
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
@vithanco/vgraph-mcp
Advanced tools
Concept Maps, IBIS, Causal Loop Diagrams and Timelines as images. Runs locally via WebAssembly.
The VGraph MCP server, running on your machine.
Same tools and same engine as the hosted server at mcp.vithanco.com — the
difference is where the work happens. The engine is compiled to WebAssembly, so
a diagram is laid out and rendered locally, with no round trip and nothing to
pay for.
npx @vithanco/vgraph-mcp
Claude Code, Claude Desktop, Cursor — anywhere an MCP server is configured by command:
{
"mcpServers": {
"vgraph": { "command": "npx", "args": ["-y", "@vithanco/vgraph-mcp"] }
}
}
The hosted server remains the better fit where there is no shell to run a command in — claude.ai in the browser, ChatGPT connectors — and stays available:
{ "mcpServers": { "vgraph": { "url": "https://mcp.vithanco.com/mcp" } } }
No graph logic. This is a host around the engine, the same way the Obsidian and VS Code plugins are — they put the wasm behind a pane, this one puts it behind a protocol on stdin.
| file | what it does |
|---|---|
src/server.mjs | MCP plumbing: list tools, dispatch, format the quality report |
src/wasm-host.mjs | loads the wasm under WASI |
src/png.mjs | rasterises the SVG |
tools.json | tool definitions, generated from the Swift server |
vendor/ | the engine, its JS glue, and the fonts |
tools.json is not written by hand. scripts/dump-mcp-tools.sh starts the
native vgraph-mcp binary and asks it, over MCP, what tools it offers — so the
VGL documentation the model reads has one source, in Swift, and a tool added
there appears here without anyone editing JavaScript.
From the repository root:
just mcp-node # build the wasm, vendor it with the fonts, refresh tools.json
just mcp-node-run # run it on stdio against the current build
vendor/ is not committed. The wasm is 4.1MB, and a copy in git is a copy that
can disagree with the engine it was built from.
The wasm writes to stderr. It logs layout DEBUG lines to WASI stdout, and
under a stdio MCP server stdout carries JSON-RPC. wasm-host.mjs routes both
wasm fds to stderr; the noise is expected.
Fonts are bundled rather than read from the SVG. The SVG carries an
@import for DM Sans, which browsers honour and rasterisers ignore — and resvg
ignores an embedded @font-face too. See fonts/README.md at the repository
root for why the faces are TTF and why there is one file per weight.
FAQs
Concept Maps, IBIS, Causal Loop Diagrams and Timelines as images. Runs locally via WebAssembly.
The npm package @vithanco/vgraph-mcp receives a total of 114 weekly downloads. As such, @vithanco/vgraph-mcp popularity was classified as not popular.
We found that @vithanco/vgraph-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.