AI Diagram Maker MCP vs tldraw SDK + MCP

AI Diagram Maker MCP 17

Last release v3.0.8, published to npm on 10 April 2026, 210 days before this check (0). No release since 8 August (0). Four issues in all. The two open ones, from 4 May (hosted MCP credit usage) and 13 October 2026, show no reply, and one closed issue had a comment (5 of 25). In the official MCP registry under the GitHub-verified namespace io.github.erajasekar, but the entry is 1.0.0 from 19 March 2026 while npm is on 3.0.8 (10 of 15). The only workflow publishes to the registry. No tests or CI, and the MCP SDK floor is ^1.9.0 (2 of 10). 0 + 0 + 5 + 10 + 2 = 17.

tldraw SDK + MCP 89

v5.6.0 tagged on 28 October 2026 (30). At least eleven releases since 5 August, v5.3.0 to v5.3.2, v5.4.0 to v5.4.2, v5.5.0, v5.5.1, v5.5.2, v5.5.4 and v5.6.0 (20). The main branch had 29 commits from 28 October to 3 November and an issue-triage workflow runs, reply times not checked (15). The MCP App is in the official registry as io.github.tldraw/tldraw, active (15). CI checks, a dependency dedupe workflow and a licence report (9).

AI Diagram Maker MCP 30

Hosted lines, because every tool call is generated on the AI Diagram Maker service, through the hosted endpoint or the npx server. No status page found on the site or in the README (0). No readable incident history (5). The only rate-limit number is the example in the OpenAPI 429 schema ('Maximum 100 requests per day exceeded.'), which isn't stated as the limit (5 of 15). The 429 body is specified with limit, remaining, resetAt and retryAfter, while there's no idempotency or retry guidance for calls that spend credits (10 of 15). No SLA found (0). Nothing labels the service or server beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.

tldraw SDK + MCP 70

Scored as an SDK. The tldraw npm package with React runtimes stated in the docs (20). A public checks.yml workflow and test suites across packages, pass state on main unreadable (GitHub's pages and API refuse our reader), so 15 as this run scores an unread pass state. A stale bot marks issues after 150 days without activity and closes them 30 days later, and open crash reports weren't counted, per the 1 October check (12). RELEASES.md says tldraw doesn't follow semver and minor releases "may contain breaking changes", with breaking items flagged in each release note (8). v5 is a stable line (15). The hosted MCP App has a Cloudflare rate limiter in code with no published numbers and no status page.

AI Diagram Maker MCP 35

The MCP server is MIT (package.json and LICENSE, added 18 March 2026). The service is closed, under terms last updated 24 September 2025 that name the operator only as AI Diagram Maker (20 of 30). The privacy policy of the same date keeps diagrams, revisions and chat prompts and responses 'as long as necessary', and the terms license user input 'to provide and improve our services', with no retention periods and no word on model training or the AI providers used (8 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations named (0). The MCP server's source sends no telemetry of its own. 20 + 8 + 0 + 0 = 28.

tldraw SDK + MCP 51

Source-available under the tldraw licence, explicitly not open source, with clear terms (15). The SDK runs in your app. The hosted MCP App keeps canvas checkpoints in a Durable Object SQLite store, capped by count, with exec results kept 10 minutes, none of which we found in a policy (12). RELEASES.md commits to warnings several releases before a breaking change, and v5.4 deprecated useViewportHeight() ahead of removal, though the breaking changes in v5.2.0, v5.3.0 and v5.5.0 came without earlier warnings (12). Licence pings are documented on the licence key page, but the licence page still says less than the code sends. Opting out means a commercial licence (6).

AI Diagram Maker MCP 20

No x402, MPP or L402 (0). Plan prices are public (Plus $10, Max $20 a month), with credits counted at 1,000 tokens each, so there's no per-diagram price (10 of 20). Basic is free forever with 50 credits a month, but the page doesn't say whether a card is needed or whether API and MCP calls are included (10 of 20, half as with an unstated card rule). A person signs up in the app and creates the key (0). 0 + 10 + 10 + 0 = 20.

tldraw SDK + MCP 35

No payment protocol (0). Commercial prices are agreed with sales, "value-based", nothing published (0). Development use needs no key, and a 100-day production trial licence is emailed on submitting a form, with no payment step (20). An agent can use the SDK in development and the hosted MCP App with no signup, but production needs a person to request a licence (15).

AI Diagram Maker MCP 66

Five compact tools (25). Output can be SVG or PNG and the API can return the D2 source with debug, but there's nothing to page or trim, and results carry the rendered image (10 of 20). Typed error bodies with codes, a 422 that returns the failing D2 code, and retryAfter on 429 (16 of 20). No readOnlyHint or other annotations in the source and no idempotency key, and every call spends credits (5 of 20). Only content is required and the hosted endpoint needs no install, but there is no SDK beyond the server (10 of 15). 25 + 10 + 16 + 5 + 10 = 66.

tldraw SDK + MCP 71

Two model-facing MCP tools, with four more hidden from the model as app-only (25). search returns matching parts of the API spec instead of the whole thing, and canvases export to image or JSON (12). exec returns the thrown error text (10). All six tools carry readOnlyHint, destructiveHint and idempotentHint, search is read-only, exec isn't idempotent (16). TypeScript only, and the canvas needs a host that renders MCP Apps (8).

AI Diagram Maker MCP 45

Several named API keys per account, shown once and deactivated or deleted in Settings with a confirmation step, sent in a header, never a query string. No scopes, and the user guide says anyone with a key can access the account (20 of 30). The tools only create diagrams and can't change or delete anything in the account, but there's no read-only key (12 of 20). Tools return diagrams built from the caller's own input. Image inputs can be any public URL (10 of 15). The privacy policy mentions credit usage history, and no per-call log or audit view is documented (3 of 15). No security.txt, disclosure policy, bug bounty or certification found (0). 20 + 12 + 10 + 3 + 0 = 45.

tldraw SDK + MCP 40

No API key. Licence keys are public and checked offline. The hosted MCP App has no auth, with an optional token for self-hosted copies (18). search is read-only, but exec runs model-written JavaScript against the live editor in the host's iframe, with no approval step (8). Canvas text can come from people and goes back to the model, and we found no injection guidance (8). No audit log (0). SECURITY.md takes reports at hello@tldraw.com with a 24-hour response target and, since 2 November 2026, lists 3.x, 4.x and 5.x as supported. No security.txt (404 on 3 November), no bug bounty found, no advisories in OSV (6).