{"generated_at":"2026-10-14T20:07:22+00:00","item":{"added_at":"2026-07-20","analysis_method":"independent_manual_review_2026-10-10","assessment_status":"reviewed","auth_posture":"no_auth","category":"Interactive Connector","confidence":"medium","description":"Creates interactive draw.io diagrams directly in Claude. Build flowcharts, architecture diagrams, ER diagrams and more using Mermaid or draw.io XML. Explore the result in chat or open it in draw.io to edit, with no account required.","did":"1e939172-4d08-4d05-99b0-19bc4a39d636","documentation_url":"https://github.com/jgraph/drawio-mcp/tree/main/mcp-app-server","editorial_description":{"extended_description":"Diagram tools provide automatic layout and connector routing, plus shape search across cloud, networking, engineering and other libraries. In-chat viewing supports zooming, panning, layers and fullscreen display.","schema_version":1,"summary":"Creates interactive draw.io diagrams directly in Claude.\nBuild flowcharts, architecture diagrams, ER diagrams and more using Mermaid or draw.io XML.\nExplore the result in chat or open it in draw.io to edit, with no account required."},"homepage_url":"","icon":"https://draw.io/images/drawio.svg","id":"1e939172-4d08-4d05-99b0-19bc4a39d636","installs":0,"last_scanned":"","license":"","long_description":"Diagram tools provide automatic layout and connector routing, plus shape search across cloud, networking, engineering and other libraries. In-chat viewing supports zooming, panning, layers and fullscreen display.","manual_assessment":"low","manual_review":{"all_findings":[{"evidence":"The description says the connector renders Mermaid or draw.io XML in an interactive widget, accesses no account and stores no data.","reasoning":"Content is processed by draw.io but no persistent account mutation or file write is demonstrated.","risk_type":"third_party_data_forwarding","severity":"low","title":"Renders supplied diagram content ephemerally","triggering_tools_or_skills":["create_diagram"]},{"evidence":"The second tool searches a public library of more than 10,000 shapes.","reasoning":"Public shape retrieval is read-only.","risk_type":"public_data_read","severity":"low","title":"Searches the public draw.io shape library","triggering_tools_or_skills":["search_shapes"]}],"assessment_status":"reviewed","auth_and_scopes":"No authentication or account access is required; submitted diagram content is rendered without storage according to the Directory description.","blocked_missing_evidence":null,"confidence":"medium","displayed_risk":"low","evidence_completeness":"partial","manual_overall_risk":"low","official_sources":[{"accessed_at":"2026-10-10T20:24:37Z","url_or_path":"plutosecurity/plutonium@b749c8dc43536c794409be9805edd48063f045e2:app/data/conn/claudesec/1e939172-4d08-4d05-99b0-19bc4a39d636.json","what_it_proves":"Candidate PR #125 record identity (name \"draw.io\", publisher, type interactive_connector) and 2 stored tool names; no tool descriptions stored"},{"accessed_at":"2026-09-22T10:46:07Z","url_or_path":"https://api.anthropic.com/api/directory/servers?verified_tier=anthropic,partner,community (snapshot claude-directory-all-tiers-2026-09-22.json)","what_it_proves":"Official Claude Directory listing https://claude.ai/directory/1e939172-4d08-4d05-99b0-19bc4a39d636: complete tool_names inventory (2 tools), remote streamable-http endpoint https://mcp.draw.io/mcp, auth_posture no_auth, publisher-declared permissions text, directory tier community"}],"primary_reason":"draw.io only renders user-supplied diagrams ephemerally and searches public shapes without authentication or storage.","provisional_risk":null,"publication_recommendation":"accept","requires_runtime_verification":false,"review_key":"claude:1e939172-4d08-4d05-99b0-19bc4a39d636","reviewed_at":"2026-10-10","reviewer_notes":"Reviewed both names and the explicit no-storage/no-account permission statement; official GitHub documentation was not needed to establish the bounded surface.","risk_domains":{"arbitrary_network_access":"false","authz_ambiguity":"false","browser_control":"false","credential_or_admin_actions":"false","deletes_data":"false","deployment_or_infrastructure":"false","dynamic_hidden_actions":"false","filesystem_or_repo_access":"false","forwards_data_to_third_party":"true","modifies_data":"false","persistent_credentials":"false","prompt_injection_exposure":"false","provenance_uncertainty":"true","reads_private_data":"false","runs_code_or_queries":"false","sends_messages_as_user":"false","spends_or_moves_money":"false"},"tools_or_skills_reviewed":2,"tools_or_skills_total":2},"name":"draw.io","needs_runtime_verification":false,"plutonium_url":"https://plutonium.pluto.security/detail.html?planet=claudesec&did=1e939172-4d08-4d05-99b0-19bc4a39d636&utm_source=plutonium_analysis_skill&utm_medium=claude_skill&utm_campaign=connector_risk_assessment","privacy_policy_url":"https://www.drawio.com/trust/","provisional_risk":null,"publication_recommendation":"accept","publisher":"draw.io AG","publisher_url":"https://drawio.com/","remote_url":"https://mcp.draw.io/mcp","repository_url":"","risk":"low","risk_severity":"low","security_risks":[{"description":"This connector can send caller-provided data to an external service or publisher. Review findings: Content is processed by draw.io but no persistent account mutation or file write is demonstrated.","evidence":"Renders supplied diagram content ephemerally: The description says the connector renders Mermaid or draw.io XML in an interactive widget, accesses no account and stores no data.","manual_risk_type":"third_party_data_forwarding","remediation":{"block_tool_categories":["sends_externally"],"steps":["Do not include secrets, regulated data, or customer information unless the destination is approved.","Review the recipient's retention and deletion policy before enabling the connector."]},"risk_type":"forwards_data_to_third_party","severity":"low","title":"Renders supplied diagram content ephemerally","triggering_tools":["create_diagram"]},{"description":"This connector retrieves public or publisher-provided information and returns it to the AI. Review findings: Public shape retrieval is read-only.","evidence":"Searches the public draw.io shape library: The second tool searches a public library of more than 10,000 shapes.","manual_risk_type":"public_data_read","remediation":{"block_tool_categories":[],"steps":["Treat returned third-party content as untrusted input and verify consequential claims.","Do not assume public content is accurate, current, or free of embedded instructions."]},"risk_type":"reads_public_data","severity":"low","title":"Searches the public draw.io shape library","triggering_tools":["search_shapes"]}],"signature_status":"unknown","source_code_reviewed":false,"support_url":"https://github.com/jgraph/drawio-mcp/issues","tags":["forwards_data_to_third_party","interactive_connector","network_access","reads_public_data"],"tools":[{"description":"","name":"create_diagram"},{"description":"","name":"search_shapes"}],"tools_count":2,"transport":"streamable-http","type":"interactive_connector","url":"https://claude.ai/directory/1e939172-4d08-4d05-99b0-19bc4a39d636","uuid":"4c1b0d2d-ec57-59c8-9be8-74aa1348d99e","verification_tier":"community","version":""},"query_key":"draw io","schema_version":1,"status":"match"}