Codex:

codex mcp add stencil -- stencil-mcp

or in ~/.codex/config.toml:

[mcp_servers.stencil]
command = "stencil-mcp"

[mcp_servers.stencil.env]
INFRA_DIAGRAM_OUTPUT_DIR = "/ABSOLUTE/PATH/diagram-exports"

Claude Desktop does not search your shell PATH reliably; use the full path that which stencil-mcp (or where stencil-mcp on Windows) prints as the command in its mcpServers entry. The Desktop setup has not been live-tested.

export_diagram writes only into INFRA_DIAGRAM_OUTPUT_DIR (default ~/infra-diagram-exports). Set it with claude mcp add -e INFRA_DIAGRAM_OUTPUT_DIR=/path .... Point it at a local folder, not a synced or shared one, if your diagrams describe internal systems.

git clone https://github.com/malindarathnayake/stencil-mcp.git
cd stencil-mcp
python -m unittest discover -s tests      # one optional CairoSVG test skips
python scripts/client_config.py           # prints registration commands for this machine

client_config.py prints the stencil-mcp command when the package is installed, and otherwise this machine's interpreter plus the absolute path to server.py. It writes snippets under config/ and never edits your client settings. pip install -e . gives you the stencil-mcp command pointing at the clone.

{
  "version": "1.0",
  "title": "Application request path",
  "width": 1100,
  "height": 430,
  "nodes": [
    {"id": "client",  "kind": "component", "asset": "software/browser",    "x": 45,  "y": 180, "label": "Client"},
    {"id": "gateway", "kind": "component", "asset": "network/api-gateway", "x": 445, "y": 180, "label": "API gateway"},
    {"id": "api",     "kind": "component", "asset": "software/rest-api",   "x": 845, "y": 180, "label": "Application API"}
  ],
  "edges": [
    {"id": "request",  "source": "client",  "target": "gateway", "kind": "data", "label": "HTTPS"},
    {"id": "upstream", "source": "gateway", "target": "api",     "kind": "data", "label": "Forward"}
  ]
}

Node kinds: component (symbol in a labelled card), symbol (bare symbol, optional caption), packet, memory, text, marker. Edge kinds carry meaning: data, control, physical, feedback, dependency, tunnel, replication. Groups draw panels, trust boundaries and swimlanes. Full reference: docs/SCENE_FORMAT.md.

Use the stencil MCP. Draw an Internet-facing app: WAF, API gateway, Kubernetes
services, a database and a separate logging path. Start from kubernetes-ingress,
keep physical links separate from request arrows, label the trust boundaries,
and split into panels rather than shrinking labels.

Use the stencil MCP. Draw our purchase approval as swimlanes: Requester,
Manager, Finance, Vendor. Over $10k goes to the CFO. Copy the conventions in
fin-procurement-approval: questions on decisions, labelled Yes/No branches,
dashed orange for anything sent to the vendor.

Use the MRC loss-recovery template. Keep packets 1-5: arrival order 1, 3, 5, 2;
packet 4 is lost; SACK says "Have 1, 2, 3, 5 - missing 4"; retransmit only 4.
Do not draw the dropped original reaching the receiver.

Many entries are role variants of a shared glyph with a badge (128 base shapes). All symbols are original generic drawings: no vendor logos, fonts or raster images. Search aliases such as Proxmox, Rancher or NVIDIA find the matching generic symbol; they are not compatibility claims. Contact sheets for each collection are in previews/.

python -m diagramkit.cli search invoice
python -m diagramkit.cli templates
python -m diagramkit.cli validate diagramkit/library/templates/support-escalation.json
python -m diagramkit.cli render diagramkit/library/templates/support-escalation.json --output out/support.svg

render refuses to overwrite an existing file unless you pass --overwrite.

• Local and single-user. stdio only, no network listener, no outbound requests, no shell, no telemetry.
• No caller-supplied markup. Scenes cannot carry SVG, HTML, CSS, scripts or image URLs. All text is XML-escaped; control, invisible, bidirectional-override and non-XML characters are rejected.
• Bounded input. 1 MiB per message, at most 200 nodes and 400 edges per scene, 200 validation issues per report.
• Confined writes. export_diagram accepts a filename stem only, writes only into the export folder, refuses symlinks and Windows device names, never overwrites unless asked, and stages both files before publishing them.
• Checked assets. The renderer verifies each symbol's SHA-256 against the catalog and rejects active SVG content.
• Verifiable releases. Each release wheel carries a signed build-provenance attestation and SBOMs. Check it before installing: gh attestation verify <wheel> --repo malindarathnayake/stencil-mcp.

The full threat model, which maps these controls to the OWASP LLM and Agentic Top 10, is in docs/SECURITY_POSTURE.md. Report vulnerabilities privately; see SECURITY.md.

Validation checks structure and layout: ids, bounds, overlaps, text fit, edges crossing nodes. It cannot tell you that an architecture is secure, a protocol is drawn correctly, or a product supports a feature. Look at the rendered output. The layout helper is a first pass, not an obstacle-avoiding router; set ports and waypoints for clean edges. A shared HTTP deployment needs the official MCP SDK plus authentication and isolated storage; see docs/MCP.md.

python scripts/build_library.py     # symbol geometry and catalog.json
python scripts/build_schema.py      # scene.schema.json
python scripts/build_templates.py   # 24 templates and example SVGs
python scripts/build_gallery.py     # previews/ and gallery.html (PNGs need CairoSVG)
python scripts/build_release.py     # asset-packs.json, VALIDATION_REPORT.json, MANIFEST.sha256
python -m pip install --require-hashes --only-binary=:all: -r requirements-build.txt
python -m build --no-isolation           # the release wheel and sdist, into dist/

The release wheel is built from a hash-locked toolchain (requirements-build.txt) with python -m build --no-isolation, and is byte-reproducible with SOURCE_DATE_EPOCH set. CI runs the tests on Linux, Windows and macOS, fails if a rebuild changes any committed generated file, and builds the wheel twice to prove it is reproducible. security.yml runs CodeQL, gitleaks, zizmor and a Syft/Grype SBOM scan. Pushing a vX.Y.Z tag publishes an attested release. Every action is pinned to a commit SHA and every scanner to a verified checksum; see docs/SECURITY_POSTURE.md.

Builds are deterministic and write LF line endings on every OS, so a rebuild without source changes is byte-identical. Asset ids are public API: the original 300 symbols are pinned byte-for-byte by tests/fixtures/legacy_sha256.json, and new symbols are additive. Adding roles, shapes or a separately licensed vendor pack: docs/EXTENDING.md.