coras-mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@coras-mcpCreate a CORAS risk diagram: attackers exploit weak authentication to steal customer data."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
coras-mcp
Describe a risk picture in words; get a real CORAS diagram, in a file the SINTEF Threat Modelling Tool opens natively — laid out the way a CORAS diagram is meant to read, and rendered back so the assistant can check its own work before handing it to you.
The 2007 editor is bundled, so there is nothing else to download.

Produced by coras_create_diagram from
examples/online-banking.coras, then rendered
through the editor's own renderer — this is exactly what the tool draws.
Install
One line, if your assistant speaks MCP:
npx -y coras-mcpThat is the command to give it. Per client:
claude mcp add coras -s user -- npx -y coras-mcpcodex mcp add coras -- npx -y coras-mcpor in ~/.codex/config.toml:
[mcp_servers.coras]
command = "npx"
args = ["-y", "coras-mcp"]claude_desktop_config.json → Settings ▸ Developer ▸ Edit Config:
{ "mcpServers": { "coras": { "command": "npx", "args": ["-y", "coras-mcp"] } } }~/.cursor/mcp.json (or .cursor/mcp.json in a project):
{ "mcpServers": { "coras": { "command": "npx", "args": ["-y", "coras-mcp"] } } }.vscode/mcp.json:
{ "servers": { "coras": { "command": "npx", "args": ["-y", "coras-mcp"] } } }~/.codeium/windsurf/mcp_config.json, same mcpServers shape as Cursor.
settings.json → "context_servers": { "coras": { "command": { "path": "npx", "args": ["-y", "coras-mcp"] } } }
It is an ordinary stdio MCP server. Command npx, arguments -y coras-mcp.
What it needs
Node 16+ | only to run |
Python 3.8+ | runs the server. Already on macOS and Linux; on Windows install it, or install uv and the launcher will use that instead. |
Java 8+ | optional. Needed only to render a diagram, validate it against the real editor, or open the editor. Writing and reading |
The editor builds an AWT drag-and-drop target while loading a diagram, so those
three tools need a display even when they draw off-screen. On a headless Linux
box, run under Xvfb (xvfb-run -a …); everything else works without one.
No Python packages, no pip install, no virtualenv — the server has zero
dependencies and talks MCP over stdio directly.
From a clone instead
git clone https://github.com/Drewnja/coras-mcp.git
cd coras-mcp
python3 tests/test_coras_mcp.py # 54 tests, ~5 s
claude mcp add coras -s user -- "$PWD/bin/coras-mcp"Related MCP server: UML-MCP
What you can ask for
"Draw the risk picture for our payment API: an outside attacker exploits a missing rate limit, brute-forces card numbers, cards get stolen — that hurts customer money and our reputation. Add 2FA as a treatment."
The assistant calls coras_create_diagram, gets back both the .dgx file and
a picture of it, and can fix anything that looks wrong before you ever open the
tool. Then coras_open_editor puts it in front of you, editable by hand.
Tools
Tool | What it does |
| Every element and relationship the editor understands, and which arrows are legal. |
| Writes a |
| Reads an existing |
| Add, remove, rename, recolour, move, re-lay-out. Keeps a |
| PNG or SVG through the editor's own renderer. |
| Loads the file with the editor's own loader and reports what it found. |
| Starts the Threat Modelling Tool, optionally with a file open. |
The text notation
diagram "Online banking"
stakeholder "The bank" as bank
asset "Customer data" as data
threat "Script kiddie" as kiddie kind=deliberate
vulnerability "Weak password policy" as weakpw
scenario "Password guessed" as guess
incident "Customer records leaked" as leak
treatment "Enforce two-factor auth" as mfa
region "Internet facing" as dmz contains=weakpw,guess
comment "Reviewed Sept 2026" as note
bank -> data
kiddie -> weakpw
weakpw -> guess "likely"
guess -> leak "likely"
leak -> data "major"
mfa -> guess strategy=ReduceLikelihood
note -> leak<type> <name> [as <id>] [key=value ...]declares an element. Types:stakeholder,threat,vulnerability,scenario,incident,risk,asset,treatment,region,comment(aliases such asvuln,unwanted-incident,note,controlwork too).a -> b "label"draws an arrow. The relationship type is worked out from the two elements, by the same rules the editor uses when you draw the arrow by hand. The label is the text on the arrow: the likelihood on an initiate arrow, the consequence on a harm arrow.diagram "Name"starts another diagram in the same file. The same id used in two diagrams is one model element shown twice — which is exactly what the editor's model/diagram split is for.#starts a comment.
Or as a structured spec:
{
"diagrams": [{
"name": "Online banking",
"nodes": [
{"id": "kiddie", "type": "threat", "name": "Script kiddie", "kind": "deliberate"},
{"id": "data", "type": "asset", "name": "Customer data"}
],
"edges": [{"from": "kiddie", "to": "data", "label": "…"}]
}]
}Nodes also take x, y, width, height (giving x/y pins an element and
turns off automatic placement for it), color, font, and — on a region —
contains, which sizes the region around the elements it names.
More in examples/: an asset diagram, a threat diagram, a
treatment diagram and a risk diagram.
What is legal
CORAS is a typed language and the editor refuses to open a file with an illegal relationship, so every arrow is checked before anything is written, with an error that says what would have been allowed instead.
From | may point at |
stakeholder | asset (ownership) |
asset | asset (dependency) |
threat | vulnerability (exploit); threat scenario, risk (initiate) |
vulnerability | vulnerability (exploit); vulnerability, threat scenario, unwanted incident (initiate) |
threat scenario | vulnerability (exploit); vulnerability, threat scenario, unwanted incident (initiate) |
unwanted incident | unwanted incident, threat scenario, risk (initiate); asset (harm) |
risk | asset (harm) |
treatment | threat, vulnerability, threat scenario, unwanted incident (treat) |
comment | anything except another comment |
Two quirks of the 2007 tool, worth knowing:
A treatment cannot point at a risk. The editor lets you draw that arrow and then drops it when it saves — the file format has no way to express it. Point the treatment at the incident behind the risk instead.
Treatment strategies are written but not read back.
strategy=Avoidis stored in the file; the editor shows every treat arrow asReduceLikelihood.
Layout
Layered, left to right, and aware of the canonical CORAS reading order:
stakeholder → threat → vulnerability → threat scenario → unwanted incident → risk → assetColumns nothing lands in are dropped, so an asset diagram of stakeholders and assets comes out as two tidy columns rather than seven.
A treatment is pulled one column left of what it treats; a stakeholder sits beside the asset it owns — above it, once threats are in the picture, so the arrows harming that asset have a clear run.
An arrow that skips a column gets invisible waypoints in the columns it crosses, so it routes around the shapes in between instead of through them.
Shapes are sized from the real font metrics of the editor's default font (
SansSerif 12, measured on the JVM), so a label never spills out of its oval; a name too long for any sensible oval is broken over lines.Regions are drawn behind everything and sized around their contents.
direction: "down" lays the same diagram out top to bottom. layout: "preserve" keeps positions already in the file and only places what is new —
the default when editing.
How it works
.dgx is the editor's own format: JAXB-marshalled XML in the
http://coras.sourceforge.net/profile/1.0 namespace, with a model part
(elements and relationships) and a diagram part (where each element sits, in
which diagram). The writer reproduces that output element for element and
attribute for attribute, in the order the editor writes it, so a generated file
is indistinguishable from a hand-drawn one.
Validation and rendering re-implement nothing: java/src/coras/mcp/Bridge.java
is compiled against the editor's own jars and calls its real loader
(Model.unmarshal → ProfileToDgmMapper) and its real JGraph renderer. If the
bridge can draw it, the tool can open it.
coras_mcp/
server.py MCP over stdio, JSON-RPC 2.0, no dependencies
tools.py the seven tools
spec.py the CORAS language and its legality rules, read off the editor's classes
model.py elements, relationships, diagrams, shape sizing
layout.py layered automatic layout
dgx.py .dgx reader and writer
dsl.py the text notation
metrics.py font metrics measured on the JVM
bridge.py finds Java and the tool, runs the helper
bin/cli.js npx entry point
bin/coras-mcp starts the server from anywhere
bin/coras-tool launches the editor with the flags a modern JRE needs
java/ the Java helper, its source and its build script
tool/ the CORAS diagram editor itself (LGPL, unmodified — see NOTICE)Running the 2007 tool on a modern JRE
The editor ships JAXB 2.0.3, which generates accessor classes at run time. Java
9 and later block that, so on a current JRE it throws
ExceptionInInitializerError the moment you open or save a file. One flag
fixes it, and bin/coras-tool and this server both pass it:
-Dcom.sun.xml.bind.v2.bytecode.ClassTailor.noOptimize=trueDouble-clicking the jar does not pass it. Use bin/coras-tool or
coras_open_editor.
Where the tool lives
The bundled copy in tool/ is used by default. To point at another one:
npx coras-mcp --set-tool-dir /path/to/folder/with/diagram-editor-2.0-SNAPSHOT.jar
npx coras-mcp --where # what it found: tool, Java, helper jarCORAS_TOOL_DIR overrides both; CORAS_JAVA picks a JDK/JRE; CORAS_PYTHON
picks an interpreter.
Tests
python3 tests/test_coras_mcp.py54 tests: the language rules, the notation, the layout, the file format, the seven tools, the MCP protocol over a real stdio pipe, and — when Java is present — a round trip through the editor itself, including one diagram holding every legal relationship in the language.
Licence
This project is MIT (see LICENSE).
tool/ contains the CORAS diagram editor 2.0 by SINTEF, redistributed
unmodified under the LGPL 2.1. Upstream:
sourceforge.net/projects/coras.
See NOTICE for the details and for where to get its source.
Available Tools
7 toolscoras_create_diagramA
Build a CORAS diagram file (.dgx) from a description and lay it out automatically, then show you how the editor draws it. Give either a structured 'spec' or 'text' in the CORAS notation. Elements are placed in the canonical left-to-right order (stakeholder, threat, vulnerability, threat scenario, unwanted incident, risk, asset), sized to fit their labels, and relationship types are inferred from the elements they join. The resulting file opens in the Threat Modelling Tool as if it had been drawn by hand.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Where to write the .dgx file. | |
| spec | No | The model: one or more diagrams that may share elements. | |
| text | No | The diagram in the CORAS text notation (see coras_reference). Use this or 'spec'. | |
| scale | No | Preview scale, default 1.5. | |
| layout | No | 'auto' (default) positions everything; 'manual' uses only the x/y you supply. | |
| dry_run | No | Validate and lay out without writing anything. | |
| preview | No | Render the result and return it as an image (default true). This also proves the editor can open the file. | |
| direction | No | Flow direction; 'right' is the CORAS norm. | |
| overwrite | No | Replace an existing file (default true). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses real behavior: it writes a file, lays elements out automatically in canonical left-to-right order, sizes them to labels, infers relationship types, and produces output that opens as if hand-drawn. It does not mention that overwrite defaults to true or that a dry_run skips writing, but those are documented in the schema; the description still provides substantial non-obvious behavioral detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded, with the primary purpose in the first sentence. The later sentences earn their place by explaining layout order, input modes, and editor compatibility. The phrase 'show you how the editor draws it' is slightly indirect, but there is no wasted or redundant content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 9 parameters and nested spec objects, the description covers the main usage patterns, layout behavior, and output compatibility. It does not explicitly describe the return value or when to use dry_run/overwrite, but those are fully documented in the schema. The description is complete enough for an agent to decide to call the tool and choose an input mode correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description reinforces that 'spec' and 'text' are the two input modes and explains layout/inference behavior, but it does not add materially new per-parameter meaning beyond what the schema already says. This is acceptable given the schema's completeness.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Build a CORAS diagram file (.dgx)...' and adds the automatic layout behavior. It distinguishes cleanly from siblings like coras_read_diagram, coras_edit_diagram, coras_render_diagram, and coras_validate_file by making 'create' the core action. The input modes ('spec' or 'text') are also clearly stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context: use this to build a new .dgx file, and provide either a structured spec or CORAS text notation. It does not explicitly name alternatives or say 'use coras_read_diagram for reading', but the create-vs-read/edit/render distinction is strong enough that the intended condition is clear. No exclusions are stated, so it misses a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
coras_edit_diagramA
Change an existing .dgx file in place: add or remove elements and arrows, rename things, recolour, move, add or drop whole diagrams, or re-run the automatic layout. Existing positions are kept unless you ask for a relayout, and a .bak copy is made first.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | The .dgx file to change. | |
| scale | No | ||
| backup | No | Write a .bak copy (default true). | |
| layout | No | 'preserve' (default) keeps hand positions and only places new elements; 'auto' re-lays out every diagram that changed. | |
| preview | No | Return an image (default true). | |
| direction | No | ||
| operations | Yes | Edits, applied in order. Each has an 'op': add_node, add_edge, remove_node, remove_edge, rename, set, set_label, add_diagram, remove_diagram, rename_diagram, relayout. add_node takes the same fields as a node in coras_create_diagram; add_edge takes from/to/label/type/strategy; set takes id plus any of name, kind, color, font, x, y, width, height. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions that existing positions are kept unless a relayout is requested, and that a .bak copy is made first, which are key behavioral traits. It does not cover permissions, reversibility, or failure modes, but the core mutation behavior and safety net are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, with two sentences that front-load the main action and then add key behavioral notes. Every sentence adds information without redundancy, making it efficient for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core functionality and key behaviors (preserving positions, backup), and the schema handles detailed parameters. It does not explicitly mention the preview/return image behavior or the ordered application of operations, but these are available in the schema. For a modification tool with this complexity, the context is adequate but not exhaustive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 71%, with descriptions for path, backup, layout, preview, and operations. The description adds little beyond what the schema already says about layout (preserve vs auto) and backup behavior. It does not elaborate on scale, direction, or operation specifics, so it provides marginal added value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool modifies an existing .dgx file in place, listing concrete operations like add/remove elements, rename, recolour, move, add/drop diagrams, and relayout. It distinguishes from siblings (create, read, render) by focusing on editing existing files. The verb 'change' is specific and resource is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this tool is for editing existing diagrams, as opposed to creating new ones (coras_create_diagram). It states that positions are preserved unless a relayout is requested, giving context on when to use the layout option. However, it does not explicitly name alternatives or exclude cases like reading or rendering, so it lacks explicit when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
coras_open_editorA
Launch the Threat Modelling Tool GUI, optionally with a .dgx file already open, so the diagram can be looked at and edited by hand. The editor keeps running after this returns.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Optional .dgx file to open on start-up. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It adds useful non-obvious behavior: 'The editor keeps running after this returns', which signals the tool is non-blocking and the GUI persists after invocation. It also notes the optional file-open behavior, though it does not discuss side effects such as whether the file is locked or whether the tool requires a graphical environment.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no filler. It front-loads the core action ('Launch the Threat Modelling Tool GUI') and then adds the key behavioral detail about persistence, all in minimal words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one optional parameter and no output schema, the description covers the essential invocation context and the non-blocking behavior. It does not mention possible failure modes like missing display or invalid file format, but these are not critical for correct invocation, so the description is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameter's meaning is already fully documented ('Optional .dgx file to open on start-up'). The description reinforces the .dgx file type but adds little beyond what the schema already provides, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Launch the Threat Modelling Tool GUI'. It also clarifies the optional .dgx file and that the diagram is for manual viewing/editing, which clearly distinguishes this tool from siblings like coras_read_diagram, coras_edit_diagram, and coras_render_diagram that operate programmatically rather than via an interactive GUI.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool should be used when a human needs to interact with a diagram by hand ('so the diagram can be looked at and edited by hand'), but it does not explicitly mention alternative tools or state when not to use it. No exclusions or sibling names are provided, leaving the route to alternatives implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
coras_read_diagramA
Read an existing .dgx file and return it as a structured spec and as the CORAS text notation, so it can be inspected or rewritten. Optionally renders it so you can see the current state.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | The .dgx file to read. | |
| scale | No | ||
| format | No | What to return, default 'both'. | |
| preview | No | Also render it as an image. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool reads a file and returns representations (structured spec and text notation) and optionally renders it. However, it does not explicitly state that it performs no modifications, what happens with missing or invalid files, or how scale affects the render. These gaps limit transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no wasted words. The primary action and output are front-loaded, and the every clause earns its place (read behavior, output formats, use case, optional render).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read tool with no annotations or output schema, the description covers the core functionality but leaves scale completely undocumented (no schema description either). It also does not explain the precise return structure or error handling, which an agent would need for robust use. The tool's complexity is moderate, so this is adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 75%, with scale missing a description. The description's phrases 'structured spec and CORAS text notation' map to the format parameter's default 'both', and 'Optionally renders it' maps to preview, adding some semantic value. However, it does not clarify scale or parameter interactions, so it does not fully compensate for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's verb ('Read'), resource ('an existing .dgx file'), and output ('structured spec and as the CORAS text notation'). It also indicates the purpose ('so it can be inspected or rewritten') and an optional rendering behavior. This distinguishes it from siblings like coras_create_diagram (creation) and coras_render_diagram (rendering alone).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for inspecting or rewriting diagrams, but does not explicitly state when to choose this tool over alternatives such as coras_render_diagram or coras_open_editor. There are no when-not-to-use conditions or references to sibling tools, leaving the decision partly to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
coras_referenceA
The CORAS language as this 2007 Threat Modelling Tool implements it: every element type, every relationship and which elements it may connect, the treatment strategies, and the text notation. Read this first when you are unsure whether an arrow is allowed - the editor refuses to open a file with an illegal relationship.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It explains the tool's scope and the editor's rejection behavior, which is useful context. However, it does not explicitly state whether the call is read-only or what form the returned reference takes, leaving some operational behavior implicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two tight sentences: the first defines the scope with a compact list, and the second gives a concrete when-to-use trigger. Every clause earns its place and there is no filler or repetition of schema/annotation information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-parameter reference tool, the description is largely complete: it states what the reference covers, when to use it, and why it matters. A minor gap is that it does not describe the output format or length, but the enumerated content list makes the expected information clear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and an empty input schema, so there is no parameter ambiguity to resolve. The description correctly avoids inventing parameters and instead focuses on the tool's content and purpose, which is the appropriate baseline for a parameterless reference.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as a reference for the CORAS language as implemented by this 2007 tool, and enumerates its contents: element types, relationships, treatments, and text notation. It also distinguishes the tool from siblings by positioning it as the first thing to read when checking whether an arrow is legal. It lacks an explicit action verb like 'returns' or 'provides,' but the 'reference' role is unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an explicit use condition: 'Read this first when you are unsure whether an arrow is allowed.' It also supplies a concrete reason (the editor refuses to open files with illegal relationships), which helps an agent decide when to consult it. It does not compare against named alternatives, but the sibling set makes the reference role distinct.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
coras_render_diagramA
Render a .dgx file to PNG or SVG using the editor's own renderer, so the image is pixel-identical to what the tool shows. Returns the picture inline and writes it to disk.
| Name | Required | Description | Default |
|---|---|---|---|
| out | No | Output file, or a folder when rendering every diagram. Omit to use a temporary folder. | |
| path | Yes | The .dgx file to render. | |
| scale | No | Default 2.0. | |
| format | No | ||
| inline | No | Return the PNG in the reply (default true). | |
| diagram | No | Name or 0-based index of one diagram; omit for all of them. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly states that the tool returns the picture inline and writes it to disk, which are key side effects, and it adds the pixel-identical guarantee. However, it does not mention error conditions, file overwrite policy, or whether the source file is modified, though the render verb implies non-destructiveness.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core action ('Render a .dgx file to PNG or SVG') and immediately followed by the key distinguishing detail (pixel-identical) and output behavior. Every word contributes value; there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a moderately complex tool with six parameters and no output schema, the description covers the core purpose, the main side effects, and the output format. It does not elaborate on return value structure or edge cases like multiple diagrams or temporary folder behavior, but the schema's high coverage compensates for parameter details. Overall, an agent likely has enough to invoke it correctly, though some behavioral nuances remain only in the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 83%, which is high, so the baseline is 3. The description does not explain individual parameters beyond what the schema already states; it only rephrases the purpose. It does add that output is written to disk and returned inline, which relates to 'out' and 'inline', but this adds limited meaning beyond the schema's descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Render'), a resource ('.dgx file'), and output formats (PNG or SVG). It also distinguishes the tool from siblings by emphasizing the editor's own renderer and pixel-identical output, making it clear this is the dedicated rendering tool among read, edit, create, validate, and open actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies when to use the tool (when a rendered image of a .dgx file is needed), but it does not explicitly mention alternatives or when not to use it. It does not reference sibling tools like coras_read_diagram or coras_edit_diagram, so the agent must infer the use case from the purpose alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
coras_validate_fileA
Check that a .dgx file is well formed and that the Threat Modelling Tool itself can load it, reporting what it found in each diagram.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that the tool reports what it found in each diagram, which is a useful behavioral detail. However, with no annotations provided, the description carries the full burden of behavioral disclosure. It does not mention whether the tool modifies the file, what happens on failure, or whether it requires specific permissions. The 'check' verb implies a read-only operation, but this is not explicitly stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the primary action ('Check that a .dgx file is well formed') and adds a secondary detail about reporting. Every word earns its place, and there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple validation tool with one parameter and no output schema, the description is mostly complete. It explains what the tool does and what it reports. However, it lacks details about the return format or how the results are presented, which could be important for an agent deciding whether to call this tool. The absence of annotations increases the burden, but the simplicity of the tool keeps the gap moderate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has only one parameter, 'path', with no description. The description mentions '.dgx file' but does not explicitly state that 'path' should point to a .dgx file. Since schema description coverage is 0%, the description must compensate, and it partially does by implying the file type, but it could be more explicit about the parameter's meaning and format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: validating a .dgx file for well-formedness and loadability by the Threat Modelling Tool, and reporting findings per diagram. It uses a specific verb ('Check') and resource ('.dgx file'), and it distinguishes itself from sibling tools like coras_read_diagram or coras_edit_diagram by focusing on validation rather than reading or editing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use this tool: when you need to validate a .dgx file before loading or editing it. However, it does not explicitly state when not to use it or mention alternatives like coras_read_diagram for inspecting content. The context is clear but lacks explicit routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v1.0.0- First observed
coras_create_diagram - First observed
coras_edit_diagram - First observed
coras_open_editor - First observed
coras_read_diagram - First observed
coras_reference - First observed
coras_render_diagram - First observed
coras_validate_file
TDQS
Scored across 7 tools
Each tool targets a distinct operation—create, read, edit, render, validate, open in the GUI, or consult the language reference—so there is little risk of selecting the wrong one. The only close pair, read vs. render, is clearly separated by output type: structured spec/text vs. PNG/SVG image.
Most tools follow a consistent coras_<verb>_<noun> pattern: coras_read_diagram, coras_edit_diagram, coras_render_diagram, coras_create_diagram, coras_open_editor. The exceptions are coras_reference, which is a bare noun, and coras_validate_file, which uses 'file' rather than 'diagram', but these are minor deviations.
Seven tools is well-scoped for a CORAS diagram server. Each tool has a clear role covering creation, inspection, editing, rendering, validation, GUI launch, and language reference, with no apparent redundancy.
The core diagram lifecycle is well covered: create, read, edit, render, validate, and even open in the desktop editor. Minor gaps exist—there is no explicit file listing/deletion or a tool to close the launched editor—but these do not block the main workflows.
Maintenance
Related MCP Connectors
Concept Maps, IBIS, Causal Loop Diagrams and Timelines as images. Runs locally via WebAssembly.
Design domain models and generate deterministic multi-stack code, driven by your coding agent.
Render, verify, describe, and safely edit Mermaid diagrams through MCP.
Schema modeling in JSON, JSON-LD, and other formats with CoreModels platform.
Related MCP Servers
- FlicenseNot gradedqualityFmaintenanceEnables AI-driven graphical diagram creation and manipulation using natural language, with support for BPMN workflows, analysis, and manual editing via the Model Context Protocol.1-
- AlicenseAqualityAmaintenanceGenerates UML and other diagrams (30+ types) via the Model Context Protocol, supporting multiple output formats and deployment options.4102MIT
- FlicenseNot gradedqualityDmaintenanceEnables AI-powered threat modeling with tools for creating threat models, analyzing security threats, generating security controls, and validating architecture against best practices.-
- FlicenseAqualityAmaintenanceEnables creation of complete metamodels and model instances through natural language interaction by connecting Large Language Models to the MM-AR metamodeling platform.62-