{ "data": { "a": { "slug": "ai-diagram-maker-mcp", "name": "AI Diagram Maker MCP", "vendor": "AI Diagram Maker (Rajasekar Elango)", "vendorUrl": "https://www.aidiagrammaker.com", "kind": "mcp", "category": "diagramming", "summary": "AI Diagram Maker MCP is an MIT-licensed MCP server, hosted or run with npx, that sends text, JSON, ASCII art, images or Mermaid to the AI Diagram Maker service and returns a D2 software diagram with an edit link.", "url": "https://www.anchorterminal.com/tools/ai-diagram-maker-mcp", "markdownUrl": "https://www.anchorterminal.com/tools/ai-diagram-maker-mcp.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/ai-diagram-maker-mcp.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/ai-diagram-maker-mcp.json", "dns": "ai-diagram-maker-mcp.grade.anchorterminal.com", "repo": "https://github.com/erajasekar/ai-diagram-maker-mcp", "license": "MIT for the MCP server. The AI Diagram Maker service it calls is closed, under terms last updated 24 September 2025", "transports": [ "streamable-http", "stdio" ], "remoteUrl": "https://mcp.aidiagrammaker.com/mcp", "packages": [ { "registry": "npm", "name": "ai-diagram-maker-mcp" } ], "auth": "api-key", "authNotes": "An API key created in the AI Diagram Maker app under Settings \u003e API Keys, shown once, named, and deactivated, reactivated or deleted from the same page. No scopes; the user guide says anyone with the key can access the account. The hosted server takes it in `X-ADM-API-Key` or `Authorization: Bearer`, the local server in `ADM_API_KEY`. No OAuth.", "pricing": "freemium", "pricingNotes": "Basic is free with 50 AI credits a month. Plus $10 a month ($96 a year) with 250 credits, Max $20 a month ($192 a year) with 500. One credit is 1,000 tokens, and extra credits can't be bought. Which plans include API and MCP use isn't stated.", "priceSummary": "$10 / mo", "where": "both", "x402": { "level": "no", "evidence": "Plans sold through Lemon Squeezy checkout links. No x402, MPP or L402 in the repository, the OpenAPI file or the site (checked 2026-11-06). Out of credits returns 402 with no payment requirements.", "endpoints": [] }, "toolCount": 5, "popularity": { "githubStars": null, "npmWeekly": 63, "pypiWeekly": null, "asOf": "2026-11-06" }, "docsUrl": "https://github.com/erajasekar/ai-diagram-maker-mcp#readme", "openapi": "https://github.com/erajasekar/ai-diagram-maker-mcp/blob/main/apispec/adm-openapi.json", "registryName": "io.github.erajasekar/ai-diagram-maker-mcp", "capabilities": [ "diagram.create", "diagram.architecture", "diagram.as-code", "diagram.export" ], "tags": [ "hosted", "local", "mcp", "remote-mcp", "stdio", "mcp-registry", "openapi", "api-key", "freemium", "d2", "mcp-apps" ], "lastRelease": "2026-04-10", "graded": true, "anchor": { "graded": true, "score": 43.8, "grade": "E", "agentReady": false, "rank": 1225, "ranked": true, "rankOf": 1486, "categoryRank": 13, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 66, "maintenance": 17, "payments": 20, "reliability": 30, "schema": 75, "security": 45, "transparency": 35 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-06" }, "negative": 0, "verdict": "Five compact, typed tools turn text, JSON, ASCII art, images or Mermaid into an editable D2 diagram, and the API documents its error and rate-limit responses. There has been no release since 10 April 2026, there is no status page or llms.txt, and the API key opens the whole account with no scopes.", "bestFor": "Quick architecture, sequence, ERD and flowchart diagrams from a coding agent, with a link to edit them.", "strengths": [ "Five tools with zod schemas, a diagramType enum and descriptions that say when to use each", "OpenAPI 3 file for the generate endpoint with documented 402, 422 and 429 responses", "A 429 body gives limit, remaining, resetAt and retryAfter", "Hosted endpoint with nothing to install, or a local npx server", "Output stays editable as D2 in the app and exports to SVG, PNG or Mermaid" ], "weaknesses": [ "Last release 3.0.8 on 10 April 2026, and the registry entry still says 1.0.0", "No status page, SLA, llms.txt, changelog or security policy found", "API keys have no scopes and give full account access", "Plans don't say whether API and MCP calls are included, and an open issue asks how hosted MCP credits are counted", "The privacy policy names no AI model providers or other processors" ], "agentNotes": [ "Send the key in the `X-ADM-API-Key` header to https://mcp.aidiagrammaker.com/mcp, never in the URL", "Pick `diagramType` from the enum when the user names one; leave it out to let the service choose", "On a 402 stop and tell the user credits are gone; they reset monthly and can't be topped up", "On a 429 wait for `retryAfter` seconds before the next call", "Give the user the returned diagram link so they can edit it, since the tools can't revise an existing diagram" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "E", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 43.8 } ], "editorialScores": { "ergonomics": 66, "maintenance": 17, "payments": 20, "reliability": 30, "schema": 75, "security": 45, "transparency": 28 }, "provenanceScore": 42, "checked": { "categories": { "ergonomics": "2026-11-06", "maintenance": "2026-11-06", "payments": "2026-11-06", "reliability": "2026-11-06", "schema": "2026-11-06", "security": "2026-11-06", "transparency": "2026-11-06" }, "last": "2026-11-06", "oldest": "2026-11-06", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "ADM_API_KEY=your_api_key npx ai-diagram-maker-mcp@latest", "claudeCode": "claude mcp add ai-diagram-maker -t stdio -e ADM_API_KEY=\u003capi_key\u003e -- npx -y ai-diagram-maker-mcp@latest", "config": { "mcpServers": { "ai-diagram-maker": { "headers": { "X-ADM-API-Key": "YOUR_API_KEY" }, "url": "https://mcp.aidiagrammaker.com/mcp" } } } }, "letme": { "capability": "https://letme.dev/diagram.create", "tool": "https://letme.dev/ai-diagram-maker-mcp" }, "area": "design-diagrams", "unitPrices": [ { "item": "Plus plan", "unit": "month", "usd": 10, "note": "250 AI credits a month; $96 billed yearly" }, { "item": "Max plan", "unit": "month", "usd": 20, "note": "500 AI credits a month; $192 billed yearly" } ], "provenance": { "legalEntity": "", "domain": "aidiagrammaker.com", "domainRegistered": "2025-08-21", "endpointOnVendorDomain": true, "terms": "https://www.aidiagrammaker.com/terms", "privacy": "https://www.aidiagrammaker.com/privacy", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-11-06", "notes": [ "The terms and privacy policy, both last updated 24 September 2025, name the company only as AI Diagram Maker, under United States law, with aidiagrammaker@gmail.com as the contact. The npm package names Rajasekar Elango as author.", "The terms list scraping among prohibited uses. Public pages were read as data.", "www.aidiagrammaker.com/robots.txt allows all paths.", "RDAP gives aidiagrammaker.com a registration date of 21 August 2025.", "/.well-known/security.txt returns 404. No status page or changelog found; the GitHub releases are the only dated record." ], "score": 42 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/ai-diagram-maker-mcp.json", "live": { "slug": "ai-diagram-maker-mcp", "probe": { "target": "https://mcp.aidiagrammaker.com/mcp", "method": "mcp-initialize", "lastAt": "2026-11-07T18:20:09.018580127Z", "lastOk": false, "lastStatus": 0, "lastMs": 0, "lastNote": "TLS certificate problem", "authRequired": false, "uptime24h": 0, "uptime30d": 0, "p50ms24h": 0, "p95ms24h": 0, "samples24h": 200, "samples30d": 200, "days": [ { "date": "2026-11-06", "probes": 13, "ok": 0 }, { "date": "2026-11-07", "probes": 187, "ok": 0 } ], "outages": [ { "start": "2026-11-06T22:45:03.399368446Z", "end": "0001-01-01T00:00:00Z", "note": "TLS certificate problem" } ] }, "versions": [ { "registry": "mcp-registry", "name": "io.github.erajasekar/ai-diagram-maker-mcp", "version": "1.0.0", "seenAt": "2026-11-07T18:16:28.95801333Z" }, { "registry": "npm", "name": "ai-diagram-maker-mcp", "version": "3.0.8", "seenAt": "2026-11-06T23:04:20.113009064Z" } ], "githubStars": 10, "npmWeekly": 63, "securityTxt": { "url": "https://aidiagrammaker.com/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:48.542497373Z" }, "pages": [ { "url": "https://www.aidiagrammaker.com/privacy", "kind": "privacy", "status": 200, "checkedAt": "2026-11-07T14:24:25.783359417Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "40a879ba4963" }, { "url": "https://www.aidiagrammaker.com/terms", "kind": "terms", "status": 200, "checkedAt": "2026-11-07T14:24:27.95923952Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "9b4e6f213ed0" } ], "mcpTools": { "url": "https://mcp.aidiagrammaker.com/mcp", "checkedAt": "2026-11-07T01:42:20.967941233Z", "status": "error", "note": "Post \"https://mcp.aidiagrammaker.com/mcp\": tls: failed to verify certificate: x509: certificate is valid for *.up.railway.app, up.railway.app, not mcp.aidiagrammaker.com", "changedAt": "2026-11-07T01:42:20.967941233Z" }, "updatedAt": "2026-11-07T18:20:09.018580127Z" } }, "answer": "Kroki scores 52.9 (D) on agent readiness against AI Diagram Maker MCP's 43.8 (E), and leads in 6 of 7 scored categories. AI Diagram Maker MCP leads on schema \u0026 documentation.", "b": { "slug": "kroki", "name": "Kroki", "vendor": "Yuzu tech", "vendorUrl": "https://kroki.io", "kind": "http-api", "category": "diagramming", "summary": "Kroki is an open-source HTTP server from Yuzu tech that converts diagram text in 29 formats, including PlantUML, Mermaid, GraphViz and D2, into SVG, PNG or PDF. Owners run it from Docker images, and kroki.io is a free public instance.", "url": "https://www.anchorterminal.com/tools/kroki", "markdownUrl": "https://www.anchorterminal.com/tools/kroki.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/kroki.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/kroki.json", "dns": "kroki.grade.anchorterminal.com", "repo": "https://github.com/yuzutech/kroki", "license": "MIT", "transports": [ "http" ], "packages": [ { "registry": "oci", "name": "yuzutech/kroki" }, { "registry": "oci", "name": "yuzutech/kroki-mermaid" }, { "registry": "oci", "name": "yuzutech/kroki-bpmn" }, { "registry": "oci", "name": "yuzutech/kroki-excalidraw" } ], "auth": "none", "authNotes": "No account, key or login on the convert endpoints, on a self-hosted server or on the public instance at kroki.io. The server binds all interfaces on port 8000 unless `KROKI_LISTEN` says otherwise. An optional bearer token, `KROKI_COMPANION_REGISTRATION_TOKEN`, protects only the `/services` registration API, which is off by default.", "pricing": "free", "pricingNotes": "Free under the MIT licence, with nothing to buy. The public instance at kroki.io is free and paid for by sponsors, for reasonable, non-commercial use with no uptime guarantee. Third parties sell hosting, which the project says it does not operate.", "priceSummary": "Free · OSS", "where": "local", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the docs or the source (checked 2026-10-09).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": 4365, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-09" }, "docsUrl": "https://docs.kroki.io/kroki/setup/usage/", "capabilities": [ "diagram.as-code", "diagram.create", "diagram.export", "diagram.architecture" ], "tags": [ "open-source", "self-hosted", "http-api", "docker", "diagram-as-code", "plantuml", "mermaid", "graphviz", "no-auth", "free" ], "lastRelease": "2026-10-25", "graded": true, "anchor": { "graded": true, "score": 52.9, "grade": "D", "agentReady": false, "rank": 966, "ranked": true, "rankOf": 1486, "categoryRank": 9, "methodology": "0.7", "run": "2026-10-01", "scores": { "ergonomics": 70, "maintenance": 86, "payments": 60, "reliability": 64, "schema": 48, "security": 56, "transparency": 70 }, "pending": [ "performance", "tasks" ], "assessment": { "confidence": "medium", "date": "2026-11-04" }, "negative": -10, "negativeNotes": [ "27 July to 12 August 2026. Four advisories on the repository, per the 9 October reading of GitHub's advisory pages (GitHub answers 403 on 4 November, and OSV holds none of them). GHSA-wmpp-fj9c-w766 (critical, CVSS 9.8) allowed unauthenticated remote code execution on `/tikz/svg` in 0.21.0 up to 0.32.0 whatever the safe mode. GHSA-r54f-fq6c-53vw (high, CVE-2026-102359), GHSA-px99-rjv4-49g8 (medium, CVE-2026-102356) and GHSA-9p7m-vrmg-qp4q (high) let TikZ, Mermaid and Vega diagrams read local files or fetch URLs in `SECURE` mode. All are fixed, in 0.32.1 at the latest, more than two months before the check, and the maintainers published each, so each costs 1 (-4) (https://github.com/yuzutech/kroki/security/advisories).", "29 October 2026. Commit f5655d0 (#2225) fixes server-side request forgery in the diagrams.net, Excalidraw and BPMN companions, whose headless Chromium could fetch an attacker-controlled URL from image shapes and background images. The fix sits under `Unreleased` in the changelog, in no release on 4 November, with no advisory (-3). A release with no advisory would move it to the released-fix term below (https://github.com/yuzutech/kroki/blob/main/CHANGELOG.md).", "27 July to 3 August 2026. Commit ea09cdc, released in 0.32.0 on 3 August, fixes the BPMN companion assigning the diagram source to `innerHTML`, which let a crafted `/bpmn/svg` request run script in its headless Chromium and, with web security disabled, make cross-origin requests and read the answers. None of the four advisories on the 9 October reading of GitHub's list covers it, and release prose isn't an advisory, so it takes the released-fix term, as ntfy's and llama.cpp's fixes without advisories did (-3) (https://github.com/yuzutech/kroki/blob/main/CHANGELOG.md)." ], "verdict": "One unauthenticated POST with diagram text returns an image for 29 diagram types, and version 0.34.0 shipped on 25 October 2026. Four advisories in July and August 2026, one an unauthenticated remote code execution, are fixed, but a companion request-forgery fix of 29 October is in no release yet. No OpenAPI file, terms or status page exist.", "bestFor": "Agents that write diagrams in several text formats and want one render endpoint, on a private network or through the public instance for non-sensitive diagrams.", "strengths": [ "`POST /` with `diagram_source`, `diagram_type` and `output_format`, or plain text to `/\u003ctype\u003e/\u003cformat\u003e`, returns the image. No account or key", "One API covers 29 diagram types, among them PlantUML, C4, Structurizr, Mermaid, GraphViz, D2, DBML, BPMN, Excalidraw and Vega", "`KROKI_SAFE_MODE` defaults to `SECURE`, which blocks file and network reads by diagram libraries, and the container runs as the non-root user `kroki`", "Three versions shipped between 12 August and 25 October 2026, and CI builds the images and runs smoke tests on every push", "Since 25 October 2026 kroki.io's privacy policy says diagram sources aren't stored and access logs are kept under 30 days" ], "weaknesses": [ "GHSA-wmpp-fj9c-w766 (CVSS 9.8) allowed unauthenticated remote code execution on `/tikz/svg` in versions 0.21.0 up to 0.32.0, whatever the safe mode. Fixed 3 August 2026", "A fix of 29 October 2026 for request forgery through image URLs in the diagrams.net, Excalidraw and BPMN companions is in no release yet", "No OpenAPI file, llms.txt or error catalogue. The JSON error shape is in the source and not in the documentation", "The public instance at kroki.io has no terms, status page or published rate limit. The CLI page limits the demonstration server to reasonable, non-commercial use", "The server has no authentication on its convert endpoints and binds all interfaces on port 8000 by default. The version is 0.34.0, with no 1.0" ], "agentNotes": [ "Send `POST /\u003ctype\u003e/\u003cformat\u003e` with `Content-Type: text/plain` and the diagram as the body. This avoids the deflate and base64 encoding that GET needs", "Send `Accept: application/json` on a JSON request to get errors as `{\"error\": {\"code\", \"message\"}}`. With an SVG Accept header the error arrives as an image", "Call `GET /health` first to list the diagram types and library versions the instance has. Mermaid, BPMN, Excalidraw and diagrams.net need companion containers", "Run 0.32.1 or later before rendering untrusted text, and keep the diagrams.net, Excalidraw and BPMN companions off untrusted input until a release carries the 29 October request-forgery fix", "Self-host for private diagrams with `docker run -p8000:8000 yuzutech/kroki`, and set `KROKI_LISTEN=127.0.0.1:8000` or a network rule, since the server has no authentication", "Expect a 503 from 0.34.0 when a companion's queue is full (default 100 waiting, 30 seconds), and retry later" ], "metrics": { "kind": "local", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.7", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 52.9 } ], "editorialScores": { "ergonomics": 70, "maintenance": 86, "payments": 60, "reliability": 64, "schema": 48, "security": 56, "transparency": 74 }, "provenanceScore": 65, "checked": { "categories": { "ergonomics": "2026-11-04", "maintenance": "2026-11-04", "payments": "2026-11-04", "reliability": "2026-11-04", "schema": "2026-11-04", "security": "2026-11-04", "transparency": "2026-11-04" }, "last": "2026-11-04", "lastMoved": "2026-11-04", "oldest": "2026-11-04", "stale": false, "staleAfterDays": 90 } }, "connect": { "install": "docker run -p8000:8000 yuzutech/kroki", "http": "curl https://kroki.io/graphviz/svg --data-raw 'digraph G {Hello-\u003eWorld}'" }, "letme": { "capability": "https://letme.dev/diagram.as-code", "tool": "https://letme.dev/kroki" }, "area": "design-diagrams", "provenance": { "legalEntity": "Yuzu tech, a French software firm. No registered legal form found", "domain": "kroki.io", "domainRegistered": "2019-01-06", "endpointOnVendorDomain": true, "terms": "", "privacy": "https://kroki.io/privacy.html", "statusPage": "", "changelog": "https://github.com/yuzutech/kroki/blob/main/CHANGELOG.md", "securityTxt": "none", "checked": "2026-11-04", "notes": [ "The kroki.io home page says Kroki is built and maintained by Yuzu tech, and links https://yuzutech.fr, whose pages name no legal form or registration number. `LICENSE` reads Copyright (c) 2020-present Kroki", "No terms document was found on kroki.io or docs.kroki.io. A privacy policy for the website and the public instance, effective 25 October 2026, is at https://kroki.io/privacy.html. The MIT licence stands in for the software terms", "https://kroki.io/.well-known/security.txt answered 404 on 4 November 2026. `SECURITY.md` asks for reports through a private GitHub security advisory", "The lead wrote the vendor as Yuzutech. The site writes Yuzu tech, and the GitHub organisation is `yuzutech`", "The endpoint on the vendor's domain is the free public instance. The listing grades the server an owner runs" ], "score": 65 }, "pageJsonUrl": "https://www.anchorterminal.com/tools/kroki.json", "live": { "slug": "kroki", "versions": [ { "registry": "github", "name": "yuzutech/kroki", "version": "v0.35.0", "released": "2026-11-05", "seenAt": "2026-11-06T23:37:51.955591757Z" } ], "githubStars": 4397, "securityTxt": { "url": "https://kroki.io/.well-known/security.txt", "state": "none", "checkedAt": "2026-11-07T16:00:36.628767521Z" }, "domain": { "domain": "kroki.io", "checkedAt": "2026-11-01T14:23:45.368804349Z" }, "pages": [ { "url": "https://raw.githubusercontent.com/yuzutech/kroki/main/CHANGELOG.md", "kind": "deprecations", "status": 200, "checkedAt": "2026-11-07T14:24:11.133354961Z", "changedAt": "2026-11-07T14:24:11.133354961Z", "fingerprint": "527a5942dadb" }, { "url": "https://kroki.io/privacy.html", "kind": "privacy", "status": 304, "checkedAt": "2026-11-07T14:12:12.261315499Z", "changedAt": "0001-01-01T00:00:00Z", "fingerprint": "11123fc117d2" } ], "github": { "repo": "yuzutech/kroki", "checkedAt": "2026-11-02T09:40:03.877023097Z", "stars": 4390, "archived": false, "issuesEnabled": true, "pushedAt": "2026-11-02T08:44:52Z", "openIssues": 130, "openPRs": 1, "issuesOpened90d": 16, "issuesClosed90d": 18, "prsMerged90d": 102, "ci": { "branch": "main", "runs": 50, "success": 50, "failure": 0, "other": 0, "latest": "success", "latestAt": "2026-11-01T13:54:24Z" }, "advisories": [ { "ghsa": "GHSA-9p7m-vrmg-qp4q", "severity": "high", "published": "2026-08-12T07:37:27Z" }, { "ghsa": "GHSA-wmpp-fj9c-w766", "severity": "critical", "published": "2026-08-03T16:26:32Z" }, { "ghsa": "GHSA-r54f-fq6c-53vw", "cve": "CVE-2026-102359", "severity": "high", "published": "2026-07-27T14:14:07Z" }, { "ghsa": "GHSA-px99-rjv4-49g8", "cve": "CVE-2026-102356", "severity": "medium", "published": "2026-07-27T14:13:50Z" } ], "replies": { "sampled": 25, "unanswered": 2, "medianDays": 0.7 } }, "updatedAt": "2026-11-07T16:00:36.628767521Z" } }, "edges": [ { "by": 69, "category": "maintenance", "leads": "kroki", "name": "Maintenance \u0026 community", "reasons": { "a": "Last release v3.0.8, published to npm on 10 April 2026, 210 days before this check (0). No release since 8 August (0). Four issues in all. The two open ones, from 4 May (hosted MCP credit usage) and 13 October 2026, show no reply, and one closed issue had a comment (5 of 25). In the official MCP registry under the GitHub-verified namespace io.github.erajasekar, but the entry is 1.0.0 from 19 March 2026 while npm is on 3.0.8 (10 of 15). The only workflow publishes to the registry. No tests or CI, and the MCP SDK floor is ^1.9.0 (2 of 10). 0 + 0 + 5 + 10 + 2 = 17.", "b": "Version 0.34.0 on 25 October 2026, 10 days before the check (30). Three versions in the 90 days from 6 August, 0.32.1 on 12 August, 0.33.0 on 5 October and 0.34.0 on 25 October, each with code changes (20). Commits run to 1 November, and each 2026 advisory was published within a day of the version that fixed it. Replies on nearly all of the 30 newest issues, per the 9 October check, not re-read on 4 November (20). No official SDKs, and the CLI has had no release since December 2022 (7). Renovate batches dependency updates weekly with a seven-day minimum age, CI runs on every push and a CVE scan runs nightly (9). 30 + 20 + 20 + 7 + 9 = 86." }, "scores": { "a": 17, "b": 86 } }, { "by": 40, "category": "payments", "leads": "kroki", "name": "Payments \u0026 pricing", "reasons": { "a": "No x402, MPP or L402 (0). Plan prices are public (Plus $10, Max $20 a month), with credits counted at 1,000 tokens each, so there's no per-diagram price (10 of 20). Basic is free forever with 50 credits a month, but the page doesn't say whether a card is needed or whether API and MCP calls are included (10 of 20, half as with an unstated card rule). A person signs up in the app and creates the key (0). 0 + 10 + 10 + 0 = 20.", "b": "Read with the self-hosted rule. Free software with nothing to buy and no payment protocol (0). No price to publish (20). No card or trial needed (20). An agent can pull the Docker image, or call the public instance, with no signup (20)." }, "scores": { "a": 20, "b": 60 } }, { "by": 35, "category": "transparency", "leads": "kroki", "name": "Transparency \u0026 trust", "reasons": { "a": "The MCP server is MIT (package.json and LICENSE, added 18 March 2026). The service is closed, under terms last updated 24 September 2025 that name the operator only as AI Diagram Maker (20 of 30). The privacy policy of the same date keeps diagrams, revisions and chat prompts and responses 'as long as necessary', and the terms license user input 'to provide and improve our services', with no retention periods and no word on model training or the AI providers used (8 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations named (0). The MCP server's source sends no telemetry of its own. 20 + 8 + 0 + 0 = 28.", "b": "MIT licence, with every component in one public repository (30). No terms for the software or the public instance. Since 25 October 2026 kroki.io has a privacy policy for the website and the public instance. It says diagram sources are processed in memory and not stored, POST bodies aren't logged, access logs (with GET URLs and so the encoded source) are kept under 30 days, and it names Cloudflare, Exoscale, Netlify and Carbon Ads, with a contact and the CNIL. It agrees with the docs' statement that the server is stateless. No DPA (22 of 30, 15 on 9 October). `KROKI_PORT` is marked deprecated with the reason and a replacement, and no removal date. Removed behaviour is recorded in the changelog (8). OpenTelemetry tracing is configured by environment variable. The 0.32.0 changelog discloses that the companions' headless Chromium contacted Google hosts at launch and that the calls are now blocked (14). 30 + 22 + 8 + 14 = 74." }, "scores": { "a": 35, "b": 70 } }, { "by": 34, "category": "reliability", "leads": "kroki", "name": "Reliability", "reasons": { "a": "Hosted lines, because every tool call is generated on the AI Diagram Maker service, through the hosted endpoint or the npx server. No status page found on the site or in the README (0). No readable incident history (5). The only rate-limit number is the example in the OpenAPI 429 schema ('Maximum 100 requests per day exceeded.'), which isn't stated as the limit (5 of 15). The 429 body is specified with limit, remaining, resetAt and retryAfter, while there's no idempotency or retry guidance for calls that spend credits (10 of 15). No SLA found (0). Nothing labels the service or server beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.", "b": "Read with the local-software lines, because the listing grades the server an owner runs. The free public instance has no status page, SLA or published limit. Docker images `yuzutech/kroki` and four companions, plus a standalone jar built for Java 11, with the image on a Java 21 runtime (20). The `main.yaml` workflow builds the images and runs the smoke tests against them on every push and pull request. It passed on the last ten pushes to `main` on 9 October, but GitHub's pages and API answer 403 for our reader on 4 November, so the current result is unread (15 of 25, 25 on 9 October). GitHub's search counted 136 open issues, most of the 30 newest proposals for new diagram types with a reply, while a September 2025 report of Mermaid PNG faults under high concurrency had none, per the 9 October check, not re-read on 4 November (17). CHANGELOG.md follows Keep a Changelog and states semantic versioning, and 0.33.0 and 0.34.0 record their changed defaults under Changed (12). Version 0.34.0, with no 1.0 and no statement of stability, and diagrams.net marked experimental (0). 20 + 15 + 17 + 12 + 0 = 64." }, "scores": { "a": 30, "b": 64 } }, { "by": 27, "category": "schema", "leads": "ai-diagram-maker-mcp", "name": "Schema \u0026 documentation", "reasons": { "a": "All five tools have zod input schemas in src/tools, and the repository ships an OpenAPI 3 file for POST /api/v2/diagrams/generate (25). No llms.txt (404) and no docs site for agents beyond the README (0). Each description says what the tool does and when to use it, listing trigger phrases and the diagram types, without saying when another tool fits better (16 of 20). `content` has a minimum length and `diagramType` an eight-value enum; the OpenAPI adds `inputType` and `format` enums (13 of 15). Examples in the parameter descriptions and README, and the OpenAPI documents 400, 401, 402, 422 (D2 failed to compile) and 429 with typed error bodies (13 of 15). Git tags from v1.1.1 to v3.0.8 and a /api/v2 path, with no changelog or release notes (8 of 15). 25 + 0 + 16 + 13 + 13 + 8 = 75.", "b": "No OpenAPI file or other machine-readable contract. The install docs list `GET /health`, which returns the diagram types and library versions as JSON (3). No llms.txt on kroki.io (HTTP 404 on 4 November). The docs are AsciiDoc files in the repository (2). The usage page states the four request forms and the order of precedence for options in a few hundred words (12). Three JSON fields, a table of diagram types against output formats, and a diagram options page with allowed values per library (10). Examples for cURL and HTTPie, and encoding samples in ten languages. Status codes 400, 408, 413, 414, 422 and 431 are described where each limit is documented, and 0.34.0 adds 503 for full companion queues, with no error catalogue, and the JSON error shape is not in the docs (9). A public changelog with dated versions. Paths carry no API version apart from a `/v1/health` alias (12). 3 + 2 + 12 + 10 + 9 + 12 = 48." }, "scores": { "a": 75, "b": 48 } }, { "by": 11, "category": "security", "leads": "kroki", "name": "Security \u0026 auth", "reasons": { "a": "Several named API keys per account, shown once and deactivated or deleted in Settings with a confirmation step, sent in a header, never a query string. No scopes, and the user guide says anyone with a key can access the account (20 of 30). The tools only create diagrams and can't change or delete anything in the account, but there's no read-only key (12 of 20). Tools return diagrams built from the caller's own input. Image inputs can be any public URL (10 of 15). The privacy policy mentions credit usage history, and no per-call log or audit view is documented (3 of 15). No security.txt, disclosure policy, bug bounty or certification found (0). 20 + 12 + 10 + 3 + 0 = 45.", "b": "No credential exists to leak or scope. The server has no authentication on its convert endpoints and binds all interfaces by default, so access control is the owner's network (18). `KROKI_SAFE_MODE` defaults to `SECURE`, which blocks file and network reads by diagram libraries, the container runs as the non-root user `kroki`, and the registration API is off in `SECURE` mode. Four advisories in 2026 showed ways round `SECURE` (13). The server renders the caller's own text and returns an image, with remote includes off by default (9). Request logs, `GET /metrics` and optional OpenTelemetry tracing (6). `SECURITY.md` asks for private GitHub advisories, four advisories were published with fixes in July and August 2026, a Trivy scan of the public images runs nightly and Renovate runs weekly. No security.txt (HTTP 404), bug bounty or certification (10)." }, "scores": { "a": 45, "b": 56 } } ], "facts": [ { "a": "MCP server", "b": "HTTP API", "name": "Kind" }, { "a": "AI Diagram Maker (Rajasekar Elango)", "b": "Yuzu tech", "name": "Vendor" }, { "a": "https://mcp.aidiagrammaker.com/mcp", "b": "no (local only)", "name": "Hosted endpoint" }, { "a": "Streamable HTTP, stdio", "b": "HTTP", "name": "Transports" }, { "a": "API key", "b": "None", "name": "Auth" }, { "a": "Freemium", "b": "Free", "name": "Pricing" }, { "a": "no", "b": "no", "name": "x402" }, { "a": "MIT for the MCP server. The AI Diagram Maker service it calls is closed, under terms last updated 24 September 2025", "b": "MIT", "name": "Licence" }, { "a": "5", "b": "none", "name": "Tools exposed" }, { "a": "no", "b": "no", "name": "Read-only variant documented" }, { "a": "no", "b": "no", "name": "llms.txt" }, { "a": "io.github.erajasekar/ai-diagram-maker-mcp", "b": "not listed", "name": "MCP registry" }, { "a": "2026-04-10", "b": "2026-10-25", "name": "Last release" }, { "a": "2025-09-24", "b": "no document linked", "name": "Terms last updated" }, { "a": "2025-09-24", "b": "not read yet", "name": "Privacy policy last updated" }, { "a": "not found in the text", "b": "not read yet", "name": "Customer content may train models" }, { "a": "yes", "b": "not read yet", "name": "Terms restrict automated access" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms restrict benchmarking" }, { "a": "not found in the text", "b": "not read yet", "name": "Terms or service can change without notice" }, { "a": "not found in the text", "b": "not read yet", "name": "Arbitration or class-action waiver" }, { "a": "63 npm/wk", "b": "4.4k stars", "name": "Popularity" } ], "faq": [ { "answer": "Kroki scores 52.9 (D) on agent readiness against AI Diagram Maker MCP's 43.8 (E), and leads in 6 of 7 scored categories. AI Diagram Maker MCP leads on schema \u0026 documentation.", "question": "Which is better for AI agents, AI Diagram Maker MCP or Kroki?" }, { "answer": "AI Diagram Maker MCP needs an API key. Kroki needs no key.", "question": "Do AI Diagram Maker MCP and Kroki need an API key?" }, { "answer": "AI Diagram Maker MCP has a hosted endpoint at https://mcp.aidiagrammaker.com/mcp. No hosted endpoint is listed for Kroki.", "question": "Can an agent call AI Diagram Maker MCP and Kroki without installing anything?" }, { "answer": "No open-source release is listed for AI Diagram Maker MCP. Kroki is open source (MIT).", "question": "Are AI Diagram Maker MCP and Kroki open source?" } ], "goodFor": [ { "aheadOn": [ "Schema \u0026 documentation, 75 against 48" ], "also": [ "A hosted endpoint, with nothing to install", "Runs on your own machine", "No incidents deducted, where Kroki loses 10 points for them" ], "goodFor": "Quick architecture, sequence, ERD and flowchart diagrams from a coding agent, with a link to edit them.", "slug": "ai-diagram-maker-mcp", "watchFor": "Last release 3.0.8 on 10 April 2026, and the registry entry still says 1.0.0" }, { "aheadOn": [ "Reliability, 64 against 30", "Security \u0026 auth, 56 against 45", "Payments \u0026 pricing, 60 against 20", "Maintenance \u0026 community, 86 against 17", "Transparency \u0026 trust, 70 against 35" ], "also": [ "No key needed to call it", "Open source" ], "goodFor": "Agents that write diagrams in several text formats and want one render endpoint, on a private network or through the public instance for non-sensitive diagrams.", "slug": "kroki", "watchFor": "GHSA-wmpp-fj9c-w766 (CVSS 9.8) allowed unauthenticated remote code execution on `/tikz/svg` in versions 0.21.0 up to 0.32.0, whatever the safe mode. Fixed 3 August 2026" } ], "history": { "ai-diagram-maker-mcp": null, "kroki": [ { "causes": [ "security", "product", "correction" ], "date": "2026-11-04", "delta": -6.6, "from": 59.5, "fromGrade": "C", "to": 52.9, "toGrade": "D" }, { "causes": [ "evidence" ], "date": "2026-10-27", "delta": 0.3, "from": 59.2, "fromGrade": "C", "to": 59.5, "toGrade": "C" } ] }, "job": { "capability": "diagram.create", "name": "Diagram creation" }, "others": [ { "json": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-cloudviz.json", "title": "AI Diagram Maker MCP vs Cloudviz API", "url": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-cloudviz" }, { "json": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-d2.json", "title": "AI Diagram Maker MCP vs D2", "url": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-d2" }, { "json": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-diagrams-so.json", "title": "AI Diagram Maker MCP vs Diagrams.so API + MCP", "url": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-diagrams-so" }, { "json": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-drawio.json", "title": "AI Diagram Maker MCP vs draw.io + MCP", "url": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-drawio" }, { "json": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-eraser.json", "title": "AI Diagram Maker MCP vs Eraser API + MCP", "url": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-eraser" }, { "json": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-excaliclaw.json", "title": "AI Diagram Maker MCP vs ExcaliClaw", "url": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-excaliclaw" }, { "json": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-excalidraw.json", "title": "AI Diagram Maker MCP vs Excalidraw", "url": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-excalidraw" }, { "json": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-lucid.json", "title": "AI Diagram Maker MCP vs Lucid API + MCP", "url": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-lucid" }, { "json": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-mermaid-chart.json", "title": "AI Diagram Maker MCP vs Mermaid Chart MCP", "url": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-mermaid-chart" }, { "json": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-mumble.json", "title": "AI Diagram Maker MCP vs Mumble", "url": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-mumble" }, { "json": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-mural-mcp.json", "title": "AI Diagram Maker MCP vs Mural MCP", "url": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-mural-mcp" }, { "json": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-plantuml.json", "title": "AI Diagram Maker MCP vs PlantUML", "url": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-plantuml" }, { "json": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-structurizr.json", "title": "AI Diagram Maker MCP vs Structurizr + MCP", "url": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-structurizr" }, { "json": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-tldraw.json", "title": "AI Diagram Maker MCP vs tldraw SDK + MCP", "url": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-tldraw" }, { "json": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-whimsical.json", "title": "AI Diagram Maker MCP vs Whimsical MCP", "url": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-whimsical" }, { "json": "https://www.anchorterminal.com/compare/cloudviz-vs-kroki.json", "title": "Cloudviz API vs Kroki", "url": "https://www.anchorterminal.com/compare/cloudviz-vs-kroki" }, { "json": "https://www.anchorterminal.com/compare/diagrams-so-vs-kroki.json", "title": "Diagrams.so API + MCP vs Kroki", "url": "https://www.anchorterminal.com/compare/diagrams-so-vs-kroki" }, { "json": "https://www.anchorterminal.com/compare/drawio-vs-kroki.json", "title": "draw.io + MCP vs Kroki", "url": "https://www.anchorterminal.com/compare/drawio-vs-kroki" }, { "json": "https://www.anchorterminal.com/compare/eraser-vs-kroki.json", "title": "Eraser API + MCP vs Kroki", "url": "https://www.anchorterminal.com/compare/eraser-vs-kroki" }, { "json": "https://www.anchorterminal.com/compare/excaliclaw-vs-kroki.json", "title": "ExcaliClaw vs Kroki", "url": "https://www.anchorterminal.com/compare/excaliclaw-vs-kroki" }, { "json": "https://www.anchorterminal.com/compare/excalidraw-vs-kroki.json", "title": "Excalidraw vs Kroki", "url": "https://www.anchorterminal.com/compare/excalidraw-vs-kroki" }, { "json": "https://www.anchorterminal.com/compare/kroki-vs-mumble.json", "title": "Kroki vs Mumble", "url": "https://www.anchorterminal.com/compare/kroki-vs-mumble" }, { "json": "https://www.anchorterminal.com/compare/kroki-vs-mural-mcp.json", "title": "Kroki vs Mural MCP", "url": "https://www.anchorterminal.com/compare/kroki-vs-mural-mcp" }, { "json": "https://www.anchorterminal.com/compare/kroki-vs-whimsical.json", "title": "Kroki vs Whimsical MCP", "url": "https://www.anchorterminal.com/compare/kroki-vs-whimsical" }, { "json": "https://www.anchorterminal.com/compare/d2-vs-kroki.json", "title": "D2 vs Kroki", "url": "https://www.anchorterminal.com/compare/d2-vs-kroki" }, { "json": "https://www.anchorterminal.com/compare/kroki-vs-lucid.json", "title": "Kroki vs Lucid API + MCP", "url": "https://www.anchorterminal.com/compare/kroki-vs-lucid" }, { "json": "https://www.anchorterminal.com/compare/kroki-vs-mermaid-chart.json", "title": "Kroki vs Mermaid Chart MCP", "url": "https://www.anchorterminal.com/compare/kroki-vs-mermaid-chart" }, { "json": "https://www.anchorterminal.com/compare/kroki-vs-plantuml.json", "title": "Kroki vs PlantUML", "url": "https://www.anchorterminal.com/compare/kroki-vs-plantuml" }, { "json": "https://www.anchorterminal.com/compare/kroki-vs-structurizr.json", "title": "Kroki vs Structurizr + MCP", "url": "https://www.anchorterminal.com/compare/kroki-vs-structurizr" }, { "json": "https://www.anchorterminal.com/compare/kroki-vs-tldraw.json", "title": "Kroki vs tldraw SDK + MCP", "url": "https://www.anchorterminal.com/compare/kroki-vs-tldraw" } ], "panel": null, "scores": [ { "ai-diagram-maker-mcp": 30, "by": 34, "edge": "kroki", "key": "reliability", "kroki": 64, "name": "Reliability", "weight": 16 }, { "key": "performance", "name": "Performance", "pending": true, "weight": 10 }, { "ai-diagram-maker-mcp": 75, "by": 27, "edge": "ai-diagram-maker-mcp", "key": "schema", "kroki": 48, "name": "Schema \u0026 documentation", "weight": 13 }, { "ai-diagram-maker-mcp": 66, "by": 4, "edge": "kroki", "key": "ergonomics", "kroki": 70, "name": "Agent ergonomics", "weight": 13 }, { "ai-diagram-maker-mcp": 45, "by": 11, "edge": "kroki", "key": "security", "kroki": 56, "name": "Security \u0026 auth", "weight": 14 }, { "ai-diagram-maker-mcp": 20, "by": 40, "edge": "kroki", "key": "payments", "kroki": 60, "name": "Payments \u0026 pricing", "weight": 10 }, { "key": "tasks", "name": "Task success", "pending": true, "weight": 10 }, { "ai-diagram-maker-mcp": 17, "by": 69, "edge": "kroki", "key": "maintenance", "kroki": 86, "name": "Maintenance \u0026 community", "weight": 7 }, { "ai-diagram-maker-mcp": 35, "by": 35, "edge": "kroki", "key": "transparency", "kroki": 70, "name": "Transparency \u0026 trust", "weight": 7 } ], "summary": "Kroki scores 52.9 (D) on agent readiness against AI Diagram Maker MCP's 43.8 (E), and leads in 6 of 7 scored categories. AI Diagram Maker MCP leads on schema \u0026 documentation. Both do diagram creation.", "tasks": null, "tutorials": [], "verdicts": { "ai-diagram-maker-mcp": "Five compact, typed tools turn text, JSON, ASCII art, images or Mermaid into an editable D2 diagram, and the API documents its error and rate-limit responses. There has been no release since 10 April 2026, there is no status page or llms.txt, and the API key opens the whole account with no scopes.", "kroki": "One unauthenticated POST with diagram text returns an image for 29 diagram types, and version 0.34.0 shipped on 25 October 2026. Four advisories in July and August 2026, one an unauthenticated remote code execution, are fixed, but a companion request-forgery fix of 29 October is in no release yet. No OpenAPI file, terms or status page exist." } }, "kind": "anchor.page", "links": { "api": "https://www.anchorterminal.com/api/v1/index.json", "html": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-kroki", "json": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-kroki.json", "llms": "https://www.anchorterminal.com/llms.txt", "markdown": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-kroki.md", "mcp": "https://www.anchorterminal.com/mcp", "slim": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-kroki.min.md" }, "markdown": "Kroki scores 52.9 (D) on agent readiness against AI Diagram Maker MCP's 43.8 (E), and leads in 6 of 7 scored categories. AI Diagram Maker MCP leads on schema \u0026 documentation. Both do diagram creation.\n\n- AI Diagram Maker MCP: grade E, 43.8/100, rank #1225 of 1486. Markdown https://www.anchorterminal.com/tools/ai-diagram-maker-mcp.md · JSON https://www.anchorterminal.com/api/v1/tools/ai-diagram-maker-mcp.json\n- Kroki: grade D, 52.9/100, rank #966 of 1486. Markdown https://www.anchorterminal.com/tools/kroki.md · JSON https://www.anchorterminal.com/api/v1/tools/kroki.json\n- Best diagramming APIs and diagram-as-code for AI agents: https://www.anchorterminal.com/best/diagramming/index.md\n- All 147 diagrams comparisons: https://www.anchorterminal.com/compare/diagramming/index.md\n\n## Which one, for what\n\n### AI Diagram Maker MCP (E)\n\nGood for: Quick architecture, sequence, ERD and flowchart diagrams from a coding agent, with a link to edit them.\n\nAhead on:\n- Schema \u0026 documentation, 75 against 48\n\nAlso in its favour:\n- A hosted endpoint, with nothing to install\n- Runs on your own machine\n- No incidents deducted, where Kroki loses 10 points for them\n\nWatch for: Last release 3.0.8 on 10 April 2026, and the registry entry still says 1.0.0\n\n### Kroki (D)\n\nGood for: Agents that write diagrams in several text formats and want one render endpoint, on a private network or through the public instance for non-sensitive diagrams.\n\nAhead on:\n- Reliability, 64 against 30\n- Security \u0026 auth, 56 against 45\n- Payments \u0026 pricing, 60 against 20\n- Maintenance \u0026 community, 86 against 17\n- Transparency \u0026 trust, 70 against 35\n\nAlso in its favour:\n- No key needed to call it\n- Open source\n\nWatch for: GHSA-wmpp-fj9c-w766 (CVSS 9.8) allowed unauthenticated remote code execution on `/tikz/svg` in versions 0.21.0 up to 0.32.0, whatever the safe mode. Fixed 3 August 2026\n\n\n## Why the edge\n\n### Maintenance \u0026 community: Kroki +69\n\n- AI Diagram Maker MCP (17): Last release v3.0.8, published to npm on 10 April 2026, 210 days before this check (0). No release since 8 August (0). Four issues in all. The two open ones, from 4 May (hosted MCP credit usage) and 13 October 2026, show no reply, and one closed issue had a comment (5 of 25). In the official MCP registry under the GitHub-verified namespace io.github.erajasekar, but the entry is 1.0.0 from 19 March 2026 while npm is on 3.0.8 (10 of 15). The only workflow publishes to the registry. No tests or CI, and the MCP SDK floor is ^1.9.0 (2 of 10). 0 + 0 + 5 + 10 + 2 = 17.\n- Kroki (86): Version 0.34.0 on 25 October 2026, 10 days before the check (30). Three versions in the 90 days from 6 August, 0.32.1 on 12 August, 0.33.0 on 5 October and 0.34.0 on 25 October, each with code changes (20). Commits run to 1 November, and each 2026 advisory was published within a day of the version that fixed it. Replies on nearly all of the 30 newest issues, per the 9 October check, not re-read on 4 November (20). No official SDKs, and the CLI has had no release since December 2022 (7). Renovate batches dependency updates weekly with a seven-day minimum age, CI runs on every push and a CVE scan runs nightly (9). 30 + 20 + 20 + 7 + 9 = 86.\n\n### Payments \u0026 pricing: Kroki +40\n\n- AI Diagram Maker MCP (20): No x402, MPP or L402 (0). Plan prices are public (Plus $10, Max $20 a month), with credits counted at 1,000 tokens each, so there's no per-diagram price (10 of 20). Basic is free forever with 50 credits a month, but the page doesn't say whether a card is needed or whether API and MCP calls are included (10 of 20, half as with an unstated card rule). A person signs up in the app and creates the key (0). 0 + 10 + 10 + 0 = 20.\n- Kroki (60): Read with the self-hosted rule. Free software with nothing to buy and no payment protocol (0). No price to publish (20). No card or trial needed (20). An agent can pull the Docker image, or call the public instance, with no signup (20).\n\n### Transparency \u0026 trust: Kroki +35\n\n- AI Diagram Maker MCP (35): The MCP server is MIT (package.json and LICENSE, added 18 March 2026). The service is closed, under terms last updated 24 September 2025 that name the operator only as AI Diagram Maker (20 of 30). The privacy policy of the same date keeps diagrams, revisions and chat prompts and responses 'as long as necessary', and the terms license user input 'to provide and improve our services', with no retention periods and no word on model training or the AI providers used (8 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations named (0). The MCP server's source sends no telemetry of its own. 20 + 8 + 0 + 0 = 28.\n- Kroki (70): MIT licence, with every component in one public repository (30). No terms for the software or the public instance. Since 25 October 2026 kroki.io has a privacy policy for the website and the public instance. It says diagram sources are processed in memory and not stored, POST bodies aren't logged, access logs (with GET URLs and so the encoded source) are kept under 30 days, and it names Cloudflare, Exoscale, Netlify and Carbon Ads, with a contact and the CNIL. It agrees with the docs' statement that the server is stateless. No DPA (22 of 30, 15 on 9 October). `KROKI_PORT` is marked deprecated with the reason and a replacement, and no removal date. Removed behaviour is recorded in the changelog (8). OpenTelemetry tracing is configured by environment variable. The 0.32.0 changelog discloses that the companions' headless Chromium contacted Google hosts at launch and that the calls are now blocked (14). 30 + 22 + 8 + 14 = 74.\n\n### Reliability: Kroki +34\n\n- AI Diagram Maker MCP (30): Hosted lines, because every tool call is generated on the AI Diagram Maker service, through the hosted endpoint or the npx server. No status page found on the site or in the README (0). No readable incident history (5). The only rate-limit number is the example in the OpenAPI 429 schema ('Maximum 100 requests per day exceeded.'), which isn't stated as the limit (5 of 15). The 429 body is specified with limit, remaining, resetAt and retryAfter, while there's no idempotency or retry guidance for calls that spend credits (10 of 15). No SLA found (0). Nothing labels the service or server beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.\n- Kroki (64): Read with the local-software lines, because the listing grades the server an owner runs. The free public instance has no status page, SLA or published limit. Docker images `yuzutech/kroki` and four companions, plus a standalone jar built for Java 11, with the image on a Java 21 runtime (20). The `main.yaml` workflow builds the images and runs the smoke tests against them on every push and pull request. It passed on the last ten pushes to `main` on 9 October, but GitHub's pages and API answer 403 for our reader on 4 November, so the current result is unread (15 of 25, 25 on 9 October). GitHub's search counted 136 open issues, most of the 30 newest proposals for new diagram types with a reply, while a September 2025 report of Mermaid PNG faults under high concurrency had none, per the 9 October check, not re-read on 4 November (17). CHANGELOG.md follows Keep a Changelog and states semantic versioning, and 0.33.0 and 0.34.0 record their changed defaults under Changed (12). Version 0.34.0, with no 1.0 and no statement of stability, and diagrams.net marked experimental (0). 20 + 15 + 17 + 12 + 0 = 64.\n\n### Schema \u0026 documentation: AI Diagram Maker MCP +27\n\n- AI Diagram Maker MCP (75): All five tools have zod input schemas in src/tools, and the repository ships an OpenAPI 3 file for POST /api/v2/diagrams/generate (25). No llms.txt (404) and no docs site for agents beyond the README (0). Each description says what the tool does and when to use it, listing trigger phrases and the diagram types, without saying when another tool fits better (16 of 20). `content` has a minimum length and `diagramType` an eight-value enum; the OpenAPI adds `inputType` and `format` enums (13 of 15). Examples in the parameter descriptions and README, and the OpenAPI documents 400, 401, 402, 422 (D2 failed to compile) and 429 with typed error bodies (13 of 15). Git tags from v1.1.1 to v3.0.8 and a /api/v2 path, with no changelog or release notes (8 of 15). 25 + 0 + 16 + 13 + 13 + 8 = 75.\n- Kroki (48): No OpenAPI file or other machine-readable contract. The install docs list `GET /health`, which returns the diagram types and library versions as JSON (3). No llms.txt on kroki.io (HTTP 404 on 4 November). The docs are AsciiDoc files in the repository (2). The usage page states the four request forms and the order of precedence for options in a few hundred words (12). Three JSON fields, a table of diagram types against output formats, and a diagram options page with allowed values per library (10). Examples for cURL and HTTPie, and encoding samples in ten languages. Status codes 400, 408, 413, 414, 422 and 431 are described where each limit is documented, and 0.34.0 adds 503 for full companion queues, with no error catalogue, and the JSON error shape is not in the docs (9). A public changelog with dated versions. Paths carry no API version apart from a `/v1/health` alias (12). 3 + 2 + 12 + 10 + 9 + 12 = 48.\n\n### Security \u0026 auth: Kroki +11\n\n- AI Diagram Maker MCP (45): Several named API keys per account, shown once and deactivated or deleted in Settings with a confirmation step, sent in a header, never a query string. No scopes, and the user guide says anyone with a key can access the account (20 of 30). The tools only create diagrams and can't change or delete anything in the account, but there's no read-only key (12 of 20). Tools return diagrams built from the caller's own input. Image inputs can be any public URL (10 of 15). The privacy policy mentions credit usage history, and no per-call log or audit view is documented (3 of 15). No security.txt, disclosure policy, bug bounty or certification found (0). 20 + 12 + 10 + 3 + 0 = 45.\n- Kroki (56): No credential exists to leak or scope. The server has no authentication on its convert endpoints and binds all interfaces by default, so access control is the owner's network (18). `KROKI_SAFE_MODE` defaults to `SECURE`, which blocks file and network reads by diagram libraries, the container runs as the non-root user `kroki`, and the registration API is off in `SECURE` mode. Four advisories in 2026 showed ways round `SECURE` (13). The server renders the caller's own text and returns an image, with remote includes off by default (9). Request logs, `GET /metrics` and optional OpenTelemetry tracing (6). `SECURITY.md` asks for private GitHub advisories, four advisories were published with fixes in July and August 2026, a Trivy scan of the public images runs nightly and Renovate runs weekly. No security.txt (HTTP 404), bug bounty or certification (10).\n\n## Score by category\n\n| Category | Weight | AI Diagram Maker MCP | Kroki | Edge |\n| --- | --- | --- | --- | --- |\n| Reliability | 16% (20 this run) | 30 | 64 | Kroki +34 |\n| Performance | 10%, pending | pending | pending | not scored in this run |\n| Schema \u0026 documentation | 13% (16.2 this run) | 75 | 48 | AI Diagram Maker MCP +27 |\n| Agent ergonomics | 13% (16.2 this run) | 66 | 70 | Kroki +4 |\n| Security \u0026 auth | 14% (17.5 this run) | 45 | 56 | Kroki +11 |\n| Payments \u0026 pricing | 10% (12.5 this run) | 20 | 60 | Kroki +40 |\n| Task success | 10%, pending | pending | pending | not scored in this run |\n| Maintenance \u0026 community | 7% (8.8 this run) | 17 | 86 | Kroki +69 |\n| Transparency \u0026 trust | 7% (8.8 this run) | 35 | 70 | Kroki +35 |\n| Negative events | ≤15 | 0 | -10 | |\n| **Total** | | **43.8 · E** | **52.9 · D** | |\n\n## Facts side by side\n\n| Fact | AI Diagram Maker MCP | Kroki |\n| --- | --- | --- |\n| Kind | MCP server | HTTP API |\n| Vendor | AI Diagram Maker (Rajasekar Elango) | Yuzu tech |\n| Hosted endpoint | `https://mcp.aidiagrammaker.com/mcp` | no (local only) |\n| Transports | Streamable HTTP, stdio | HTTP |\n| Auth | API key | None |\n| Pricing | Freemium | Free |\n| x402 | no | no |\n| Licence | MIT for the MCP server. The AI Diagram Maker service it calls is closed, under terms last updated 24 September 2025 | MIT |\n| Tools exposed | 5 | none |\n| Read-only variant documented | no | no |\n| llms.txt | no | no |\n| MCP registry | `io.github.erajasekar/ai-diagram-maker-mcp` | not listed |\n| Last release | 2026-04-10 | 2026-10-25 |\n| Terms last updated | 2025-09-24 | no document linked |\n| Privacy policy last updated | 2025-09-24 | not read yet |\n| Customer content may train models | not found in the text | not read yet |\n| Terms restrict automated access | yes | not read yet |\n| Terms restrict benchmarking | not found in the text | not read yet |\n| Terms or service can change without notice | not found in the text | not read yet |\n| Arbitration or class-action waiver | not found in the text | not read yet |\n| Popularity | 63 npm/wk | 4.4k stars |\n\n## How the scores have moved\n\n### AI Diagram Maker MCP\n\nNo score change since it was listed.\n\n### Kroki\n\n- -6.6 on 4 November 2026 (C to D): security, product, correction\n- +0.3 on 27 October 2026: new evidence\n\n## Verdicts\n\n**AI Diagram Maker MCP.** Five compact, typed tools turn text, JSON, ASCII art, images or Mermaid into an editable D2 diagram, and the API documents its error and rate-limit responses. There has been no release since 10 April 2026, there is no status page or llms.txt, and the API key opens the whole account with no scopes.\n\n**Kroki.** One unauthenticated POST with diagram text returns an image for 29 diagram types, and version 0.34.0 shipped on 25 October 2026. Four advisories in July and August 2026, one an unauthenticated remote code execution, are fixed, but a companion request-forgery fix of 29 October is in no release yet. No OpenAPI file, terms or status page exist.\n\n## Before you call either\n\n### AI Diagram Maker MCP\n\n1. Send the key in the `X-ADM-API-Key` header to https://mcp.aidiagrammaker.com/mcp, never in the URL\n2. Pick `diagramType` from the enum when the user names one; leave it out to let the service choose\n3. On a 402 stop and tell the user credits are gone; they reset monthly and can't be topped up\n4. On a 429 wait for `retryAfter` seconds before the next call\n5. Give the user the returned diagram link so they can edit it, since the tools can't revise an existing diagram\n\n### Kroki\n\n1. Send `POST /\u003ctype\u003e/\u003cformat\u003e` with `Content-Type: text/plain` and the diagram as the body. This avoids the deflate and base64 encoding that GET needs\n2. Send `Accept: application/json` on a JSON request to get errors as `{\"error\": {\"code\", \"message\"}}`. With an SVG Accept header the error arrives as an image\n3. Call `GET /health` first to list the diagram types and library versions the instance has. Mermaid, BPMN, Excalidraw and diagrams.net need companion containers\n4. Run 0.32.1 or later before rendering untrusted text, and keep the diagrams.net, Excalidraw and BPMN companions off untrusted input until a release carries the 29 October request-forgery fix\n5. Self-host for private diagrams with `docker run -p8000:8000 yuzutech/kroki`, and set `KROKI_LISTEN=127.0.0.1:8000` or a network rule, since the server has no authentication\n6. Expect a 503 from 0.34.0 when a companion's queue is full (default 100 waiting, 30 seconds), and retry later\n\n## Questions\n\n### Which is better for AI agents, AI Diagram Maker MCP or Kroki?\n\nKroki scores 52.9 (D) on agent readiness against AI Diagram Maker MCP's 43.8 (E), and leads in 6 of 7 scored categories. AI Diagram Maker MCP leads on schema \u0026 documentation.\n\n### Do AI Diagram Maker MCP and Kroki need an API key?\n\nAI Diagram Maker MCP needs an API key. Kroki needs no key.\n\n### Can an agent call AI Diagram Maker MCP and Kroki without installing anything?\n\nAI Diagram Maker MCP has a hosted endpoint at https://mcp.aidiagrammaker.com/mcp. No hosted endpoint is listed for Kroki.\n\n### Are AI Diagram Maker MCP and Kroki open source?\n\nNo open-source release is listed for AI Diagram Maker MCP. Kroki is open source (MIT).\n\n\n## For agents\n\n- This comparison as JSON: https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-kroki.json, and with the fewest tokens: https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-kroki.min.md\n- Over MCP at https://www.anchorterminal.com/mcp (no key): `compare_tools {\"a\": \"ai-diagram-maker-mcp\", \"b\": \"kroki\"}`. From a terminal: `anchor compare ai-diagram-maker-mcp kroki`\n- Each listing in full: https://www.anchorterminal.com/api/v1/tools/ai-diagram-maker-mcp.json and https://www.anchorterminal.com/api/v1/tools/kroki.json\n\n## Other comparisons with AI Diagram Maker MCP or Kroki\n\n- [AI Diagram Maker MCP vs Cloudviz API](https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-cloudviz.md)\n- [AI Diagram Maker MCP vs D2](https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-d2.md)\n- [AI Diagram Maker MCP vs Diagrams.so API + MCP](https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-diagrams-so.md)\n- [AI Diagram Maker MCP vs draw.io + MCP](https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-drawio.md)\n- [AI Diagram Maker MCP vs Eraser API + MCP](https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-eraser.md)\n- [AI Diagram Maker MCP vs ExcaliClaw](https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-excaliclaw.md)\n- [AI Diagram Maker MCP vs Excalidraw](https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-excalidraw.md)\n- [AI Diagram Maker MCP vs Lucid API + MCP](https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-lucid.md)\n- [AI Diagram Maker MCP vs Mermaid Chart MCP](https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-mermaid-chart.md)\n- [AI Diagram Maker MCP vs Mumble](https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-mumble.md)\n- [AI Diagram Maker MCP vs Mural MCP](https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-mural-mcp.md)\n- [AI Diagram Maker MCP vs PlantUML](https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-plantuml.md)\n- [AI Diagram Maker MCP vs Structurizr + MCP](https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-structurizr.md)\n- [AI Diagram Maker MCP vs tldraw SDK + MCP](https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-tldraw.md)\n- [AI Diagram Maker MCP vs Whimsical MCP](https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-whimsical.md)\n- [Cloudviz API vs Kroki](https://www.anchorterminal.com/compare/cloudviz-vs-kroki.md)\n- [Diagrams.so API + MCP vs Kroki](https://www.anchorterminal.com/compare/diagrams-so-vs-kroki.md)\n- [draw.io + MCP vs Kroki](https://www.anchorterminal.com/compare/drawio-vs-kroki.md)\n- [Eraser API + MCP vs Kroki](https://www.anchorterminal.com/compare/eraser-vs-kroki.md)\n- [ExcaliClaw vs Kroki](https://www.anchorterminal.com/compare/excaliclaw-vs-kroki.md)\n- [Excalidraw vs Kroki](https://www.anchorterminal.com/compare/excalidraw-vs-kroki.md)\n- [Kroki vs Mumble](https://www.anchorterminal.com/compare/kroki-vs-mumble.md)\n- [Kroki vs Mural MCP](https://www.anchorterminal.com/compare/kroki-vs-mural-mcp.md)\n- [Kroki vs Whimsical MCP](https://www.anchorterminal.com/compare/kroki-vs-whimsical.md)\n- [D2 vs Kroki](https://www.anchorterminal.com/compare/d2-vs-kroki.md)\n- [Kroki vs Lucid API + MCP](https://www.anchorterminal.com/compare/kroki-vs-lucid.md)\n- [Kroki vs Mermaid Chart MCP](https://www.anchorterminal.com/compare/kroki-vs-mermaid-chart.md)\n- [Kroki vs PlantUML](https://www.anchorterminal.com/compare/kroki-vs-plantuml.md)\n- [Kroki vs Structurizr + MCP](https://www.anchorterminal.com/compare/kroki-vs-structurizr.md)\n- [Kroki vs tldraw SDK + MCP](https://www.anchorterminal.com/compare/kroki-vs-tldraw.md)\n", "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "attributionRequired": true, "credit": "CC BY 4.0, credit Anchor Terminal and link the page or API address you took it from (https://www.anchorterminal.com/terms/#data)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-11-07", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.7", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run", "terms": "https://www.anchorterminal.com/terms/#data" }, "page": { "breadcrumbs": [ { "name": "Home", "url": "https://www.anchorterminal.com/" }, { "name": "Compare", "url": "https://www.anchorterminal.com/compare/" }, { "name": "AI Diagram Maker MCP vs Kroki", "url": "" } ], "description": "Kroki scores 52.9 (D) to AI Diagram Maker MCP's 43.8 (E) for diagram creation. Prices, MCP, x402, uptime and agent notes side by side.", "facts": [ "AI Diagram Maker MCP E 43.8", "Kroki D 52.9", "scores" ], "h1": "AI Diagram Maker MCP vs Kroki", "image": "https://www.anchorterminal.com/assets/og/default.png", "path": "/compare/ai-diagram-maker-mcp-vs-kroki", "published": "2026-10-01", "section": "tools", "title": "AI Diagram Maker MCP vs Kroki for AI agents in 2026: scores and prices", "toc": null, "updated": "2026-11-07", "url": "https://www.anchorterminal.com/compare/ai-diagram-maker-mcp-vs-kroki" }, "tokens": { "markdown": 5100, "slim": 3030 }, "version": 1 }