Kroki vs Mumble

Kroki

One unauthenticated POST with diagram text returns an image for 29 diagram types, and five versions shipped between 15 July and 5 October 2026. Four advisories were published in July and August 2026, one an unauthenticated remote code execution on /tikz/svg, all fixed. No OpenAPI file exists, and the public instance has no terms, privacy policy or status page.

Mumble

Mumble keeps audio on the Mac and stores each conversation as plain files in ~/Mumble, with canvas JSON that diffs cleanly. There is no API or MCP server an outside agent can call today. The documented mumble-mcp has no public download, package or repository, and the app is reached only through an early-access waitlist.

Kroki

1. Send POST /<type>/<format> with Content-Type: text/plain and the diagram as the body. This avoids the deflate and base64 encoding that GET needs
2. Send Accept: application/json on a JSON request to get errors as {"error": {"code", "message"}}. With an SVG Accept header the error arrives as an image
3. Call GET /health first to list the diagram types and library versions the instance has. Mermaid, BPMN, Excalidraw and diagrams.net need companion containers
4. Run 0.32.1 or later before rendering untrusted text. Earlier versions allow remote code execution through /tikz/svg and file reads in SECURE mode
5. Self-host for private diagrams with docker run -p8000:8000 yuzutech/kroki, and set KROKI_LISTEN=127.0.0.1:8000 or a network rule, since the server has no authentication

Mumble

1. Don't plan to call Mumble from another agent. Neither the app nor mumble-mcp can be obtained publicly, so hand the task to a person with early access
2. Don't configure /path/to/mumble-mcp from the docs. It is a placeholder, and no binary is published
3. If the person already has Mumble, read ~/Mumble/<capture>/ directly, capture.json for the transcript and diagram.canvas for the map
4. Keep canvas keys in schema order and never rename a node id, or the edges that name it are orphaned and the canvas is refused. Use git as the undo
5. Don't write to a capture that is being recorded. The app doesn't merge the two versions