Agentic Mermaid
by adewale · remote · local (npm) · no sign-in to list tools · v0.4.1 · published by GitHub user adewale
Render, verify, describe, and safely edit Mermaid diagrams through MCP.
9 tools: 7 change things and 2 only read.
Scanned Oct 21, 2026
- Deletes or cancels0Claude Code: deny
- Can't be undone0Claude Code: ask
- Changes things7Claude Code: ask: see these tools
- Only reads2Claude Code: allow: see these tools
3 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.
claude mcp add --transport http agentic-mermaid https://agentic-mermaid.dev/mcpFindings
Matches of fixed checks, with the text they matched.
- Warnexecute
The server marks "execute" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "execute" says "execute": a word for a change.
- Warnmutate
The server marks "mutate" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "apply": a word for a change.
- Infoexecute
The description is 14,965 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...type: string; note?: string }[]> opSignatures(family: DiagramKind): string[] }"
Tools
Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.
9 tools
Changes things 7Claude Code: ask
buildAuthor a new Mermaid diagram from blank by folding a list of structured ops over an empty diagram of `family`.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Author a new Mermaid diagram from blank by folding a list of structured ops over an empty diagram of `family`. The declarative counterpart to hand-writing source. Returns the same envelope as `mutate`: { ok, family, source, verify } or { ok:false, family, opIndex, error }. Call `describe_sdk` for the family before authoring unfamiliar ops.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
executeRun JavaScript in an isolated sandbox; return a value.2 findings
Why it is in this group
- The name "execute" says "execute": a word for a change.
- The input takes a statement or command to run (input.code), which can change anything it can reach.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Info
The description is 14,965 characters long, over the 2,000 this check looks for.
What this check looks forMatched text
description ends: "...type: string; note?: string }[]> opSignatures(family: DiagramKind): string[] }"
- Warn
The server marks "execute" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":false,"openWorldHint":false}; The name "execute" says "execute": a word for a change.
Description, as the server wrote it Run JavaScript in an isolated sandbox; return a value. One call composes edits. Submit JavaScript; declaration types are guidance. No promises, async/await, dynamic import, or type annotations. Hosted note: execute runs in an on-demand isolate and costs more than the direct render_svg/render_ascii/render_png/verify/describe tools — prefer those for plain render/verify calls. For straightforward structured edits, prefer the declarative mutate/build tools; reserve execute for logic the ops don't express. Hosted mermaid.renderMermaidSVG*, renderMermaidASCII*, and layoutMermaidWithReceipt calls force security:'strict' and embedFontImport:false; caller code cannot weaken that host policy. SDK declaration: type DiagramKind = 'flowchart' | 'state' | 'sequence' | 'timeline' | 'class' | 'er' | 'journey' | 'architecture' | 'xychart' | 'pie' | 'quadrant' | 'gantt' | 'mindmap' | 'gitgraph' | 'radar' type MutationOp = { kind: string; [field: string]: unknown } type Result<T, E = { code: string; message: string }> = { ok: true; value: T } | { ok: false; error: E } interface SourceLocation { readonly line: number; readonly col: number } interface SourceMapSpans { readonly preserved: PreservedSourceSpans; readonly nodes: ReadonlyMap<string, SourceSpan>; readonly edges: ReadonlyMap<string, SourceSpan>; readonly groups: ReadonlyMap<string, SourceSpan>; readonly labels: ReadonlyMap<string, SourceSpan> } interface SourceMap { readonly nodes: ReadonlyMap<string, SourceLocation>; readonly edges: ReadonlyMap<string, SourceLocation>; readonly groups: ReadonlyMap<string, SourceLocation>; readonly labels: ReadonlyMap<string, SourceLocation>; readonly spans?: SourceMapSpans } interface ValidDiagram { readonly kind: DiagramKind; readonly source: SourceMap } type ExternalFamilyId = `family:${string}` interface ExtensionCompatibility { readonly [contract: string]: string | undefined readonly core?: string readonly scene?: string } interface ExtensionProvenance { readonly owner: string; readonly source: string; readonly reference?: string } interface ExtensionIdentity<Kind extends string = string> { readonly id: `${Kind}:${string}` readonly kind: Kind readonly version: string readonly compatibility: ExtensionCompatibility readonly provenance: ExtensionProvenance } interface SourceSpanPoint { readonly offset: number; readonly line: number; readonly col: number } interface SourceSpan { readonly start: SourceSpanPoint; readonly end: SourceSpanPoint } interface PreservedSourceSpans { readonly source: SourceSpan readonly wrapper?: SourceSpan readonly frontmatter?: SourceSpan readonly initDirectives?: readonly SourceSpan[] readonly accessibilityDirectives?: readonly SourceSpan[] readonly header: SourceSpan readonly body: SourceSpan } interface SourcePreservationReceipt { readonly version: 1 readonly classification: 'unsupported' | 'inventory-only' | 'unknown' readonly source: string readonly header: string readonly upstreamFamilyId?: string readonly mermaidVersion: string readonly spans?: PreservedSourceSpans } interface ParseError { readonly code: string readonly message: string readonly line?: number readonly col?: number readonly preservation?: SourcePreservationReceipt readonly help?: string } interface ExtensionValidDiagram { readonly kind: ExternalFamilyId readonly descriptorIdentity: ExtensionIdentity<'family'> readonly source: SourceMap } interface PreservedValidDiagram { readonly kind: ExternalFamilyId readonly source: SourceMap readonly body: { readonly kind: 'preserved' readonly representation: 'opaque' | 'unknown' readonly source: string readonly preservation: SourcePreservationReceipt readonly spans: PreservedSourceSpans readonly diagnostic: { readonly code: 'UNSUPPORTED_FAMILY' | 'UNKNOWN_HEADER' | 'FAMILY_DESCRIPTOR_MISMATCH' readonly message: string readonly help: string } } } type ParsedDiagram = ValidDiagram | ExtensionValidDiagram | PreservedValidDiagram type RenderedRegionKind='node'|'edge'|'label'|'canvas'|'group'|'cluster'|'lane'|'band'|'compartment'|'plot'|'ring' type DiagramActionSecurity='safe'|'unsafe'|'source-only'|'unsupported' interface RenderedRegion { id:string;kind:RenderedRegionKind;elementId?:string;parentId?:string;bounds:{x:number;y:number;w:number;h:number};sourceLine?:number } interface DiagramActionRecord { id?:string;regionId?:string;family:DiagramKind;target:string;action:'href'|'call'|'callback';raw:string;line?:number;href?:string;security:DiagramActionSecurity;executable:false;message?:string } interface RenderedLayout { version: 1; kind: DiagramKind | ExternalFamilyId; bounds: { w: number; h: number }; nodes: unknown[]; edges: unknown[]; groups: unknown[]; regions?: RenderedRegion[]; actions?: DiagramActionRecord[] } interface VerifyResult { ok: boolean; warnings: unknown[]; layout: RenderedLayout } type CheckMermaidSpec = string[] | { include?: string[]; exclude?: string[]; exact?: boolean } interface CheckMermaidResult { ok: boolean; missing: string[]; unexpected: string[]; facts: string[] } type MermaidConfigScalar = string | number | boolean | null type MermaidConfigValue = MermaidConfigScalar | MermaidConfigValue[] | { [key: string]: MermaidConfigValue | undefined } type MermaidRuntimeConfig = { [key: string]: MermaidConfigValue | undefined } interface StyleColors {bg?:string;fg?:string;line?:string;accent?:string;muted?:string;surface?:string;border?:string} type SceneStyleRole="node"|"edge"|"edge-label"|"group"|"group-header"|"label"|"actor"|"lifeline"|"activation"|"message"|"block"|"note"|"class-box"|"member"|"entity"|"attribute"|"relationship"|"cardinality"|"pie-slice"|"legend"|"bar"|"series"|"point"|"axis"|"grid"|"plate"|"section"|"task"|"milestone"|"marker-line"|"rail"|"period"|"event"|"score"|"actor-pill"|"service"|"junction"|"icon"|"title"|"defs"|"prelude"|"chrome" type ExactSceneStyleRole="node"|"edge"|"group"|"group-header"|"label"|"actor"|"relation… [8965 more characters not shown]
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: false
- openWorldHint: false
mutateApply a list of structured edit ops to an existing Mermaid `source` and return the edited diagram.1 finding
Why it is in this group
- The description's first verb is "apply": a word for a change.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Findings
- Warn
The server marks "mutate" read-only (readOnlyHint: true), and its own name, description or input give the class "write".
What this check looks forMatched text
annotations: {"readOnlyHint":true,"destructiveHint":false,"idempotentHint":true,"openWorldHint":false}; The description's first verb is "apply": a word for a change.
Description, as the server wrote it Apply a list of structured edit ops to an existing Mermaid `source` and return the edited diagram. This is the declarative counterpart to `execute`: plain JSON in, plain JSON out, no sandbox. Prefer it for straightforward edits; reserve `execute` for logic the ops don't express. Returns { ok, family, source, verify:{ ok, warnings } } on success, or { ok:false, family, opIndex, error } — where `error` names the offending field and lists the valid ones — when an op is malformed or cannot apply. Ops apply in order and are all-or-nothing: the first failing op stops the batch (its position is `opIndex`) and the input is left untouched. Each op is { "kind": <op>, …fields }. Call `describe_sdk` for the detected family before authoring unfamiliar ops; it returns compact signatures or exact field types, enum values, defaults, and constraints.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
render_asciiRender a Mermaid source string to text.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Render a Mermaid source string to text. Returns { ok, text }. useAscii true → plain ASCII (+,-,|); false/absent → Unicode box drawing (┌,─,│). targetWidth sets a hard terminal display-cell bound; impossible bounds return a typed error.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
render_pngRasterize a Mermaid source string to PNG.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Rasterize a Mermaid source string to PNG. Returns { ok, png_base64 }. Hosted rendering uses resvg-wasm with bundled fonts; bytes may differ from the local napi renderer, so hosted PNG is a convenience surface, not part of the byte-determinism contract. For file/URL artifacts use the local stdio server.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
render_svgRender a Mermaid source string to themeable SVG.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Render a Mermaid source string to themeable SVG. Returns { ok, svg }. Layout is deterministic: identical input produces identical geometry. The hosted boundary forces security:'strict' and embedFontImport:false.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
verifyParse and verify a Mermaid diagram without rendering it.No findings
Why it is in this group
- Nothing in its name or description says what it does, so it is counted as a write.
- The server marks it read-only (readOnlyHint: true), but an annotation never lowers a class.
Description, as the server wrote it Parse and verify a Mermaid diagram without rendering it. Returns { ok, family, summary, warnings, layout: { bounds, nodes, edges } } for valid diagrams and { ok: false, errors } for parse failures. `family` is the detected diagram family and `summary` a one-line description — check them: ok:true only means the diagram is structurally valid, not that it is the kind you intended. Warnings use the layout-rubric codes.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
Only reads 2Claude Code: allow
describeDescribe a Mermaid diagram.No findings
Why it is in this group
- The name "describe" says "describe": a word for reading.
Description, as the server wrote it Describe a Mermaid diagram. format=text returns { ok, text } with one or two summary sentences; format=json returns { ok, tree } with the AX tree; format=facts returns { ok, facts } with deterministic semantic fact lines for machine checking (for example edge A -> B : label, member Duck +quack()).
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
describe_sdkReturn version-matched mutation operations for one diagram family.No findings
Why it is in this group
- The name "describe_sdk" says "describe": a word for reading.
Description, as the server wrote it Return version-matched mutation operations for one diagram family. Use detail=signatures for the compact op menu or detail=fields (default) for exact field types, required flags, enum values, defaults, and constraints. Call this before build, mutate, or execute when the family schema is not already known.
Annotations the server declares
- readOnlyHint: true
- destructiveHint: false
- idempotentHint: true
- openWorldHint: false
This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.
Install
Pinned to version 0.4.1. Values in angle brackets are yours to fill in.
claude mcp add --transport http agentic-mermaid https://agentic-mermaid.dev/mcpRun in a terminal.
Claude Code permissions
Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.
{
"permissions": {
"allow": [
"mcp__agentic-mermaid__describe_sdk",
"mcp__agentic-mermaid__describe"
],
"ask": [
"mcp__agentic-mermaid__execute",
"mcp__agentic-mermaid__render_svg",
"mcp__agentic-mermaid__render_ascii",
"mcp__agentic-mermaid__render_png",
"mcp__agentic-mermaid__verify",
"mcp__agentic-mermaid__mutate",
"mcp__agentic-mermaid__build"
],
"deny": []
}
}Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as agentic-mermaid. Review it before you use it.
