AI Diagram Maker MCP vs Whimsical MCP

AI Diagram Maker MCP 35

The MCP server is MIT (package.json and LICENSE, added 18 March 2026). The service is closed, under terms last updated 24 September 2025 that name the operator only as AI Diagram Maker (20 of 30). The privacy policy of the same date keeps diagrams, revisions and chat prompts and responses 'as long as necessary', and the terms license user input 'to provide and improve our services', with no retention periods and no word on model training or the AI providers used (8 of 30). No deprecation policy or dated notices (0). No subprocessors or data locations named (0). The MCP server's source sends no telemetry of its own. 20 + 8 + 0 + 0 = 28.

Whimsical MCP 71

The server is closed with published terms, last updated 30 July 2025. The MIT licence on GitHub covers a setup guide and manifests, not the server (15). Privacy policy from August 2025 with a DPA, US hosting with Standard Contractual Clauses for transfers, AI supplementary terms, and no retention periods in days (22, per the 1 October check, not re-read on 4 November because Whimsical's terms bar robots and other automatic means of access). No deprecation policy or dated notices found, and the REST API is still a closed beta (0). A separate subprocessor list, and hosting in the US named (16). 15 + 22 + 0 + 16 = 53.

AI Diagram Maker MCP 30

Hosted lines, because every tool call is generated on the AI Diagram Maker service, through the hosted endpoint or the npx server. No status page found on the site or in the README (0). No readable incident history (5). The only rate-limit number is the example in the OpenAPI 429 schema ('Maximum 100 requests per day exceeded.'), which isn't stated as the limit (5 of 15). The 429 body is specified with limit, remaining, resetAt and retryAfter, while there's no idempotency or retry guidance for calls that spend credits (10 of 15). No SLA found (0). Nothing labels the service or server beta (10). 0 + 5 + 5 + 10 + 0 + 10 = 30.

Whimsical MCP 60

Status page at status.whimsical.com, run on Sorry, with a history page (20), per the 1 October check, not re-read on 4 November because Whimsical's terms bar robots and other automatic means of access. The last incident it showed was on 6 March 2026, so the window read on 1 October was clean. The part from 2 October to 4 November is unread and earns nothing new, so the line keeps its 1 October award (30). Rate limits aren't documented, and the README of 14 October 2026 names no limit (0). No 429 or retry guidance. The README's troubleshooting covers only 401 and expired sessions (0). No SLA found (0). The remote MCP server is generally available, tagged v1.1.0 in Whimsical's repository (10). 20 + 30 + 0 + 0 + 0 + 10 = 60.

AI Diagram Maker MCP 75

All five tools have zod input schemas in src/tools, and the repository ships an OpenAPI 3 file for POST /api/v2/diagrams/generate (25). No llms.txt (404) and no docs site for agents beyond the README (0). Each description says what the tool does and when to use it, listing trigger phrases and the diagram types, without saying when another tool fits better (16 of 20). content has a minimum length and diagramType an eight-value enum; the OpenAPI adds inputType and format enums (13 of 15). Examples in the parameter descriptions and README, and the OpenAPI documents 400, 401, 402, 422 (D2 failed to compile) and 429 with typed error bodies (13 of 15). Git tags from v1.1.1 to v3.0.8 and a /api/v2 path, with no changelog or release notes (8 of 15). 25 + 0 + 16 + 13 + 13 + 8 = 75.

Whimsical MCP 54

The server is closed, so we couldn't read the tool schemas. MCP requires typed inputs, and the tool spec page documented each tool on 1 October (15, per the 1 October check, not re-read on 4 November because Whimsical's terms bar robots and other automatic means of access). No llms.txt. The how_to tool hands the agent Whimsical's syntax docs on demand (5). Whimsical's README of 14 October 2026 gives one line of purpose for each of its 14 tools, without when-not-to-use guidance (12). Input constraints unread (7). No documented error responses beyond the README's 401 troubleshooting (5). Versioning through the registry manifest (server.json 1.0.0 from 26 March 2026, 1.1.0 tagged v1.1.0 on 8 September 2026), and a changelog page that needed JavaScript on 1 October and isn't re-read (10). 15 + 5 + 12 + 7 + 5 + 10 = 54.

AI Diagram Maker MCP 66

Five compact tools (25). Output can be SVG or PNG and the API can return the D2 source with debug, but there's nothing to page or trim, and results carry the rendered image (10 of 20). Typed error bodies with codes, a 422 that returns the failing D2 code, and retryAfter on 429 (16 of 20). No readOnlyHint or other annotations in the source and no idempotency key, and every call spends credits (5 of 20). Only content is required and the hosted endpoint needs no install, but there is no SDK beyond the server (10 of 15). 25 + 10 + 16 + 5 + 10 = 66.

Whimsical MCP 46

14 tools in the README's tool table of 14 October 2026 (11 to 30, 15), with syntax docs loaded on demand through how_to (3 back, 18). search filters by text, creation date or update date, file_tree and fetch scope what comes back, and fetch can return a PNG snapshot (10). Error responses aren't documented (5). Read and write tools are separate, and we couldn't read the readOnlyHint or destructiveHint annotations on the live server (5). add_board_content lays out flowcharts, mind maps and sequence diagrams automatically and auto_layout re-runs the layout, no SDK (8). 18 + 10 + 5 + 5 + 8 = 46.

AI Diagram Maker MCP 17

Last release v3.0.8, published to npm on 10 April 2026, 210 days before this check (0). No release since 8 August (0). Four issues in all. The two open ones, from 4 May (hosted MCP credit usage) and 13 October 2026, show no reply, and one closed issue had a comment (5 of 25). In the official MCP registry under the GitHub-verified namespace io.github.erajasekar, but the entry is 1.0.0 from 19 March 2026 while npm is on 3.0.8 (10 of 15). The only workflow publishes to the registry. No tests or CI, and the MCP SDK floor is ^1.9.0 (2 of 10). 0 + 0 + 5 + 10 + 2 = 17.

Whimsical MCP 31

The newest dated release is the repository's v1.1.0 tag (server.json and plugin manifests 1.1.0) of 8 September 2026, 57 days before 4 November (20). The commits of 14 October rewrite the README, add screenshots and glama.json and change a contact email, with no version, so they don't count. One dated release since 6 August, and the registry's 13 August date for 1.0.0 came from its JSON API and is struck, so the 90-day line stays 0. The changelog page wasn't re-read (terms ban). Support by email, not tested (8). The README says the server is listed in the official MCP Registry as com.whimsical/mcp, and its server.json names that entry, but that is Whimsical's own claim. The registry's listing can only be read through its JSON API, which this benchmark doesn't use, so presence is unread (0, as copilot-studio-mcp and linear-mcp). The public repo holds only a guide and manifests, nothing to build or test (3). 20 + 0 + 8 + 0 + 3 = 31.

AI Diagram Maker MCP 45

Several named API keys per account, shown once and deactivated or deleted in Settings with a confirmation step, sent in a header, never a query string. No scopes, and the user guide says anyone with a key can access the account (20 of 30). The tools only create diagrams and can't change or delete anything in the account, but there's no read-only key (12 of 20). Tools return diagrams built from the caller's own input. Image inputs can be any public URL (10 of 15). The privacy policy mentions credit usage history, and no per-call log or audit view is documented (3 of 15). No security.txt, disclosure policy, bug bounty or certification found (0). 20 + 12 + 10 + 3 + 0 = 45.

Whimsical MCP 58

OAuth 2.1 with PKCE and no API keys, restated in the README of 14 October 2026. Separate read and write scopes per the 30 September check (28). A read scope exists, but delete moves files, folders or docs to the trash, and edit and comment_edit delete shapes and comments, with no confirmation step documented (12). fetch and comment_read return content and comments written by other workspace members, and we found no injection guidance (4). No audit log for MCP calls found (0). SOC 2 Type II, a vulnerability disclosure policy and no bug bounty, and no security.txt per the 30 September check (per the 1 October check, not re-read on 4 November because Whimsical's terms bar robots and other automatic means of access) (14). 28 + 12 + 4 + 0 + 14 = 58.