
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
sysdesign-board
Advanced tools
A hand-drawn whiteboard for system design interviews, with an MCP server so Claude or ChatGPT can act as your interviewer: it sees your board, listens, talks and points at your diagram.
A hand-drawn whiteboard for system design mock interviews, plus an MCP server that turns Claude or ChatGPT into your interviewer. It sees your board, listens to you, talks back, pins questions on your components, and ends with scored feedback.

Requires Node.js 18+.
| Your AI app | How to connect | Billed to |
|---|---|---|
| Claude Desktop | Double-click sysdesign-board-x.y.z.mcpb from Releases, or run npx -y sysdesign-board install | Claude Pro / Max |
| Claude Code | claude mcp add sysdesign-board -- npx -y sysdesign-board | Claude Pro / Max |
| Codex CLI | Add it to ~/.codex/config.toml (below) | ChatGPT Plus / Pro |
| ChatGPT (desktop / web) | Developer Mode connector through a tunnel (below) | ChatGPT Plus / Pro |
| Cursor, Windsurf, VS Code, others | The standard MCP JSON (below) | Your plan there |
The .mcpb one-click file is Claude Desktop only. Every other app runs the same npm package.
Option A: one-click. Download the .mcpb file from Releases and double-click it. Claude Desktop shows an install dialog.
Option B: command line. First quit Claude Desktop completely (macOS: ⌘Q; Windows: tray icon → Quit). Claude rewrites its config file from memory when it quits, which would drop the new entry. Then run:
npx -y sysdesign-board install
Reopen Claude Desktop.
Option C: edit the config yourself (again, with Claude Desktop quit). The file is at:
~/Library/Application Support/Claude/claude_desktop_config.json%APPDATA%\Claude\claude_desktop_config.json~/.config/Claude/claude_desktop_config.json{
"mcpServers": {
"sysdesign-board": { "command": "npx", "args": ["-y", "sysdesign-board"] }
}
}
On Windows, use "command": "cmd", "args": ["/c", "npx", "-y", "sysdesign-board"]. If Claude can't find npx (common with nvm, Volta or asdf), use the absolute path from which npx (macOS/Linux) or where npx (Windows).
Either add the server directly:
claude mcp add sysdesign-board -- npx -y sysdesign-board
Or install the plugin, which also adds an interview skill, from this repo's marketplace. Run these inside Claude Code:
/plugin marketplace add tGhattas/sysdesign-board
/plugin install sysdesign-board@sysdesign-board
Add this to ~/.codex/config.toml (Windows: %USERPROFILE%\.codex\config.toml):
[mcp_servers.sysdesign-board]
command = "npx"
args = ["-y", "sysdesign-board"]
tool_timeout_sec = 120
ChatGPT connects to MCP servers over public HTTPS, so you run the board locally and expose only its /mcp endpoint through a tunnel. The board itself, its API and its WebSocket refuse any request that doesn't come from localhost.
npx -y sysdesign-board serve
cloudflared tunnel --url http://localhost:4321
npx -y sysdesign-board token
https://<your-tunnel>.trycloudflare.com/mcp?token=<token> and no authentication.Treat that URL like a password. To change the token, delete ~/.sysdesign-board/token, or set SYSDESIGN_TOKEN yourself.
{ "command": "npx", "args": ["-y", "sysdesign-board"] }
Start a new chat and say:
Start a system design interview with me on my sketch board.
Or use the interview prompt from your app's prompt or slash menu. The board opens at http://localhost:4321.
The board also works without any AI: run npx -y sysdesign-board serve and open http://localhost:4321.
| Tool | What it does |
|---|---|
start_interview | Sets the problem, level and duration, opens the board, and speaks the opening line |
wait_for_candidate | Waits for your speech or messages, or for board changes once you stop drawing |
say | Sends a chat message, read aloud |
get_board | Structured diagram: components, connections (with labels; dashed means async), zones, notes, and what changed |
get_board_image | A PNG of the whole board (for handwriting and sketches) |
annotate / clear_annotations | Pin or remove "INTERVIEWER" comment bubbles on components |
highlight | Makes components glow, optionally zooming to them |
draw_on_board | Adds components, connections, notes and zones in the same sketchy style |
set_phase | Requirements → Estimation → API & Data → High-level → Deep dive → Wrap-up |
end_interview | Feedback card with 1–5 scores, strengths and improvements |
get_transcript, open_board | Housekeeping |
V select · H hand / hold Space · R rect · D diamond · O ellipse · A arrow · L line · P pen · T text · N sticky note · F zone · E eraser · K laser · C components · I interview panel · Q tool lock · G grid snap · ⌘/Ctrl Z undo · ⌘/Ctrl D duplicate · ⇧1 fit · ? all shortcuts
The full policy is in PRIVACY.md. In short:
~/.sysdesign-board/. The author runs no server, and there are no accounts, analytics or telemetry.npx downloads the package from npm./mcp requests pass through the tunnel provider.localhost requests from localhost pages. Other websites and tunnels are refused, which also blocks DNS-rebinding attacks./mcp) always requires the token.~/.sysdesign-board/.npx -y sysdesign-board install, then reopen.npx (see Option C), or run npx -y sysdesign-board install, which writes absolute paths for you.SYSDESIGN_PORT (or --port=5000). In the .mcpb extension it's a setting.sysdesign-board MCP server over stdio (what AI apps launch)
sysdesign-board serve Board + HTTP MCP endpoint only
sysdesign-board install Add to Claude Desktop (quit it first) [--npx | --local]
sysdesign-board token Print the HTTP MCP token / URL
git clone <this repo> && cd sysdesign-board
npm install
npm run dev
npm run dev starts the hub on :4321 with reload, and Vite on :5173. Other scripts:
| Command | What it does |
|---|---|
npm run build | Builds the board UI and bundles the server into one file |
npm run build:mcpb | Packs build/sysdesign-board-<version>.mcpb |
npm run typecheck | Type-checks the web and server code |
node scripts/mcp-smoke.mjs | Drives every MCP tool against a running board |
The code lives in three folders:
web/: the board (React UI plus the canvas engine in web/src/engine.ts; renderer and component glyphs in web/src/render/)server/: the hub (HTTP, WebSocket and persistence), the MCP tools and the CLIshared/: the data model, component catalog and geometryFAQs
A hand-drawn whiteboard for system design interviews, with an MCP server so Claude or ChatGPT can act as your interviewer: it sees your board, listens, talks and points at your diagram.
The npm package sysdesign-board receives a total of 0 weekly downloads. As such, sysdesign-board popularity was classified as not popular.
We found that sysdesign-board demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.