
Security News
vlt 1.5.0 Adds Agent Skills Management
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.
pi-excalidraw
Advanced tools
A pi package that provides a locally hosted Excalidraw canvas plus AI-callable diagramming tools.
pi-excalidraw gives pi a locally hosted Excalidraw canvas plus AI-callable tools for drawing, layout, screenshots, persistence, templates, and mixed-diagram composition.
It is built for a practical local loop: pi starts the Excalidraw runtime, you keep the canvas open in a browser, and the model uses tool calls plus screenshots to create and refine diagrams on that live whiteboard.
[!IMPORTANT]
pi-excalidrawis a local, browser-connected workflow. Canvas interaction, viewport control, screenshot capture, and image export require a connected browser tab or pane. This package does not provide a hosted Excalidraw service or a fully headless drawing runtime.

The published package includes these validated capabilities:
horizontal, vertical, and centered-flow modes.pi/excalidraw-diagrams/.pi/excalidraw-templates/Not shipped yet:
Install the package into the project where you run pi:
npm install pi-excalidraw
Then start pi in that project. If pi is already running, use /reload so it re-discovers installed packages and extensions.
pi install git:github.com/coctostan/pi-excalidraw
pi install /absolute/path/to/pi-excalidraw
>=20pi-excalidraw is installed./excalidraw to start the local Excalidraw runtime.Example requests:
A typical session looks like this:
/excalidrawThe package exposes higher-level tool workflows for:
For project-specific work, save the current scene as a diagram bundle and reload it later:
.pi/excalidraw-diagrams/.pi/excalidraw-templates/This keeps Excalidraw work resumable across sessions without adding remote persistence infrastructure.
This repository uses the repo root as the canonical pi package entrypoint:
src/index.ts # canonical extension entrypoint declared in package.json
.pi/extensions/pi-excalidraw/index.ts # thin local development shim for /reload while working in this repo
vendor/mcp_excalidraw/ # vendored Excalidraw runtime used by the local server workflow
scripts/smoke-test.mjs # package smoke test
assets/readme/ # package/readme graphics
From the repository root:
npm install
npm run check
npm run check runs:
npm run typechecknpm run smoke-testnpm pack --dry-run/reloadIf you are developing inside this repository, you usually do not need to reinstall the package after every edit.
src/index.ts or related files./reload.Why that works:
.pi/extensions/pi-excalidraw/index.ts in this repositorysrc/index.ts/reload refreshes the extension in the current project sessionThe live Excalidraw frontend must be open in a browser for the canvas to exist. Screenshot, viewport, and export workflows depend on that connected client.
The repository vendors the Excalidraw runtime under vendor/mcp_excalidraw/ because the published upstream package did not ship the runnable frontend/runtime assets needed for this extension's local server workflow.
pi-excalidraw is focused on reliable local diagramming workflows for pi. It does not currently try to be a hosted service, a generic docs site, or a Mermaid conversion layer.
https://github.com/coctostan/pi-excalidrawhttps://github.com/coctostan/pi-excalidraw#readmehttps://github.com/coctostan/pi-excalidraw/issuesIf you want to inspect the package before installing, start with src/index.ts, package.json, and the vendored runtime layout under vendor/mcp_excalidraw/.
FAQs
A pi package that provides a locally hosted Excalidraw canvas plus AI-callable diagramming tools.
The npm package pi-excalidraw receives a total of 4 weekly downloads. As such, pi-excalidraw popularity was classified as not popular.
We found that pi-excalidraw demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.

Security News
Rust 1.100 will add opt-in dependency cooldowns to Cargo, giving security scanners and maintainers time to catch malicious crate releases.

Security News
Cloudflare is acquiring Deno’s team, which will provide another year of bug fixes and security updates before ending support for the runtime.