AI diagrams you can keep editing
Most image generators can draw something that resembles an architecture diagram, but the result is pixels with misspelled labels and no useful object model. Next AI Draw.io asks a model to produce and modify draw.io XML. The result opens in the familiar draw.io canvas, where boxes, labels, pages, connectors, and styles remain editable. That makes the output usable after the chat ends.
The web application supports creation from a prompt, replication from an uploaded image, and extraction from PDFs or text files. Chat can revise the current diagram, and history allows rollback to earlier versions. Cloud icon sets, animated connectors, and all six draw.io themes broaden the visual range. Provider support spans OpenAI, Anthropic, Google, Bedrock, Azure, Ollama, OpenRouter, DeepSeek, several Chinese services, and compatible custom endpoints.
An MCP package brings the same idea into Claude Code, Claude Desktop, Cursor, VS Code, and other clients. The agent starts a session, opens a browser preview, creates or edits XML, reads the current diagram, manages pages, and exports draw.io, PNG, or SVG files. Seeing the canvas update while an agent works is far more inspectable than receiving a final attachment.
Quality depends heavily on model behavior
Generating valid draw.io XML is a long, constrained output task. The README recommends current high-capability models, and the FAQ says small self-hosted models often think without drawing or fail tool calls. It recommends 32-billion-parameter or larger local models with automatic tool choice configured. That is honest guidance, but it means “supports Ollama” does not imply that any laptop model will produce a competent diagram.
Issue 888 provides a concrete failure. A user supplied a Mermaid document under 1,000 words to DeepSeek V4 Flash and received nodes without most connectors. Follow-up attempts added only a few overlapping lines, reportedly because output was truncated. The proposed declarative diagram-engine work aims to compute flow layout, swimlanes, sequence diagrams, and mind maps rather than ask a model to hand-place everything. Until such routing is released, complex graphs need human cleanup.
The application also has one current canvas. Issue 882 says a new agent-generated diagram replaces the previous diagram in DiagramContext; history holds rollback snapshots, not simultaneously editable documents. Parallel subagents can therefore overwrite one another's work. The MCP server supports pages within a file, which helps organization, but teams should serialize sessions or use separate processes and ports.
There are several practical ways in
The hosted demo needs no installation and permits a browser-stored personal API key to bypass quotas. Desktop assets cover Intel and Apple Silicon macOS, Windows installers and portable builds, Linux AppImage, deb, and rpm packages. Windows builds are signed; the v0.4.16 release notes say macOS builds are not, so Gatekeeper warnings require a manual override.
Docker operation is a short command with a provider, model, and key. Administrators can expose several server-side models through JSON configuration and protect management settings with ADMIN_PASSWORD. Source development uses npm and serves on port 6002. The main README is clear, and separate guides explain providers, the admin panel, Docker, Cloudflare, and offline operation.
“Offline” needs qualification. Both the application and MCP package load the draw.io interface from embed.diagrams.net by default. A private environment needs a separate draw.io deployment and a configured base URL. In the Next.js app, public URL variables are compiled into client JavaScript, so changing runtime environment variables on an existing image does not work; the image must be rebuilt with the correct argument.
Version 0.4.16 is unsafe to expose
Issue 918 reports that POST /api/parse-url accepts a caller-controlled URL and fetches it server-side. Its private-address test compares hostname strings without resolving DNS. A public hostname such as an sslip.io name can resolve to loopback after passing that check, allowing unauthenticated access to internal HTTP services. The report marks versions through 0.4.16 affected and a patch as pending.
Issue 917 concerns the MCP package through version 0.2.1, bundled with application v0.4.16. It says the embedded HTTP server inserts the mcp query value into raw HTML and a script block without encoding. A crafted localhost link can execute JavaScript in that local origin after a user visits it. Localhost is not a harmless trust boundary when the page holds diagram state and talks to an agent tool server.
Issue 914 reports an unauthenticated history endpoint accepting arbitrary SVG strings, which the history panel later renders with innerHTML. Combined with disclosure of a recent session identifier, the report describes a stored-XSS chain requiring a victim to open a link. A private advisory was accepted, but the public tracker still listed patched versions as pending.
These three reports are specific to different paths and should not be collapsed into a vague warning. The web service can reach internal resources; the MCP browser can reflect script; and stored history can execute supplied SVG. Put v0.4.16 behind a trusted local boundary, avoid shared hosting, do not browse untrusted localhost links, and wait for release artifacts that name the fixes.
Active development, incomplete hardening
The repository was pushed on August 12, 2026. Its 177 open issues and pull requests include same-day dependency updates and current security work, while 34,738 stars indicate a large audience. Release v0.4.16 arrived May 21 with framework security updates, Electron fixes, model compatibility work, and better tests. A later last-push date plus active reports is evidence of health even though a newer release has not shipped.
This project is already valuable for supervised diagram drafting. It understands that editable structure matters, supports many deployment modes, and explains model constraints better than most AI wrappers. The present security boundary is the disqualifier. Keep evaluation isolated, export important files, review every generated diagram, and upgrade only after the advisories identify fixed versions.