Excalidraw vs Kroki

Excalidraw

Excalidraw+ keys carry read or full permission, route restrictions and an expiry, and the MCP server shows a key only the tools its routes allow. The API and MCP server are in public beta with breaking changes expected, sit behind the $6 Plus plan, and have no published OpenAPI file, SDK or idempotency keys.

Kroki

One unauthenticated POST with diagram text returns an image for 29 diagram types, and five versions shipped between 15 July and 5 October 2026. Four advisories were published in July and August 2026, one an unauthenticated remote code execution on /tikz/svg, all fixed. No OpenAPI file exists, and the public instance has no terms, privacy policy or status page.

Excalidraw

1. Send Authorization: Bearer <API_KEY> to https://api.excalidraw.com/api/v1. For MCP, use POST /api/v1/mcp only. The server is stateless and answers 405 to other methods
2. Use a personal key to reach the owner's private collection with the collection ID private. A workspace admin must enable personal keys first
3. Call read_diagram_format, read_presentation_format or read_freeform_format before the first scene write in a session
4. Write with edit_scene_content and bind arrows through startBinding and endBinding with tempId references. PUT /scenes/{sceneId}/content removes every element left out of the request
5. Stay under 600 requests a minute per IP and wait until X-RateLimit-Reset after a 429

Kroki

1. Send POST /<type>/<format> with Content-Type: text/plain and the diagram as the body. This avoids the deflate and base64 encoding that GET needs
2. Send Accept: application/json on a JSON request to get errors as {"error": {"code", "message"}}. With an SVG Accept header the error arrives as an image
3. Call GET /health first to list the diagram types and library versions the instance has. Mermaid, BPMN, Excalidraw and diagrams.net need companion containers
4. Run 0.32.1 or later before rendering untrusted text. Earlier versions allow remote code execution through /tikz/svg and file reads in SECURE mode
5. Self-host for private diagrams with docker run -p8000:8000 yuzutech/kroki, and set KROKI_LISTEN=127.0.0.1:8000 or a network rule, since the server has no authentication