
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
Your agent draws the architecture. Editable Draw.io and Excalidraw diagrams, generated and edited by coding agents - offline, with 6,000+ bundled icons.
Editable Draw.io and Excalidraw diagrams, generated and edited by your coding agent, on your machine.
Arkitect turns a small JSON spec into a .drawio or .excalidraw source file:
real product icons embedded, every edge connected, laid out so nothing runs
through anything. You keep editing it in Draw.io or Excalidraw. The agent
writes the spec, builds, validates, renders the result and looks at it before
it reports.
Built from a 48-node spec in one command, no hand-editing.
# Claude Code: the plugin, six skills, model-invoked
claude plugin marketplace add mouadja02/arkitect
claude plugin install arkitect@arkitect
# Any other agent, or the CLI alone
npm install -g arkitect
cd ~/my-project && arkitect install --all # adapters for Codex, Cursor, Copilot, ...
# One command, nothing installed
npx arkitect excalidraw icon "postgres"
Then ask:
Draw an architecture for an event-driven order system: a web app posts to an API gateway, orders land on a queue, a worker validates them and writes to Postgres, failures go to a dead-letter queue, and a nightly job reconciles against the warehouse. Save it to
docs/orders.excalidraw.
Every route, and setup per agent: docs/install.md.
validate names every edge through
an icon and every label over a border; the build report hands the agent the
exact node to paste when a box should have been an icon or a boundary.Two constraints outrank every feature: stay functional and lightweight (no
dependencies, no services, no build step) and work with whatever model is
driving, so a small local model gets a good diagram and not only a frontier
one. Context is the scarce resource: each skill's reading budget is measured,
and layout, icon resolution and validation live in scripts, not prompts.
AGENTS.md
has the full statement.
Draw.io .drawio | Excalidraw .excalidraw | |
|---|---|---|
| looks | crisp, formal, vendor icons | hand-drawn |
| for | a client, a review board, an RFC; AWS-heavy designs; several pages; as-is/to-be | system design, component and block diagrams, flows, README art |
| icons | 18 packs, 4,850 marks + built-in mxgraph.aws4.* + fetched logos | 1,162 native items across 36 libraries + 4,850 shared marks as embedded artwork |
| edit in | Draw.io Desktop or VS Code, never the hosted editor | the local container (npm run excalidraw:up) or excalidraw.com |
The Draw.io starter template: every node kind, every connector kind, a generated legend.
| agent | loads | install |
|---|---|---|
| Claude Code | plugin: 6 skills, 5 hooks | claude plugin install arkitect@arkitect |
| Codex | AGENTS.md + .agents/skills/arkitect ($arkitect) | arkitect install codex |
| Cursor | .cursor/rules/arkitect.mdc + /arkitect | arkitect install cursor cursor-command |
| OpenCode | AGENTS.md + .opencode/command/arkitect.md | arkitect install opencode agents |
| GitHub Copilot | .github/copilot-instructions.md | arkitect install copilot |
| Antigravity, Pi | AGENTS.md | arkitect install antigravity / pi |
| Gemini CLI | GEMINI.md | arkitect install gemini |
| anything else | AGENTS.md, or paste it into the tool's rules | arkitect install agents |
| skill | runs |
|---|---|
arkitect-drawio, arkitect-excalidraw | on their own, when a diagram is asked for |
learn-drawio-style, learn-excalidraw-style | only when you type the command |
apply-drawio-style, apply-excalidraw-style | only when you type the command |
| install.md | every install route, npm and npx, setup per agent, update and removal |
| getting-started.md | your first diagram |
| cli.md | every command, the spec format, rendering |
| icons.md | what ships, how search decides, logos, libraries, placeholders |
| apps.md | the local Excalidraw container, Draw.io Desktop, the Draw.io MCP server |
| style.md | the house style, and making it yours |
| privacy.md | exactly what touches the network |
| testing.md | the offline suite, the redaction check, the evals |
| maintenance.md | the contract for changing this repository, releases |
| audit-prompt.md | the prompt that finds the next round of work |
| status.md | how work gets done, and decisions that can look unfinished |
What changed in each release: CHANGELOG.md.
Your diagrams never leave the machine. Two things reach the network, both public and free of anything about your architecture: a product logo you asked for by URL, and the public Excalidraw library catalogue. The Draw.io MCP tools that open the hosted editor are off-limits for your content, and the style record holds structural statistics only, which a test checks on every run. docs/privacy.md.
Issues and pull requests are welcome: patterns, icon coverage, another agent
adapter, a bug in a generator. Start with CONTRIBUTING.md;
the suite is node tests/run-tests.mjs, offline, in about 20 seconds.
Arkitect draws with other people's work: the AWS, Azure and Google Cloud icon sets, Simple Icons, devicon, Lucide and Octicons, and 36 Excalidraw libraries from the public catalogue, each credited in ATTRIBUTION.md and the pack attribution.
MIT for the code, docs and generators. Bundled icon sets remain under their own terms; see NOTICE.
FAQs
Your agent draws the architecture. Editable Draw.io and Excalidraw diagrams, generated and edited by coding agents - offline, with 6,000+ bundled icons.
We found that arkitect demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.