D2 vs PlantUML

D2

A single local command turns text into a diagram in six formats with no account, key or network call, and CI passes on the default branch. The language is at 0.9.0 with no stable release, its company sponsor has shut down, and one maintainer with limited time wrote every commit since July.

PlantUML

One Java command reads diagram text from stdin and writes PNG, SVG, PDF or ASCII with no account, and CI passed on the last eight pushes. The default security profile lets diagram text read any local file and fetch any URL, and the documentation still lists chronology diagrams that release 1.2026.2 switched off.

D2

1. Check the exit status of d2, never the output file. The man page says a partial render can be written when an error occurs
2. Run d2 validate file.d2 before rendering, and d2 fmt to normalise the source
3. Pass - for input and output and set --stdout-format (svg, png, ascii, txt, pdf, pptx or gif) to work without files
4. Use --stdout-format ascii when the reader is a text-only model
5. Pass --bundle=false or review image URLs and imports before rendering D2 text from an untrusted source. Release 0.9.0 fetches remote images when bundling

PlantUML

1. Set PLANTUML_SECURITY_PROFILE to SANDBOX or ALLOWLIST before rendering text from an untrusted source. The default profile lets !include read local files and fetch URLs
2. Run java -jar plantuml.jar --check-syntax with -stdrpt first and read the exit status. Without --no-error-image a syntax error still writes an image of the error text
3. Pass -pipe with --svg, --txt or --utxt to work without files. --txt output suits a text-only model
4. Start the local server as -picoweb:8080:127.0.0.1. Without the bind address it listens on every interface
5. Use npx -y @plantuml/mcp-js when no Java runtime is present. It renders SVG only, so use the jar for PNG or PDF