arch-diagram-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| ARCH_DIAGRAM_FONT | No | Font family; auto picks Segoe UI on Windows, Helvetica Neue on macOS, DejaVu Sans on Linux. | auto |
| ARCH_DIAGRAM_PNG_DPI | No | PNG/JPG resolution (72-300). | 144 |
| ARCH_DIAGRAM_STORAGE | No | Artifact storage backend: local, s3, azure, or gcs. | local |
| ARCH_DIAGRAM_AUTH_MODE | No | Authentication mode: none, token, or oidc; inferred from the variables below when set to auto. | auto |
| ARCH_DIAGRAM_HTTP_HOST | No | HTTP bind address. | 127.0.0.1 |
| ARCH_DIAGRAM_HTTP_PORT | No | HTTP bind port. | 8000 |
| ARCH_DIAGRAM_LOG_LEVEL | No | JSON logs go to stderr, one audit line per tool call. | INFO |
| ARCH_DIAGRAM_MAX_EDGES | No | Maximum number of edges allowed in a diagram spec. | 800 |
| ARCH_DIAGRAM_MAX_NODES | No | Maximum number of nodes allowed in a diagram spec. | 300 |
| ARCH_DIAGRAM_S3_REGION | No | AWS region for S3 artifact storage. | |
| ARCH_DIAGRAM_URL_TTL_S | No | Download-link lifetime in seconds (60 s to 7 days). | 3600 |
| ARCH_DIAGRAM_AUTH_TOKEN | No | Legacy single bearer token for token authentication; still supported. | |
| ARCH_DIAGRAM_OUTPUT_DIR | No | Where diagrams are written. | ~/architecture-diagrams |
| ARCH_DIAGRAM_AUTHOR_ROLE | No | Role name for author access when using OIDC RBAC. | |
| ARCH_DIAGRAM_AUTH_TOKENS | No | Named bearer tokens in the format name=secret,... for token authentication. | |
| ARCH_DIAGRAM_INPUT_ROOTS | No | os.pathsep-separated directories that diagram_from_terraform(path=...) may read. | cwd + output dir |
| ARCH_DIAGRAM_OIDC_ISSUER | No | OIDC issuer URL used to validate JWTs. | |
| ARCH_DIAGRAM_READER_ROLE | No | Role name for reader access when using OIDC RBAC. | |
| ARCH_DIAGRAM_MAX_CLUSTERS | No | Maximum number of clusters allowed in a diagram spec. | 100 |
| ARCH_DIAGRAM_ALLOWED_HOSTS | No | Comma-separated Host allow-list for DNS-rebinding protection. | |
| ARCH_DIAGRAM_OIDC_AUDIENCE | No | Expected OIDC JWT audience. | |
| ARCH_DIAGRAM_OIDC_JWKS_URI | No | Optional OIDC JWKS URI; otherwise discovered from the issuer. | |
| ARCH_DIAGRAM_S3_KMS_KEY_ID | No | Optional KMS key ID for S3 SSE-KMS encryption. | |
| ARCH_DIAGRAM_RETENTION_DAYS | No | Deletes generated files older than N days; 0 keeps files forever. | 0 |
| ARCH_DIAGRAM_STORAGE_BUCKET | No | Bucket or container used by the configured cloud storage backend. | |
| ARCH_DIAGRAM_STORAGE_PREFIX | No | Key prefix for objects in cloud storage. | diagrams/ |
| ARCH_DIAGRAM_ALLOWED_ORIGINS | No | Comma-separated Origin allow-list for DNS-rebinding protection. | |
| ARCH_DIAGRAM_KEEP_DOT_SOURCE | No | Keeps the .dot file for hand-editing. | true |
| ARCH_DIAGRAM_PUBLIC_BASE_URL | No | External URL used for download links and OAuth metadata. | |
| ARCH_DIAGRAM_URL_SIGNING_KEY | No | HMAC key for local download links; at least 32 characters; must be shared across replicas. | |
| ARCH_DIAGRAM_RENDER_TIMEOUT_S | No | Graphviz is killed after this many seconds. | 60 |
| ARCH_DIAGRAM_AZURE_ACCOUNT_URL | No | Azure Blob Storage account URL for Azure artifact storage. | |
| AZURE_STORAGE_CONNECTION_STRING | No | Azure Storage connection string used as an alternative account-key credential for Azure artifact storage. | |
| ARCH_DIAGRAM_MAX_TERRAFORM_BYTES | No | Terraform input size limit. | 25 MB |
| ARCH_DIAGRAM_INLINE_PNG_MAX_BYTES | No | Larger PNGs are returned as a path only. | 4 MB |
| ARCH_DIAGRAM_OIDC_REQUIRED_SCOPES | No | Optional required OIDC scopes. | |
| ARCH_DIAGRAM_ALLOW_UNAUTHENTICATED | No | Allows a non-loopback bind without a token; only use behind an authenticating proxy. | false |
| ARCH_DIAGRAM_DELETE_LOCAL_AFTER_UPLOAD | No | Removes local files after a successful cloud storage upload. | false |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": false
} |
| prompts | {
"listChanged": false
} |
| resources | {
"subscribe": false,
"listChanged": false
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| search_iconsB | Search ~1,900 official icons by service name, alias or category. Examples: 'ecs', 's3', 'aks', 'cloud run', 'postgres', 'redis', 'kafka', 'load balancer'.
Returns canonical ids (usable as node |
| list_icon_categoriesA | List every category of a provider and the service icons in each. |
| list_templatesB | List bundled reference architectures (AWS, Azure, GCP) that can be loaded with get_template. |
| get_templateA | Return a reference architecture spec to customise and pass to generate_architecture_diagram. |
| validate_diagramA | Check a spec without rendering: icon ids (with suggestions), references, nesting, limits. |
| generate_architecture_diagramA | Render an architecture diagram with official provider icons. spec.nodes: services ( |
| review_architectureA | Heuristic Well-Architected review of a spec (security, reliability, operations, performance). Returns a 0-100 score, grade, and findings with recommendations. Findings reflect only what the diagram shows. |
| diagram_from_terraformA | Build a diagram from Terraform: Pass the JSON text in |
| diagram_from_inventoryA | Diagram infrastructure that is already running, from the cloud's own inventory, with real names. Google Cloud: pass the output of
Layout: Project > VPC > Subnet > GKE cluster > namespace. Edges come from configuration
(Cloud SQL/secret/Pub/Sub references, URLs matched to Cloud Run services, load balancer
backends, push subscriptions, Scheduler targets, VPC connectors). Filter with |
| server_infoA | Report version, Graphviz status, icon count, storage, auth mode, caller identity and limits. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
| design_architecture | Guide the model through designing, rendering and reviewing an architecture. |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 10 tools
Most tools have clearly distinct purposes: rendering (generate_architecture_diagram), discovery (search_icons, list_icon_categories, list_templates, get_template), validation (validate_diagram vs review_architecture), and import (diagram_from_terraform vs diagram_from_inventory). Minor overlap between search_icons and list_icon_categories (both surface icons) and between validate_diagram and review_architecture (both inspect a spec), but descriptions clarify the intent difference.
Most tools follow a verb_noun pattern (search_icons, list_templates, get_template, validate_diagram, review_architecture) and the two import tools consistently use diagram_from_<source>. Deviations exist: server_info is noun-only and generate_architecture_diagram is a longer verb phrase, but the set reads predictably overall.
Ten tools is well-scoped for a diagram generation server, covering rendering, discovery, templates, validation, review, and two import sources without redundancy. Each tool earns its place in the workflow.
The surface covers the full diagram lifecycle: discover icons, load templates, generate, validate, review, and import from Terraform/inventory. Minor gaps remain—no explicit tool to save/manage custom templates or to retrieve/edit previously generated diagram files—but core workflows are well supported.