Cloudviz API vs PlantUML

Cloudviz API

Diagrams come from the live AWS account through a read-only cross-account role with a per-customer external ID. AWS only, and API access starts at the $49 a month Team plan.

PlantUML

One Java command reads diagram text from stdin and writes PNG, SVG, PDF or ASCII with no account, and CI passed on the last eight pushes. The default security profile lets diagram text read any local file and fetch any URL, and the documentation still lists chronology diagrams that release 1.2026.2 switched off.

Cloudviz API

1. Call GET /aws/accounts/ first to get the Cloudviz account ID, then request /aws/accounts/{account-id}/{region}/{format}
2. On a 202, wait and repeat the same GET until the diagram is ready
3. Ask for jsonSnapshot or jsonDiagram (there is no plain json format) when the agent has to reason over resources
4. Use a read-only key unless the agent has to add, change or delete AWS accounts

PlantUML

1. Set PLANTUML_SECURITY_PROFILE to SANDBOX or ALLOWLIST before rendering text from an untrusted source. The default profile lets !include read local files and fetch URLs
2. Run java -jar plantuml.jar --check-syntax with -stdrpt first and read the exit status. Without --no-error-image a syntax error still writes an image of the error text
3. Pass -pipe with --svg, --txt or --utxt to work without files. --txt output suits a text-only model
4. Start the local server as -picoweb:8080:127.0.0.1. Without the bind address it listens on every interface
5. Use npx -y @plantuml/mcp-js when no Java runtime is present. It renders SVG only, so use the jar for PNG or PDF