Is draw.io MCP safe? Security scan and tools

What we checked

We read every description in its 3 tools, from the live server, and the listing for 1.4.1. 6 checks, no findings.

Hidden instructionsNothing tells the agent to override its rules or keep things from you.
Passed
Invisible textNo invisible or direction-flipping characters.
Passed
Access to credentialsNo reaching for SSH keys, cloud credentials, wallets or the keychain.
Passed
Downloads and runs codeNo piping downloads into a shell or running encoded payloads.
Passed
Sends data outNo uploads of credential files or catch-all collection endpoints.
Passed
Leaked secretsNo API keys, tokens or private keys published by mistake.
Passed

Pinned tool set3

None change data · none can delete. Each tool is fingerprinted; every rescan compares against these hashes. Dashed access is read from the name.

Tool	Access	Description	Pinned hash
create_diagram	read	Create Diagram · Creates and displays an interactive draw.io diagram from Mermaid.js syntax or draw.io XML — provide exactly one.	sha256:9ae9…abac
get_drawio_reference	read	Get draw.io Reference · Returns the draw.io diagram generation reference as Markdown. Format "xml": styles, the layout grid, edges, containers, swimlanes, layers, tags, metadata, dark mode, the layout and routing passes, and the well-formedness rules for create_diagram's xml. Format "mermaid": the header keyword and syntax hints for every Mermaid type draw.io supports, flowchart styling and the ELK layout. Call it once per format and conversation, before the first diagram in that format; the reference stays valid for the rest of the conversation.	sha256:2743…9747
search_shapes	read	Search Shapes · Search the draw.io shape library by keywords. Returns matching shapes with their exact style strings, dimensions, and titles. Covers ~10,000 built-in stencils (cloud architecture, network topology, P&ID, electrical, Cisco, Kubernetes, BPMN) and, when those are sparse, supplements results with the draw.io icon service (brand/product logos and general-purpose concept icons, e.g. 'react', 'slack', 'shopping cart', 'solar panel'). Use ONLY for diagrams that need industry-specific, branded, or pictorial icons. Do NOT use for standard diagram types like flowcharts, UML, ERD, org charts, or mind maps — these use basic geometric shapes (rectangles, diamonds, circles, cylinders) that are already covered in the XML reference. Also skip if the user asks to use basic/simple shapes or says not to search. The style string from the results can be used directly in mxCell style attributes.	sha256:622c…8f7c

Set pinned as sha256:709c…6d07 · still listed 9 h ago

What we checked

Pinned tool set

History

About

Ratings and reviews

draw.io MCP

What we checked

Pinned tool set

History

When a server changes its tools

What we checked

Pinned tool set

History

Browse plugins, skills and use-case recipes by category.

draw.io MCP

What we checked

Pinned tool set3

What we checked

Pinned tool set

History

History

When a server changes its tools

What we checked

Pinned tool set3

History

What we checked

Pinned tool set

History

About

Ratings and reviews

Security of draw.io MCP

What we checked

Pinned tool set

History

When a server changes its tools

What we checked

Pinned tool set

History

Browse plugins, skills and use-case recipes by category.

Security of draw.io MCP

What we checked

Pinned tool set3

What we checked

Pinned tool set

History

History

When a server changes its tools

What we checked

Pinned tool set3

History