
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
@drawx/mcp-server
Advanced tools
Model Context Protocol server for DrawX — generate draw.io diagrams and architecture designs from natural language, inside Claude, Cursor, and VS Code.
Generate draw.io diagrams and architecture designs from inside Claude, Cursor, or VS Code.
DrawX MCP is a Model Context Protocol server that gives your AI assistant three tools:
generate_diagram — one-shot: natural-language prompt → complete draw.io XML.architect_design — from a brief, produce a High-Level Design diagram (optionally an LLD + design doc).whoami — verify your API key + see remaining quota.Behind the scenes it calls the DrawX public API, so output matches the DrawX web app exactly.
drawx_live_. API access is a paid feature (bundled with the DrawX Pro plan).npm install -g @drawx/mcp-server
Or, if your MCP client supports npx, no install is needed — reference npx @drawx/mcp-server directly.
Edit ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows):
{
"mcpServers": {
"drawx": {
"command": "npx",
"args": ["-y", "@drawx/mcp-server"],
"env": {
"DRAWX_API_KEY": "drawx_live_..."
}
}
}
}
Restart Claude Desktop. In a new chat, ask "Draw me a microservices checkout flow" — Claude will call generate_diagram and show the resulting XML.
Edit ~/.cursor/mcp.json:
{
"mcpServers": {
"drawx": {
"command": "npx",
"args": ["-y", "@drawx/mcp-server"],
"env": { "DRAWX_API_KEY": "drawx_live_..." }
}
}
}
Add to your workspace or user settings.json:
{
"mcp": {
"servers": {
"drawx": {
"command": "npx",
"args": ["-y", "@drawx/mcp-server"],
"env": { "DRAWX_API_KEY": "drawx_live_..." }
}
}
}
}
| Variable | Required | Purpose |
|---|---|---|
DRAWX_API_KEY | yes | Your DrawX API key (drawx_live_...). |
DRAWX_API_BASE | no | Override the API base URL (default https://getdrawx.com/api/v1). Useful for staging. |
generate_diagramTurn a description into draw.io XML.
Inputs
prompt (string, required) — what to draw.mode — "flash" (default), "pro", or "ultra". Trades speed for quality.previousXml — an existing mxfile to modify.Output — assistant text: a summary line (model, tokens, cost) followed by the full <mxfile>...</mxfile> XML in a fenced code block. Paste the XML into diagrams.net or save as .drawio.
architect_designRun the DrawX Architect Co-Pilot on a brief. Streams intermediate progress; returns a JSON payload with hld (and optional lld, doc).
Inputs
brief (string, required, ≥ 20 chars) — what to design.depth — "hld", "hld_lld" (default), or "hld_lld_doc".style — "cloud_agnostic" (default), "aws", "azure", or "gcp".mode — "flash" (default), "pro", or "ultra".whoamiNo inputs. Returns your email, plan, API tier, and remaining monthly API quota.
API usage is metered on a separate tier from your in-app usage. Pro subscribers get 200 API calls / month. The rate limit is 60 requests / minute. On the free plan, API access is not enabled — upgrade at getdrawx.com.
git clone https://github.com/SaharshPamecha/drawx-mcp-server
cd drawx-mcp-server
npm install
npm run build
DRAWX_API_KEY=drawx_live_... node dist/index.js # runs over stdio; use an MCP inspector
npm test
MIT © 2026 DrawX
FAQs
Model Context Protocol server for DrawX — generate draw.io diagrams and architecture designs from natural language, inside Claude, Cursor, and VS Code.
The npm package @drawx/mcp-server receives a total of 36 weekly downloads. As such, @drawx/mcp-server popularity was classified as not popular.
We found that @drawx/mcp-server demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.