From the maker

Create flowcharts from text or images, edit existing diagrams, save and retrieve diagrams and versions, inspect task receipts, and export editable draw.io XML or JSON with 11 MCP tools. Uses hosted Streamable HTTP with OAuth/PKCE or scoped API keys. Account required; AI generation and editing use your existing allowance or Credits with per-task spending caps. No separate MCP subscription. Saved diagrams open in the FlowchartAI web editor. Application and connection metadata are public and MIT licensed.

How to connect

Streamable HTTP endpoint:

https://flowchartai.org/api/mcp

What happened when we asked

We asked on 15 October 2026 and it challenged us for credentials. That is a working server guarding itself: it answered, and it wants an account we do not hold. A tool count and a response time come from a tools/list we were never served, so this listing carries neither.

How it asks you to sign in

Its refusal named a public document describing how to authenticate, which is what the MCP authorization spec asks a guarded server to publish. We read that document on 15 October 2026. Everything below is what it says; we have still not been inside this server.

It calls itself

FlowchartAI MCP

Sign in through

flowchartai.org

Token accepted in

header

Its own docs

https://flowchartai.org/developers/docs

Read

2026-10-15 07:53 UTC

The 7 permissions it declares

These are the scopes the document lists, verbatim. They describe what an account can grant this server, not what it will do with the grant, and we have not audited either.

• account:read
• diagrams:read
• diagrams:write
• diagrams:generate
• diagrams:export
• tasks:read
• offline_access

Anything above describes one moment on the date shown. We do not re-test on a schedule, so nothing here says what this server is doing now. We have not audited its code, its data handling or its permissions, and this is not a safety rating.