dayuan.jiang d415f19cf5 feat(mcp-server): serve the bundled draw.io same-origin behind an api token ...

GET /drawio/<path> serves dist/drawio with a MIME table, a day of
caching and nosniff; paths are normalized and never reach WEB-INF or
META-INF. The preview embeds /drawio/index.html when the copy exists and
DRAWIO_BASE_URL is unset, else the external draw.io as before (and
start_session says so). Every /api request must carry the per-process
X-Drawio-Token the page gets in its HTML; pages send
frame-ancestors 'self' and nosniff.

2026-10-11 20:56:07 +09:00

..

claude-plugin

feat(mcp-server): screenshot attached to create_new_diagram and edit_diagram results (#983)

2026-10-11 20:54:17 +09:00

mcp-server

feat(mcp-server): serve the bundled draw.io same-origin behind an api token

2026-10-11 20:56:07 +09:00