Editable draw.io XML is the reason to choose it
Next AI Draw.io asks a language model to create or revise draw.io XML, then opens the result in an embedded editor. The diagram remains a real draw.io document: you can move shapes, fix labels, reconnect arrows, restore an earlier state, and export the file. That makes it more useful than a generated picture when the first answer is only a draft. Image, PDF, and text inputs can supply the material for a new diagram.
The checkout we measured was 4.8 MB, with 306 files and about 40,702 lines of source. Installation expanded it to 1,552 packages and 2,083 MB. That large jump buys a Next.js application, the editor integration, model adapters, desktop packaging, document input, and diagram history. It also changes the maintenance question. The maintenance burden is an application stack around draw.io, far larger than a small XML helper.
Model quality determines whether the editor gets usable XML
The README lists hosted providers such as OpenAI, Anthropic, Gemini, Bedrock, DeepSeek, and Qwen, plus compatible gateways and Ollama. Most require an API key and a model identifier. Administrators can publish several server-side choices through JSON or environment configuration, then use the web panel for access codes, quotas, and feature settings. Saved panel secrets live in data/settings.json, protected by file mode 600 but stored as plaintext.
All 174 Vitest tests passed in our sandbox, but that result does not rate a model's diagrams. The project itself says this job needs a model that can produce long output under strict XML rules. Open issue 943 describes failures with Ollama routing, forced XML behavior, and parsing tolerance. The practical trial is your own prompt set: architecture diagrams, longer revisions, and malformed model output should be checked before a team standardizes on one provider.
The MCP server brings editable diagrams into Claude Code
The MCP package connects Claude Code, Claude Desktop, Cursor, VS Code, and other clients to a browser preview. Its 10 documented tools cover starting a session, creating or loading a diagram, editing cells, reading XML, exporting files, and managing pages. The embedded HTTP server uses port 6002 by default and can try ports through 6020 when that one is occupied. The normal draw.io interface still comes from embed.diagrams.net.
The repository also had 6 CI workflow files, a Dockerfile, a Compose file, and a tests directory in our measured checkout. Those are good signs for contributors. The MCP route deserves separate threat modeling because it starts a local HTTP service and accepts diagram state from an agent. A private setup can point DRAWIO_BASE_URL at a self-hosted draw.io instance, but that changes only the editor source, not the need to review the MCP server itself.
What happened when we ran it
Our sandbox installed commit 027cd88 in 67 seconds on 3 CPUs with 8 GB of RAM. npm added 1,552 packages, and the finished install occupied 2,083 MB. The repository itself contained 306 files, about 40,702 lines of source, and occupied 4.8 MB before that dependency expansion. The install completed without secrets inside an unprivileged Debian container running the lab's Node 22 image.
The production build succeeded in 69 seconds. Vitest then passed all 174 tests in 13 seconds, with 0 failures. npm audit found 51 known vulnerabilities: 2 critical, 27 high, 7 moderate, and 15 low. The sandbox run did not include a model credential, so it provides no generation-quality, latency, or token-cost result. It establishes that install, build, and tests finish at this commit, while the dependency audit remains a release concern.
Two open security reports make public hosting a separate decision
Issue 921 reports that the URL-import endpoint checks hostname strings without resolving DNS before fetching, which can permit an unauthenticated server-side request to an internal address. The report names versions through 0.4.16 and remained open on September 28. Issue 914 reports a stored-XSS path in MCP history through an unauthenticated SVG update and disclosed session identifier. These are reporter-submitted findings, not exploits we reproduced in our sandbox.
The 51 audit findings do not prove that every listed package is reachable from a public request. They still matter beside two reports that describe concrete request paths. A sensible evaluation starts on a trusted workstation, with no inbound public route. Before shared hosting, inspect the affected code, restrict outbound network access, add authentication outside the app, and confirm which advisories apply to the deployed build. Passing 174 tests shows regression coverage. It does not certify security.
A September 27 push shows activity beyond the May release
GitHub recorded 36,064 stars, 193 open issues and pull requests combined, and a last push on September 27, 2026. The latest tagged release, v0.4.16, shipped on May 21 with desktop builds, dependency updates, and fixes for the Electron window, Kimi reasoning messages, access-code refresh, and the model sidebar. Open issues were still receiving updates in September, including reports about Ollama, image generation, and connector quality.
The dates show an active project even though the newest release tag is 4 months old. Our 67-second install, 69-second build, and 13-second test run also show that commit 027cd88 is workable for contributors. The decision turns on where you run it. For a developer who wants editable diagrams from Claude Code, the workflow is distinctive enough to justify a local trial. For a public service, 51 advisories and two open security reports are reasons to wait or add serious containment.