AI Diagram Maker MCP vs Mural MCP

AI Diagram Maker MCP 17

Last release v3.0.8, published to npm on 10 April 2026, 210 days before this check (0). No release since 8 August (0). Four issues in all. The two open ones, from 4 May (hosted MCP credit usage) and 13 October 2026, show no reply, and one closed issue had a comment (5 of 25). In the official MCP registry under the GitHub-verified namespace io.github.erajasekar, but the entry is 1.0.0 from 19 March 2026 while npm is on 3.0.8 (10 of 15). The only workflow publishes to the registry. No tests or CI, and the MCP SDK floor is ^1.9.0 (2 of 10). 0 + 0 + 5 + 10 + 2 = 17.

Mural MCP 75

Registry version 1.0.0 published on 5 October 2026 and an MCP update in the 29 September release notes (30). Three dated MCP entries in 90 days, the public preview and fixes on 8 September, read and write changes on 29 September and the registry release on 5 October (20). Weekly public release notes, support@mural.co routing to a technical specialist and a community site, not tested (10). In the official MCP registry as co.mural/mural under Mural's own domain (15). Closed hosted service with no package or CI to assess (0).

AI Diagram Maker MCP 75

All five tools have zod input schemas in src/tools, and the repository ships an OpenAPI 3 file for POST /api/v2/diagrams/generate (25). No llms.txt (404) and no docs site for agents beyond the README (0). Each description says what the tool does and when to use it, listing trigger phrases and the diagram types, without saying when another tool fits better (16 of 20). content has a minimum length and diagramType an eight-value enum; the OpenAPI adds inputType and format enums (13 of 15). Examples in the parameter descriptions and README, and the OpenAPI documents 400, 401, 402, 422 (D2 failed to compile) and 429 with typed error bodies (13 of 15). Git tags from v1.1.1 to v3.0.8 and a /api/v2 path, with no changelog or release notes (8 of 15). 25 + 0 + 16 + 13 + 13 + 8 = 75.

Mural MCP 30

The tool list needs an OAuth sign-in with a paid Mural account, so we read Mural's help article instead. MCP tools carry JSON Schema inputs by protocol, but Mural publishes no tool reference and the developer docs page linked from the server's sign-in app returns 404 (10). No llms.txt or Markdown docs. The help article renders only through a crawler view of a Salesforce page (0). The help article lists what the server can and can't do, which tells an agent when not to use it, but no per-tool descriptions are public (6). Input types and constraints unread (5). A prompt library and a troubleshooting section, no documented error responses (4). Registry version 1.0.0 and dated weekly release notes that mention MCP, no MCP changelog (5).

AI Diagram Maker MCP 66

Five compact tools (25). Output can be SVG or PNG and the API can return the D2 source with debug, but there's nothing to page or trim, and results carry the rendered image (10 of 20). Typed error bodies with codes, a 422 that returns the failing D2 code, and retryAfter on 429 (16 of 20). No readOnlyHint or other annotations in the source and no idempotency key, and every call spends credits (5 of 20). Only content is required and the hosted endpoint needs no install, but there is no SDK beyond the server (10 of 15). 25 + 10 + 16 + 5 + 10 = 66.

Mural MCP 26

Tool count and definition size unknown, since the list is behind OAuth. Client-side tool allow-lists are the only subsetting Mural mentions (10). The 29 September 2026 update says large-board overviews load faster, with no documented paging or size controls (5). Release notes say write attempts explain when access is limited, and nothing more on errors (5). Edits land in normal undo history, and we couldn't read readOnlyHint or destructiveHint annotations (3). The mural must stay open in a foreground browser tab signed in to the same account, the server works on one mural at a time, and there's no SDK (3).

AI Diagram Maker MCP 35

The MCP server is MIT (package.json and LICENSE, added 18 March 2026). The service is closed, under terms last updated 24 September 2025 that name the operator only as AI Diagram Maker (20 of 30). The privacy policy of the same date keeps diagrams, revisions and chat prompts and responses 'as long as necessary', and the terms license user input 'to provide and improve our services', with no retention periods and no word on model training or the AI providers used (8 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations named (0). The MCP server's source sends no telemetry of its own. 20 + 8 + 0 + 0 = 28.

Mural MCP 63

Closed service with published terms, which the preview disclaimer limits by excluding service levels, support and indemnities (15). The help article says the server stores no mural content, keeps OAuth tokens, registration records and session state in Redis, and that customer content isn't used for training. It also says token keys have no TTL and that revocation and retention still need a documented policy, and the privacy statement's body didn't render for us (18). No deprecation policy. The preview may change or end at any time without notice (0). A public subprocessor list with locations, mostly the US, and US hosting on Microsoft Azure by default with workspace-level data residency on Enterprise (18).

AI Diagram Maker MCP 45

Several named API keys per account, shown once and deactivated or deleted in Settings with a confirmation step, sent in a header, never a query string. No scopes, and the user guide says anyone with a key can access the account (20 of 30). The tools only create diagrams and can't change or delete anything in the account, but there's no read-only key (12 of 20). Tools return diagrams built from the caller's own input. Image inputs can be any public URL (10 of 15). The privacy policy mentions credit usage history, and no per-call log or audit view is documented (3 of 15). No security.txt, disclosure policy, bug bounty or certification found (0). 20 + 12 + 10 + 3 + 0 = 45.

Mural MCP 72

OAuth only, with PKCE (S256), dynamic client registration, a revocation endpoint and scopes murals:read, murals:write, rooms:read and workspaces:read in the server's own metadata. The assistant inherits the user's Mural permissions and there's no service account (28). A read scope exists and view-only murals stay read-only, but enablement is account-wide, and deletes run with no server-side confirmation, relying on the client's approval prompts and undo (12). Mural content and existing comments written by other collaborators come back to the model, and we found no injection guidance (4). MCP actions are recorded in the mural activity log and the audit log as the user's, marked 'with AI'. The audit log is an Enterprise feature (13). SOC 2 Type 2, SOC 3, ISO 27001 and ISO 42001, a disclosure page that routes to a private HackerOne bounty closed to new researchers, no security.txt (15).

AI Diagram Maker MCP 20

No x402, MPP or L402 (0). Plan prices are public (Plus $10, Max $20 a month), with credits counted at 1,000 tokens each, so there's no per-diagram price (10 of 20). Basic is free forever with 50 credits a month, but the page doesn't say whether a card is needed or whether API and MCP calls are included (10 of 20, half as with an unstated card rule). A person signs up in the app and creates the key (0). 0 + 10 + 10 + 0 = 20.

Mural MCP 10

No x402, MPP or L402 (0). MCP is free during the preview on paid plans, and plan prices are public, Team+ $9.99 and Business $17 a member a month billed yearly, nothing per call (10). The Free plan is excluded from MCP, so there's no free route (0). Signup, plan purchase and OAuth consent all need a person (0).