MCP Excalidraw

Findings (18)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/server@2.0.0: 4 known vulnerabilities

  GHSA-46jr-4wx8-v453, GHSA-f897-62hf-6gxq, GHSA-jm63-cq47-j5jp, GHSA-rvq5-wwqv-78pq

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@1.20.6: 1 known vulnerability

  GHSA-27r3-jxmh-p828

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  dompurify@3.1.6: 23 known vulnerabilities

  GHSA-39q2-94rc-95cp, GHSA-55q2-fjhq-7xh7, GHSA-6688-9rhm-gjv2, GHSA-76mc-f452-cxcm, GHSA-c2j3-45gr-mqc4 +18 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  lodash-es@4.17.21: 2 known vulnerabilities

  GHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  nanoid@3.3.3: 4 known vulnerabilities

  GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-mwcw-c2x4-8c55, GHSA-xwg4-73v4-xw9w

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  nanoid@4.0.2: 4 known vulnerabilities

  GHSA-28wg-ghj8-5hjv, GHSA-2v37-7h3g-55p8, GHSA-mwcw-c2x4-8c55, GHSA-xwg4-73v4-xw9w

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  source-map-js@1.2.1: 1 known vulnerability

  GHSA-68fv-2mgg-jv7q

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  uuid@9.0.1: 1 known vulnerability

  GHSA-w5hq-g745-h8pq

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  vite@6.4.3: 5 known vulnerabilities

  GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@3.25.76: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@4.4.3: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  katex@0.16.47: 1 known vulnerability

  GHSA-238p-pmpm-9mq7

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  mermaid@10.9.4: 7 known vulnerabilities

  GHSA-2v8p-3f2j-5mp7, GHSA-6m6c-36f7-fhxh, GHSA-6x64-9x62-f2gx, GHSA-87f9-hvmw-gh4p, GHSA-c4c3-pg64-4m4v +2 more

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.15.3: 3 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-x5fp-wj9c-mxmx

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity

Tools exposed (26)

• create_element

  Create a new Excalidraw element. For arrows, use startElementId/endElementId to bind to shapes (auto-routes to edges).

• update_element

  Update an existing Excalidraw element

• delete_element

  Delete an Excalidraw element

• query_elements

  Query Excalidraw elements with optional filters

• get_resource

  Get an Excalidraw resource

• group_elements

  Group multiple elements together

• ungroup_elements

  Ungroup a group of elements

• align_elements

  Align elements to a specific position

• distribute_elements

  Distribute elements evenly

• lock_elements

  Lock elements to prevent modification

• unlock_elements

  Unlock elements to allow modification

• create_from_mermaid

  Convert a Mermaid diagram to Excalidraw elements and render them on the canvas

• batch_create_elements

  Create multiple Excalidraw elements at once. For arrows, use startElementId/endElementId to bind arrows to shapes — Excalidraw auto-routes to element edges. Assign custom id to shapes so arrows can reference them.

• get_element

  Get a single Excalidraw element by ID

• clear_canvas

  Clear all elements from the canvas

• export_scene

  Export the current canvas to .excalidraw JSON format. Optionally write to a file; a path ending in .md is written in the Obsidian Excalidraw plugin format (.excalidraw.md).

• import_scene

  Import elements and image files from .excalidraw JSON, Obsidian .excalidraw.md, a PNG with an embedded Excalidraw scene, or raw JSON data

• export_to_image

  Export the current canvas to a PNG or SVG image. Renders headless in the canvas server (no browser tab needed); SVGs embed fonts. Set embedScene: true for a PNG that is also editable in Excalidraw.

• duplicate_elements

  Duplicate elements with a configurable offset

• snapshot_scene

  Save a named snapshot of the current canvas state for later restoration

• restore_snapshot

  Restore the canvas from a previously saved named snapshot

• describe_scene

  Get an AI-readable description of the current canvas: element types, positions, connections, labels, spatial layout, and bounding box. Use this to understand what is on the canvas before making changes.

• get_canvas_screenshot

  Render the current canvas to a PNG and return it as an image. Renders headless in the canvas server (no browser tab needed). Use this to visually verify what the diagram looks like.

• read_diagram_guide

  Returns a comprehensive design guide for creating beautiful Excalidraw diagrams: color palette, sizing rules, layout patterns, arrow binding best practices, diagram templates, and anti-patterns. Call this before creating diagrams to produce professional results.

• export_to_excalidraw_url

  Export the current canvas to a shareable excalidraw.com URL. The diagram is encrypted and uploaded; anyone with the URL can view it. Returns the shareable link.

• set_viewport

  Control the canvas viewport (camera). Auto-fit all elements, zoom-to-fit a subset of elements, center on a specific element, or set zoom/scroll directly. Requires the canvas frontend open in a browser.