The canvas server has no built-in authentication; keep it bound to localhost unless network access controls are in place., MCP tools can create, update, duplicate, group, delete, clear, import, export, snapshot, and restore diagram content., File import and export should stay inside an approved export directory; review `EXCALIDRAW_EXPORT_DIR` before enabling file workflows., The URL export tool can upload a scene to Excalidraw hosted sharing, so review the scene before sharing., In-memory canvas state can be lost on restart unless diagrams are exported or snapshots are preserved.
Privacy notes
Diagrams may reveal infrastructure topology, unreleased product plans, customer names, credentials accidentally included as labels, or incident context., Screenshots, exported images, Excalidraw JSON files, snapshots, and share URLs may be visible to the MCP client, browser, logs, and model provider., Avoid exposing the local REST/WebSocket canvas API to shared networks without authentication or a trusted network boundary., Treat imported diagrams from untrusted sources as prompt-injection and data-exposure risks before asking a model to summarize them.
Author
yctimlin
Submitted by
oktofeesh1
Claim status
unclaimed
Last verified
2026-06-05
Decision playbook
Review trust signals before you adopt
Signals are present but mixed. Use the checklist below to confirm the source and operational safety for your environment.
Compare context
Selected
0
Current score
63
Baseline
—
Delta
No baseline selected
No major trust-signal divergence detected in the current selection.
Source and provenance checks
Needs review
Confirm ownership and provenance before trusting install instructions.
Source link availableRequired
Open the canonical repository and verify ownership.
Done
Source provenance statusRequired
Marked as source-backed.
Done
Metadata reviewed
No reviewed flag detected in metadata.
Pending
Safety and privacy checks
Complete
Validate risk disclosures before installation or API wiring.
Safety notes presentRequired
Review the listed safety guidance before running commands.
Done
Privacy notes presentRequired
Review data handling notes before connecting accounts or secrets.
Done
Trust level risk gateRequired
Trust level does not block evaluation.
Done
Package and install checks
Needs review
Check package metadata and artifact integrity signals.
Install payload available
Install or copy payload is available for review.
Done
Package verification flag
No package verification flag provided.
Pending
Checksum metadata
No checksum provided for downloaded artifact.
Pending
Compare-driven decision checks
Needs review
Use compare context to validate trade-offs before adoption.
Compare tray has multiple entries
Add at least one more entry to compare trust differences.
5 safety and 4 privacy notes across 7 risk areas. Review closely: credentials & tokens, permissions & scopes, network access, third-party handling.
7 areas
SafetyPermissions & scopesThe canvas server has no built-in authentication; keep it bound to localhost unless network access controls are in place.
SafetyData retentionMCP tools can create, update, duplicate, group, delete, clear, import, export, snapshot, and restore diagram content.
SafetyLocal filesFile import and export should stay inside an approved export directory; review `EXCALIDRAW_EXPORT_DIR` before enabling file workflows.
SafetyNetwork accessThe URL export tool can upload a scene to Excalidraw hosted sharing, so review the scene before sharing.
SafetyGeneralIn-memory canvas state can be lost on restart unless diagrams are exported or snapshots are preserved.
PrivacyCredentials & tokensDiagrams may reveal infrastructure topology, unreleased product plans, customer names, credentials accidentally included as labels, or incident context.
PrivacyThird-party handlingScreenshots, exported images, Excalidraw JSON files, snapshots, and share URLs may be visible to the MCP client, browser, logs, and model provider.
PrivacyNetwork accessAvoid exposing the local REST/WebSocket canvas API to shared networks without authentication or a trusted network boundary.
PrivacyGeneralTreat imported diagrams from untrusted sources as prompt-injection and data-exposure risks before asking a model to summarize them.
Safety notes
The canvas server has no built-in authentication; keep it bound to localhost unless network access controls are in place.
MCP tools can create, update, duplicate, group, delete, clear, import, export, snapshot, and restore diagram content.
File import and export should stay inside an approved export directory; review `EXCALIDRAW_EXPORT_DIR` before enabling file workflows.
The URL export tool can upload a scene to Excalidraw hosted sharing, so review the scene before sharing.
In-memory canvas state can be lost on restart unless diagrams are exported or snapshots are preserved.
Privacy notes
Diagrams may reveal infrastructure topology, unreleased product plans, customer names, credentials accidentally included as labels, or incident context.
Screenshots, exported images, Excalidraw JSON files, snapshots, and share URLs may be visible to the MCP client, browser, logs, and model provider.
Avoid exposing the local REST/WebSocket canvas API to shared networks without authentication or a trusted network boundary.
Treat imported diagrams from untrusted sources as prompt-injection and data-exposure risks before asking a model to summarize them.
Prerequisites
Node.js 18 or newer and npm for local setup, or Docker for the container path.
A running canvas server, started locally with `PORT=3000 npm run canvas` or through the canvas container image.
The MCP server configured with `EXPRESS_SERVER_URL` pointing to the canvas server.
Browser access to the canvas UI when using screenshot, viewport, or image export workflows.
Excalidraw Canvas MCP Server gives Claude-compatible MCP clients programmatic
control over a live Excalidraw canvas. The repository separates the canvas
server from the stdio MCP server: the canvas provides the web UI, REST API, and
WebSocket sync, while the MCP server exposes tools that create, inspect, update,
export, snapshot, and refine scene elements.
The upstream README positions this project as different from the official
Excalidraw MCP: instead of a one-shot prompt-to-diagram generator, it provides
element-level CRUD, scene awareness, screenshots, file import/export, snapshots,
Mermaid conversion, and real-time canvas sync for iterative diagram work.
These sources were reviewed on 2026-06-05. Prefer the live repository,
README, package metadata, server source, skill file, Docker files, and npm
registry metadata for current setup commands, transport behavior, and tool list.
For Docker users, the upstream README documents separate images for the canvas
and MCP server. Start the canvas first, then point the MCP server at the canvas
URL.
Use Cases
Ask Claude to create an architecture diagram on a live Excalidraw canvas.
Iterate on a diagram by describing the scene, taking a screenshot, and fixing layout issues.
Convert an existing Mermaid diagram into Excalidraw and then refine it element by element.
Export .excalidraw JSON or image artifacts after human review.
Snapshot a canvas before trying alternative layouts.
Share a reviewed scene through an Excalidraw URL when hosted sharing is acceptable.
Safety and Privacy
Keep the canvas server local by default. The README notes that binding beyond
localhost requires network-level access controls because the canvas API has no
built-in authentication. Treat the REST and WebSocket canvas surfaces as trusted
local tools, not public endpoints.
Diagram content can include sensitive architecture, roadmap, customer, or
incident details. Review any scene before exporting images, uploading a share
URL, or including screenshots in prompts. Use EXCALIDRAW_EXPORT_DIR to keep
file import/export operations inside an approved directory and avoid importing
untrusted diagrams without review.
Duplicate Check
No yctimlin/mcp_excalidraw, mcp-excalidraw-server, or matching Excalidraw
canvas source URL was found in content/mcp. The README also distinguishes this
project from the official Excalidraw MCP by emphasizing a persistent live canvas
and element-level editing workflow.
Show that Excalidraw Canvas MCP Server is listed on HeyClaude. Paste this Markdown into your README — it renders the badge and links back to this page.
[](https://heyclau.de/entry/mcp/excalidraw-canvas-mcp-server)
How it compares
Excalidraw Canvas MCP Server side by side with 3 alternatives on trust, install, platform support, and disclosed safety notes — all from reviewed registry metadata.
MCP server for controlling Draw.io and diagrams.net diagrams from Claude, including document discovery, page management, layers, shapes, edges, Mermaid import, diagram import/export, and a built-in editor mode.
MCP server that turns an AI coding agent's plan into a local interactive flowchart, approval workflow, execution tracker, branch selector, and plan history before code changes proceed.
✓The canvas server has no built-in authentication; keep it bound to localhost unless network access controls are in place.
MCP tools can create, update, duplicate, group, delete, clear, import, export, snapshot, and restore diagram content.
File import and export should stay inside an approved export directory; review `EXCALIDRAW_EXPORT_DIR` before enabling file workflows.
The URL export tool can upload a scene to Excalidraw hosted sharing, so review the scene before sharing.
In-memory canvas state can be lost on restart unless diagrams are exported or snapshots are preserved.
✓Draw.io MCP Server can create, edit, delete, import, export, rename, copy, and reorganize diagram pages, layers, shapes, edges, labels, metadata, and Mermaid-derived content.
Live operations target connected Draw.io browser tabs or the built-in editor; verify the selected document and page before allowing destructive edits.
The server can run local HTTP and WebSocket endpoints, optionally with TLS or auto-generated self-signed certificates; avoid binding it to untrusted network interfaces.
Browser-extension mode links a browser tab to the MCP server, so only connect tabs containing diagrams that the agent is allowed to inspect or modify.
Export tools can write or return XML, SVG, and PNG files with embedded diagram data; review outputs before sharing them externally.
Use trusted package sources, pin versions for repeatable workflows, and review generated diagrams before committing architectural or security documentation.
✓AntV MCP Server Chart can generate visual outputs from provided data, so review charts before using them in reports, dashboards, or customer-facing material.
Geographic visualization tools may depend on external map services and have regional limitations described by the upstream project.
Disable unsupported or unwanted chart tools with `DISABLED_TOOLS` when an MCP client has compatibility issues or a workflow should expose fewer visualization actions.
Use private rendering infrastructure through `VIS_REQUEST_SERVER` when sensitive datasets should not be sent to the default chart generation service.
✓Overture is an approval and visualization layer; it does not replace code review, tests, access controls, or human judgment.
The server starts a local web UI and WebSocket service for plan review and execution tracking.
Plan approval, pause, rerun, branch selection, and node-status tools affect what the agent is instructed to do next, but they do not sandbox the agent's other tools.
File attachments and node metadata can influence later agent steps, so review attached context and secret fields before approval.
If local UI ports are exposed beyond trusted local clients, plan data and attachments could be visible to unintended users.
Privacy notes
✓Diagrams may reveal infrastructure topology, unreleased product plans, customer names, credentials accidentally included as labels, or incident context.
Screenshots, exported images, Excalidraw JSON files, snapshots, and share URLs may be visible to the MCP client, browser, logs, and model provider.
Avoid exposing the local REST/WebSocket canvas API to shared networks without authentication or a trusted network boundary.
Treat imported diagrams from untrusted sources as prompt-injection and data-exposure risks before asking a model to summarize them.
✓Diagrams can include private architecture, network topology, cloud account names, customer systems, credentials embedded in labels, incident details, internal process maps, or product plans.
The MCP client can receive diagram XML, SVG, PNG exports, page names, layer names, selected-cell data, shape metadata, browser tab document metadata, and imported Mermaid content.
Local editor and browser-extension workflows may leave diagrams, exported files, browser state, TLS material, and logs on disk.
Treat exported SVG or PNG files with embedded XML as source files, because they can contain full editable diagram data beyond the visible image.
Clear temporary files, generated certificates, and MCP logs when they are no longer needed for the diagram workflow.
✓Chart data, labels, prompts, generated images, service identifiers, and rendering requests may contain business metrics, personal data, locations, or customer information.
Default chart rendering can involve AntV-hosted services; review data sensitivity before sending private datasets.
Protect custom rendering endpoints, service identifiers, and any generated record links in client configs, logs, screenshots, and shared prompts.
✓Plans can include workspace paths, task descriptions, risks, expected outputs, user inputs, selected branches, node outputs, and agent execution status.
Overture stores project history in a project `.overture.json` file when possible and falls back to local user-level storage.
Uploaded attachments are saved under local Overture attachment storage and can include code, documents, images, or secrets if the user provides them.
The UI includes file-reading and attachment endpoints for local plan review, so use it only with trusted local clients and approved workspaces.
The marketplace panel can fetch remote MCP marketplace data, so network policy should account for that optional UI feature.
Prerequisites
Node.js 18 or newer and npm for local setup, or Docker for the container path.
A running canvas server, started locally with `PORT=3000 npm run canvas` or through the canvas container image.
The MCP server configured with `EXPRESS_SERVER_URL` pointing to the canvas server.
Browser access to the canvas UI when using screenshot, viewport, or image export workflows.
Node.js 22 or newer for the published npm package.
An MCP client such as Claude Desktop or Claude Code.
A browser for the built-in editor, or the Draw.io MCP browser extension when controlling an existing diagrams.net tab.
Review of which diagrams, browser tabs, pages, and export locations Claude is allowed to modify.
Node.js and npm available to the MCP client runtime.
Structured data or a clear visualization request.
Optional private chart rendering service if default remote rendering is not appropriate for the data.
Optional tool filtering plan for chart types that should not be exposed to a given agent workflow.
Node.js 18 or newer and npx available to the MCP client runtime.
A coding-agent workflow that will call Overture planning tools before making changes.
Review of local browser, file attachment, and plan-history storage behavior before using it with private workspaces.