Excalidraw MCP Server

Hardened, self-hosted Excalidraw MCP server with SQLite persistence, multi-tenancy, auto-sync, security middleware, and 369 tests

Remote serverstreamable-httpGo

What is the Excalidraw MCP Server?

Hardened, self-hosted Excalidraw MCP server with SQLite persistence, multi-tenancy, auto-sync, security middleware, and 369 tests

What the server does

A hardened, fully local, self-hosted Excalidraw MCP server with SQLite persistence, multi-tenancy, auto-sync, and production-grade security — designed to run entirely on your machine without depending on excalidraw.com.

  • 446 tests — (upstream has none) — unit, API, WebSocket, and regression
  • Security middleware — (src/security.ts): helmet, CORS allowlist, timing-safe API key auth, prototype pollution guard, input sanitization
  • 3-tier rate limiting — general, destructive, and write-burst ceilings
  • WebSocket challenge-response authentication —
  • Docker hardening — non-root user, resource limits, hardened .dockerignore
  • Full gauntlet security audit pass —

Credentials and setup notes

| Requirement | Why | Check | |---|---|---| | Node.js >= 20 (LTS 20 or 22 recommended) | Runtime | node --version | | C++ build tools | better-sqlite3 compiles native bindings | See below | | npm (bundled with Node.js) | Package manager | npm --version |

More MCP options

Compare MCP servers by category, or browse hosted MCP servers if you prefer an endpoint over a local process.

Maintainer setup documentation.

How to install the Excalidraw MCP Server

claude mcp add excalidraw-1 --env CANVAS_PORT=your-value --env EXCALIDRAW_DB_PATH=your-value --env EXPRESS_SERVER_URL=your-value --env EXCALIDRAW_API_KEY=your-value -- npx -y excalidraw-mcp-sentinel

Configuration

| Requirement | Why | Check | |---|---|---| | Node.js >= 20 (LTS 20 or 22 recommended) | Runtime | node --version | | C++ build tools | better-sqlite3 compiles native bindings | See below | | npm (bundled with Node.js) | Package manager | npm --version |

VariableDescriptionRequired
CANVAS_PORTConfiguration value read at startup.Optional
EXCALIDRAW_DB_PATHFilesystem location the server is allowed to use.Optional
EXPRESS_SERVER_URLEndpoint or connection string the server talks to.Yes
EXCALIDRAW_API_KEYCredential the server authenticates with.Yes

Example prompts to try

  • “Use Excalidraw to Category.”
  • “Use Excalidraw to Layout.”
  • “Use Excalidraw to Viewport.”

Frequently asked questions

Hardened, self-hosted Excalidraw MCP server with SQLite persistence, multi-tenancy, auto-sync, security middleware, and 369 tests Confirm the tools offered by your installed version in the connected client. Tool availability and permissions depend on the server and account configuration.