November, so the current result is unread (15 of 25, 25 on 9 October). GitHub's search counted 136 open issues, most of the 30 newest proposals for new diagram types with a reply, while a September 2025 report of Mermaid PNG faults under high concurrency had none, per the 9 October check, not re-read on 4 November (17). CHANGELOG.md follows Keep a Changelog and states semantic versioning, and 0.33.0 and 0.34.0 record their changed defaults under Changed (12). Version 0.34.0, with no 1.0 and no statement of stability, and diagrams.net marked experimental (0). 20 + 15 + 17 + 12 + 0 = 64.

AI Diagram Maker MCP 75

All five tools have zod input schemas in src/tools, and the repository ships an OpenAPI 3 file for POST /api/v2/diagrams/generate (25). No llms.txt (404) and no docs site for agents beyond the README (0). Each description says what the tool does and when to use it, listing trigger phrases and the diagram types, without saying when another tool fits better (16 of 20). content has a minimum length and diagramType an eight-value enum; the OpenAPI adds inputType and format enums (13 of 15). Examples in the parameter descriptions and README, and the OpenAPI documents 400, 401, 402, 422 (D2 failed to compile) and 429 with typed error bodies (13 of 15). Git tags from v1.1.1 to v3.0.8 and a /api/v2 path, with no changelog or release notes (8 of 15). 25 + 0 + 16 + 13 + 13 + 8 = 75.

Kroki 48

No OpenAPI file or other machine-readable contract. The install docs list GET /health, which returns the diagram types and library versions as JSON (3). No llms.txt on kroki.io (HTTP 404 on 4 November). The docs are AsciiDoc files in the repository (2). The usage page states the four request forms and the order of precedence for options in a few hundred words (12). Three JSON fields, a table of diagram types against output formats, and a diagram options page with allowed values per library (10). Examples for cURL and HTTPie, and encoding samples in ten languages. Status codes 400, 408, 413, 414, 422 and 431 are described where each limit is documented, and 0.34.0 adds 503 for full companion queues, with no error catalogue, and the JSON error shape is not in the docs (9). A public changelog with dated versions. Paths carry no API version apart from a /v1/health alias (12). 3 + 2 + 12 + 10 + 9 + 12 = 48.

AI Diagram Maker MCP 45

Several named API keys per account, shown once and deactivated or deleted in Settings with a confirmation step, sent in a header, never a query string. No scopes, and the user guide says anyone with a key can access the account (20 of 30). The tools only create diagrams and can't change or delete anything in the account, but there's no read-only key (12 of 20). Tools return diagrams built from the caller's own input. Image inputs can be any public URL (10 of 15). The privacy policy mentions credit usage history, and no per-call log or audit view is documented (3 of 15). No security.txt, disclosure policy, bug bounty or certification found (0). 20 + 12 + 10 + 3 + 0 = 45.

Kroki 56

No credential exists to leak or scope. The server has no authentication on its convert endpoints and binds all interfaces by default, so access control is the owner's network (18). KROKI_SAFE_MODE defaults to SECURE, which blocks file and network reads by diagram libraries, the container runs as the non-root user kroki, and the registration API is off in SECURE mode. Four advisories in 2026 showed ways round SECURE (13). The server renders the caller's own text and returns an image, with remote includes off by default (9). Request logs, GET /metrics and optional OpenTelemetry tracing (6). SECURITY.md asks for private GitHub advisories, four advisories were published with fixes in July and August 2026, a Trivy scan of the public images runs nightly and Renovate runs weekly. No security.txt (HTTP 404), bug bounty or certification (10).