AI Diagram Maker MCP vs Lucid API + MCP

AI Diagram Maker MCP 30

Hosted lines, because every tool call is generated on the AI Diagram Maker service, through the hosted endpoint or the npx server. No status page found on the site or in the README (0). No readable incident history (5). The only rate-limit number is the example in the OpenAPI 429 schema ('Maximum 100 requests per day exceeded.'), which isn't stated as the limit (5 of 15). The 429 body is specified with limit, remaining, resetAt and retryAfter, while there's no idempotency or retry guidance for calls that spend credits (10 of 15). No SLA found (0). Nothing labels the service or server beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.

Lucid API + MCP 80

Atlassian Statuspage at status.lucid.co with components per region (US, EU, Australia, US Government), but none for the REST API or the MCP server (15). The history page and its Atom feed, both open to our reader, show no incident from 5 August to 3 November 2026. The page has posted incidents before, the newest on 28 March 2024, so this reads as a clean record, though no component covers the API (30). Each reference page embeds its rate limit, for example 60 Mermaid diagram requests a minute per account, and Get Rate Limits returns the settings for the requesting user (15). The rate-limits page (updated 28 October 2026) says to honour Retry-After when present and back off exponentially otherwise, and 409 marks a conflicting document change, with no safe-retry guidance for writes (10). No SLA found (0). The REST API is generally available and the MCP server is at 1.0.0 in the official registry since 15 June 2026 (10). 15+30+15+10+0+10 = 80.

AI Diagram Maker MCP 45

Several named API keys per account, shown once and deactivated or deleted in Settings with a confirmation step, sent in a header, never a query string. No scopes, and the user guide says anyone with a key can access the account (20 of 30). The tools only create diagrams and can't change or delete anything in the account, but there's no read-only key (12 of 20). Tools return diagrams built from the caller's own input. Image inputs can be any public URL (10 of 15). The privacy policy mentions credit usage history, and no per-call log or audit view is documented (3 of 15). No security.txt, disclosure policy, bug bounty or certification found (0). 20 + 12 + 10 + 3 + 0 = 45.

Lucid API + MCP 80

OAuth 2.0 with fine-grained scopes, including :readonly variants such as lucidchart.document.content:readonly, plus API keys limited by grants such as DocumentEdit. The MCP server uses OAuth with dynamic client registration (28). Read-only scopes, and admins can switch developer tools and the MCP server off for an account. Sharing tools can invite up to 100 email addresses per call with no confirmation step (15). Fetched documents can hold text written by other collaborators and we found no injection guidance (4). Get and Query Audit Logs endpoints in the REST API (15). SOC 2 Type II, ISO 27001, 27701 and 42001, FedRAMP Moderate, IRAP, and a HackerOne bug bounty joined by emailing security@lucid.co. No security.txt per the 30 September check (18).

AI Diagram Maker MCP 35

The MCP server is MIT (package.json and LICENSE, added 18 March 2026). The service is closed, under terms last updated 24 September 2025 that name the operator only as AI Diagram Maker (20 of 30). The privacy policy of the same date keeps diagrams, revisions and chat prompts and responses 'as long as necessary', and the terms license user input 'to provide and improve our services', with no retention periods and no word on model training or the AI providers used (8 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations named (0). The MCP server's source sends no telemetry of its own. 20 + 8 + 0 + 0 = 28.

Lucid API + MCP 62

Closed service with published terms (15). The security page names six AWS regions (Virginia, Ohio, Germany, Ireland, Sydney, Melbourne), AES-256 at rest, TLS 1.2 or 1.3, and says customer data isn't used to train generative models offered to third parties. Retention sits in the privacy policy and DPA, which we didn't read (22). The scope docs mark document.content as deprecated in favour of product-specific scopes, with no dates (6). A public subprocessor list is referenced and data regions are named (18).

AI Diagram Maker MCP 17

Last release v3.0.8, published to npm on 10 April 2026, 210 days before this check (0). No release since 8 August (0). Four issues in all. The two open ones, from 4 May (hosted MCP credit usage) and 13 October 2026, show no reply, and one closed issue had a comment (5 of 25). In the official MCP registry under the GitHub-verified namespace io.github.erajasekar, but the entry is 1.0.0 from 19 March 2026 while npm is on 3.0.8 (10 of 15). The only workflow publishes to the registry. No tests or CI, and the MCP SDK floor is ^1.9.0 (2 of 10). 0 + 0 + 5 + 10 + 2 = 17.

Lucid API + MCP 33

No public changelog for the REST API or the MCP server. The newest dated change is the MCP server's 1.0.0 registry entry of 15 June 2026, 141 days before the check (10). No dated release or change in the 90 days from 5 August. Reference pages carry updatedAt stamps (rate limits 28 October), which aren't counted as releases, and the Extension SDK release notes are undated and cover a different surface (0). Support at support@lucid.co and a community forum with developer announcements, not tested (8). In the official MCP registry as app.lucid.mcp/lucid under Lucid's own domain (15). No official REST SDK package to assess (0). 10+0+8+15+0 = 33.

AI Diagram Maker MCP 20

No x402, MPP or L402 (0). Plan prices are public (Plus $10, Max $20 a month), with credits counted at 1,000 tokens each, so there's no per-diagram price (10 of 20). Basic is free forever with 50 credits a month, but the page doesn't say whether a card is needed or whether API and MCP calls are included (10 of 20, half as with an unstated card rule). A person signs up in the app and creates the key (0). 0 + 10 + 10 + 0 = 20.

Lucid API + MCP 25

No x402, MPP or L402 (0). Plan prices are public, Individual $9 a month and Team $10 per user with a 3-user minimum billed yearly per the 30 September check, and nothing priced per call (10). A Free plan exists. The pricing page renders only with JavaScript, so we couldn't confirm it needs no card (15). Signup, developer-tool activation and OAuth consent all need a person (0).