DrawPro is a diagramming platform built to be driven by an agent. Claude describes what connects to what; layout, sizing, text wrapping and arrow binding are derived. The result lands in your account as a real, editable Excalidraw sheet — encrypted before it leaves your machine.
Asking a model to write Excalidraw JSON by hand produces overlapping boxes and arrows bound to nothing, because coordinates are the part a language model is worst at and the part that decides whether a diagram is readable.
A spec is nodes and edges. There is nowhere to put an x or a y — the schema does not offer one — so layout is computed by dagre every time, not guessed.
An edge naming a node that does not exist is refused with that node's name, and nothing is written. The model reads the message and fixes it in the same turn.
A sheet returns as an outline of shapes and connections, not tens of thousands of characters of coordinates and style. Extending a diagram starts by reading it.
Because one writer would be a trap: regenerating layout destroys a hand-drawn sheet, so wording changes and geometry changes get their own tools.
Anyone can claim their MCP server works. This one ships a suite that drives the real server over a real MCP stdio session and grades what comes out — runnable by a stranger, with no account, no API key and no network.
Every check states what breaks in the real world if it fails. Some are marked critical: a silent overwrite, a half-applied edit, a plaintext label on the wire, or a model asking the user to type their passcode into a chat.
A second suite drives a real model through the same prompts and grades the transcripts, with an ablation arm that removes the plugin. The delta between the arms is the number that says whether it earns its place.
DrawPro is end-to-end encrypted. Diagrams are sealed in the client with X25519 + AES-256-GCM and the server stores only ciphertext — it cannot read your drawings, and neither can we. A hosted remote MCP server would have to receive plaintext to do its job, which would undo that property entirely. So it runs locally: encryption and decryption stay here, exactly as they do in the browser.
Reading needs your private key, unwrapped by an interactive login that
stores it in the OS keychain. It is never a tool argument, so it never reaches the
model's context — and a locked tool relays that instruction rather than asking.
Names are sealed at creation. The server sees [encrypted]; a dashboard
of readable titles would leak the shape of everything you work on.
Because the server is local, import_sheet reads a file straight into the
encrypted blob. The contents never pass through the model's context.