Verified

Excalidraw MCP Server

Excalidraw canvas management allows AI agents to create, view, and refine diagrams.

Data last scanned yesterday · Reviewed 2 months ago

28 2 dangerous tools45 tools★ 2,220TypeScriptMIT

Overview

This server provides AI agents with a live, interactive Excalidraw canvas, enabling them to generate architecture diagrams and flowcharts programmatically. By utilizing 26 distinct MCP tools, agents can see their own work through screenshots, adjust layouts, and save diagrams as .excalidraw files directly within a repository. The tool operates locally using Node.js without requiring API keys, and offers multiple integration paths including a CLI, an MCP server via stdio, and a REST API. It handles complex diagram tasks by allowing the agent to iterate on element placement and content until the output meets specific requirements.

Our verdict

With a security score of 58/100, this server is classified as high risk. The primary security concern is the lack of a read-only mode, meaning every installation provides the agent with full write access to the canvas and potentially connected file systems. Additionally, it is a community-maintained project rather than an official Excalidraw release. Users should be cautious when deploying this in environments where they do not fully trust the connected AI model, as the tool's inherent write capabilities are always active.

Supports multiple interfaces including CLI and REST API
Contains 13 direct dependencies reducing supply-chain surface
Maintains an active repository with 17 contributors
Enables iterative diagram refinement through element updates

No read-only mode available for restricted access
Community-maintained software lacking official vendor support
Authentication method currently unreviewed

Setup

Claude Desktop

{
  "mcpServers": {
    "mcp-excalidraw": {
      "args": [
        "-y",
        "mcp-excalidraw-server"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Tools

Tool	Description	Risk
start	Start the canvas server.	medium
stop	Stop the canvas server.	medium
status	Report current canvas server state.	low
add	Batch-create elements from a JSON array.	medium
apply	Execute a multi-op patch of create, update, or delete operations.	medium
get	Read elements by ID.	low
delete	Remove elements by ID.	medium
update	Update an element.	medium
query	Query elements using types, bounding boxes, or filters.	low
describe	Provide an AI-readable scene summary.	low

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›What are the system requirements for running the Excalidraw MCP server?

The server requires Node.js version 18 or higher.

›Does this MCP server require any external API keys to function?

No, the core drawing functionality runs fully locally and does not require any API keys.

›How does the server handle the canvas process?

The canvas server defaults to http://127.0.0.1:3000 and will automatically start when the CLI or MCP server launches, provided no other instance is listening.

›Is it possible to disable the automatic startup of the canvas server?

Yes, you can opt out of the auto-start behavior by setting the environment variable EXCALIDRAW_NO_AUTOSTART=1.

›Is the Excalidraw content ever uploaded to external servers?

Sharing is optional; if you choose to use the share feature, the tool uploads an encrypted scene to excalidraw.com.