Loading…
Validates and renders Mermaid diagrams through hosted endpoints
Review before connecting
The findings on this server are worth reviewing before you connect an agent to it.
Scanned 1 month ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The Mermaid Server MCP server exposes 25 tools, focused primarily on filesystem capabilities. Its published description reads: "Validates and renders Mermaid diagrams through hosted endpoints". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates Mermaid Server C — the findings are worth reviewing before you connect an agent to it. Its most notable findings include "No authorization on a public remote server" and "Single tool spans filesystem and network". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check Mermaid Server's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add Mermaid Server to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.mermaidchart.com/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
SIMPLE RENDER TOOL - Renders Mermaid diagrams directly (Mermaid automatically validates during rendering). If successful, returns diagram image. If Mermaid validation fails, returns error details for
Generate a descriptive title for a Mermaid diagram based on its content. This tool analyzes the diagram structure and content to suggest an appropriate title.
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: push_file
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
push_file Create or update a single file on a given branch in a GitHub repository. REQUIRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: push_file
A filesystem tool exposes a path parameter that is a free-form string with no pattern/enum/format constraint, so it accepts absolute paths and "../" traversal. A tool that constrains its path (a rooted `pattern` or an `enum`) does not fire.
unconstrained path parameter "path"RecommendationConstrain the path parameter to a rooted allow-list and reject absolute/traversal paths server-side.
Analyze web pages and entire sites for SEO, accessibility, performance, and security compliance. Generate detailed reports and actionable issue lists to improve site quality and user experien
Validates ZUGFeRD, Factur-X, and XRechnung e-invoices against EN 16931 with correction suggestions.
Tracks US tariff and trade-action changes from Federal Register documents and exposes them through an API for AI agents.
Instant rug-check for any EVM or Solana token, distilled to one clear 0-10 risk verdict.
Provides access to Bible translations, books, chapters, verses, and search functionality.
Remote-first MCP adapter for emitting Settlement Attestation Receipts; not a verifier.
Generate a concise summary for a Mermaid diagram based on its content. This tool provides prompts for the LLM to generate a brief summary (2-4 sentences) highlighting the primary flow, key decisions,
Search for available Mermaid icons by provider or name. Returns icons in ready-to-use format with provider prefixes (e.g., 'aws:arch-amazon-ec2'). PERFORMANCE TIP: For faster searches, start with limi
Get comprehensive syntax documentation and examples for a specific Mermaid diagram type. Returns the official Mermaid.js documentation with syntax rules, examples, and usage instructions for the reque
Lists all available MCP servers and their tools in the workspace.
List GitHub repositories for the authenticated user, or for an organization when `org` is set. REQUIRES: `Github-Token` header (HTTP) or `GITHUB_TOKEN` / `GH_TOKEN` in the server environment.
List .mmd Mermaid files in a GitHub repository (code search with tree fallback). REQUIRES: `Github-Token` header (HTTP) or GITHUB_TOKEN / GH_TOKEN.
Read a single .mmd file from a GitHub repository. Only paths ending in .mmd are allowed. REQUIRES: `Github-Token` header (HTTP) or GITHUB_TOKEN / GH_TOKEN.
Create a new branch (git ref), one commit from the base tree with your file changes, then open a pull request in the same repository. REQUIRES: `Github-Token` (HTTP) or GITHUB_TOKEN with `contents: wr
Create or update a single file on a given branch in a GitHub repository. REQUIRES: `Github-Token` (HTTP) or GITHUB_TOKEN with contents write access.
List pull requests for a GitHub repository. REQUIRES: `Github-Token` (HTTP) or GITHUB_TOKEN / GH_TOKEN.
List or resolve branch names. **List mode (default):** one `GET /repos/.../branches?per_page=100&page=1` — at most 100 names, A–Z sorted in the response; `has_more` if a full page was returned. **Reso
List issues for a repository (excludes pull requests). REQUIRES: `Github-Token` (HTTP) or GITHUB_TOKEN / GH_TOKEN.
Create an issue in a GitHub repository. REQUIRES: `Github-Token` (HTTP) or GITHUB_TOKEN with issues write if creating issues in private repos.
List comments on an issue by issue number. REQUIRES: `Github-Token` (HTTP) or GITHUB_TOKEN / GH_TOKEN.
Get all pull request comments: both issue/PR thread comments and inline review comments, with a `type` of `issue_thread` or `review` per item. REQUIRES: `Github-Token` (HTTP) or GITHUB_TOKEN / GH_TOKE
Generate a Mermaid flowchart that visualises Jira issue dependency links for a project. Each node shows the ticket key, summary, and status, and is a clickable link to the ticket. Dashed nodes represe
Generate a Mermaid kanban board from Jira issues. Issues are grouped into columns by their current status and ordered by workflow stage (To Do → In Progress → Done). Each card shows the issue summary
Generate a Mermaid flowchart centred on a single Jira ticket. Fetches the ticket's subtasks, parent, issue links, and recent comments in one call. The focal ticket is highlighted in indigo; subtasks a
Generate a Mermaid diagram showing the history of a single Jira ticket using its changelog. Two views are available: - **state**: stateDiagram-v2 showing all status transitions with dates and authors,
Extract all Mermaid code blocks from a Notion page. Returns block ID, diagram code, and optional caption for each block.
Retrieve a single Mermaid diagram block by its block ID. Returns the diagram code and optional caption.
Update the Mermaid source code (and optional caption) of an existing mermaid code block by its block ID.
Append a Mermaid diagram as a code block to a Notion page. The block is added at the end of the page content.