
Security News
GitHub to Block pull_request_target Workflows by Default Starting December 2
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.
diagonaldiagrams
Advanced tools
Charts and diagrams for agents: one command checks the spec, draws an SVG, and audits the layout.
diagonaldiagrams is a Python library and MCP server that lets an AI agent draw diagrams and charts as SVG, and check them for overlapping text, arrows through boxes and text that spills, before showing them.
Site: filmed examples, benchmarks and a gallery.

$ diagonaldiagrams mermaid flow.mmd -o flow.svg
{"ok": true, "svg": "flow.svg", ..., "items": 3,
"layout": ["row 1: Start", "row 2: Ready? (decision)", "row 3: Done"]}
When ok is false, each error comes with a fix.
Needs Python 3.11 or newer.
Command line
pip install diagonaldiagrams
MCP (Cursor, Claude Desktop and other MCP apps). Add this to the app's MCP settings; it needs uv. The server is in the official MCP registry as io.github.lucas19919/diagonaldiagrams.
{
"mcpServers": {
"diagonaldiagrams": { "command": "uvx", "args": ["diagonaldiagrams", "mcp"] }
}
}
Claude Desktop can also open the .mcpb file from the latest release.
Claude Code
/plugin marketplace add lucas19919/diagonaldiagrams
/plugin install diagonaldiagrams@diagonaldiagrams
Any other agent: tell it Install diagonaldiagrams from https://github.com/lucas19919/diagonaldiagrams. It follows the install skill, then draws with the drawing skill. The short version for models is llms.txt.
| Command | Input | Draws |
|---|---|---|
mermaid | flowchart, sequenceDiagram, erDiagram | A flow, a sequence, or a schema |
flow, arch, seq, schema | JSON | The same four, from a spec |
iso | JSON | A layer stack in isometric 3D, with links between layers |
bar, line, scatter | CSV | A comparison, a trend, a relationship |
geo | CSV or GeoJSON | Places on a built-in coastline |
chart <type> | CSV or JSON | About 60 more |
describe <type> prints the spec shape for any figure type.--fit column sizes a figure for a README or docs page. slide is the default, and page is for print.story turns one figure into several views in one page, and --gif films it when ffmpeg is installed.apply edits a spec with a JSON patch, and export writes PNG, PDF, draw.io or Excalidraw files.Measured on 2026-10-19 against Mermaid CLI and Pele, on version 0.8.0, with the same four flowcharts of 5 to 40 steps.
The full tables, the method and the scripts to rerun them are in bench/.
python -m unittest discover tests/unit # unit tests
python tests_smoke.py # the command-line contract
python scripts/golden.py # the reference figures, byte for byte
How the engine is put together: docs/ARCHITECTURE.md. How releases are made: PUBLISHING.md.
MIT. See LICENSE.
FAQs
Charts and diagrams for agents: one command checks the spec, draws an SVG, and audits the layout.
We found that diagonaldiagrams demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
GitHub is tightening GitHub Actions security with new restrictions on privileged pull request workflows. Here's what changes and how maintainers are affected.

Security News
/Application Security
A practical guide to securing GitHub Actions against supply chain attacks, covering malicious pull requests, credential theft, dependency risks, and release pipelines.

Security News
Composer 2.11 adds dependency cooldowns, joining package managers that delay new releases to reduce supply chain risks while allowing urgent security updates.