Shared visual canvas (Excalidraw) for collaborative whiteboarding between AI agents and humans.
{
"mcpServers": {
"io-github-sshwarts-napkin": {
"args": [
"-y",
"npm"
],
"command": "npx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Napkin is a shared Excalidraw canvas for agent + human collaboration.
Is it safe?
No known CVEs for npm. 8 previously resolved.
No authentication — any process on your machine can connect.
License not specified.
Is it maintained?
Last commit 3 days ago. 1 stars. 12,072,835 weekly downloads.
Will it work with my client?
Transport: stdio, sse. Works with Claude Desktop, Cursor, Claude Code, and most MCP clients.
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y 'npm' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
No open vulnerabilities. 8 fixed CVEs.
CVE-2022-29244FixedPacking does not respect root-level ignore files in workspaces
### Impact `npm pack` ignores root-level `.gitignore` & `.npmignore` file exclusion directives when run in a workspace or with a workspace flag (ie. `--workspaces`, `--workspace=<name>`). Anyone who has run `npm pack` or `npm publish` with workspaces, as of [v7.9.0](https://github.com/npm/cli/releases/tag/v7.9.0) & [v7.13.0](https://github.com/npm/cli/releases/tag/v7.13.0) respectively, may be affected and have published files into the npm registry they did not intend to include. ### Patch - Up
CVE-2018-7408FixedIncorrect Permission Assignment for Critical Resource in NPM
An issue was discovered in an npm 5.7.0 2018-02-21 pre-release (marked as "next: 5.7.0" and therefore automatically installed by an "npm upgrade -g npm" command, and also announced in the vendor's blog without mention of pre-release status). It might allow local users to bypass intended filesystem access restrictions because ownerships of /etc and /usr directories are being changed unexpectedly, related to a "correctMkdir" issue.
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Dynamic problem-solving through sequential thought chains
A Model Context Protocol server for searching and analyzing arXiv papers
An open-source AI agent that brings the power of Gemini directly into your terminal.
The official Python SDK for Model Context Protocol servers and clients
MCP Security Weekly
Get CVE alerts and security updates for io.github.sshwarts/napkin and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
CVE-2013-4116FixedLocal Privilege Escalation in npm
Affected versions of `npm` use predictable temporary file names during archive unpacking. If an attacker can create a symbolic link at the location of one of these temporary file names, the attacker can arbitrarily write to any file that the user which owns the `npm` process has permission to write to, potentially resulting in local privilege escalation. ## Recommendation Update to version 1.3.3 or later.
CVE-2020-15095Fixednpm CLI exposing sensitive information through logs
Versions of the npm CLI prior to 6.14.6 are vulnerable to an information exposure vulnerability through log files. The CLI supports URLs like `<protocol>://[<user>[:<password>]@]<hostname>[:<port>][:][/]<path>`. The password value is not redacted and is printed to stdout and also to any generated log files.
CVE-2019-16777Fixednpm Vulnerable to Global node_modules Binary Overwrite
Versions of the npm CLI prior to 6.13.4 are vulnerable to a Global node_modules Binary Overwrite. It fails to prevent existing globally-installed binaries to be overwritten by other package installations. For example, if a package was installed globally and created a `serve` binary, any subsequent installs of packages that also create a `serve` binary would overwrite the first binary. This will not overwrite system binaries but only binaries put into the global node_modules directory. This b
CVE-2019-16776Fixednpm symlink reference outside of node_modules
Versions of the npm CLI prior to 6.13.3 are vulnerable to a symlink reference outside of node_modules. It is possible for packages to create symlinks to files outside of the`node_modules` folder through the `bin` field upon installation. A properly constructed entry in the package.json bin field would allow a package publisher to create a symlink pointing to arbitrary files on a user’s system when the package is installed. Only files accessible by the user running the `npm install` are affected.
CVE-2019-16775FixedArbitrary File Write in npm
Versions of the npm CLI prior to 6.13.3 are vulnerable to an Arbitrary File Write. It fails to prevent access to folders outside of the intended node_modules folder through the bin field. A properly constructed entry in the package.json bin field would allow a package publisher to create files on a user's system when the package is installed. It is only possible to affect files that the user running `npm install` has access to and it is not possible to over write files that already exist on disk
CVE-2016-3956Fixednpm Token Leak in npm
Affected versions of the `npm` package include the bearer token of the logged in user in every request made by the CLI, even if the request is not directed towards the user's active registry. An attacker could create an HTTP server to collect tokens, and by various means including but not limited to install scripts, cause the npm CLI to make a request to that server, which would compromise the user's token. This compromised token could be used to do anything that the user could do, including
Napkin is a shared Excalidraw canvas for agent + human collaboration.
I love using AI assistants for everyday tasks — design, programming, and brainstorming. I’ve always found visual thinking helpful, but there was a gap: I could describe something, and the agent could describe it back, but we couldn’t point to the same thing. What if my agent and I could share a whiteboard — where I draw, it responds, and we build together?
Napkin works with any MCP-capable agent. For true two-way canvas-to-agent, you'll also need a webhook.
Brainstorming
Gaming
"Art" - Don't know why Perry invented a Platabird, but there you are.
Collaboration
Napkin is an Excalidraw whiteboard connected to an MCP server. Any MCP-capable agent can read the canvas, draw on it, annotate it, animate it, and respond to what you draw — all while you interact with the agent through your normal channel (Slack, WhatsApp, Telegram, Terminal, or any MCP client).
The conversation stays in your channel. The canvas is pure whiteboard.
cd mcp
npm install
npm run build
npm start
Defaults:
http://localhost:3003ws://localhost:3002cd ui
npm install && npm run dev
# Open http://localhost:5173
Napkin works with any MCP-capable agent. Add to your MCP client config:
{
"napkin": {
"type": "http",
"url": "http://localhost:3003"
}
}
Two-way vs one-way: MCP alone gives you agent→canvas (read, write, animate). For canvas→agent (the agent waking up when you draw something), you need a webhook receiver on your agent's side.
| Mode | What you get | Requires | |------|-------------|---------| | MCP only | Agent can read and write the canvas | Any MCP client | | MCP + webhook | Agent also reacts to human canvas activity | Webhook receiver (see below) |
When you draw on the canvas, Napkin POSTs a trigger to your agent's webhook endpoint. The agent wakes up, reads the canvas diff, and responds.
OpenClaw — built in. Set NAPKIN_TRIGGER_WEBHOOK in your environment and it routes automatically.
NanoClaw — add the webhook channel via PR #1488:
# .env additions
WEBHOOK_PORT=3200
WEBHOOK_LINKED_JID=<your channel JID> # the chat where the agent should post
Then pass the webhook URL when starting your session:
start_session({
session_id: "<your channel ID>",
webhook_url: "http://localhost:3200/webhook"
})
Custom / other frameworks — any HTTP server that accepts POST /webhook with { message, sender? } JSON and forwards to your agent works fine.
Common server variables:
NAPKIN_TRANSPORT (http or stdio, default http)NAPKIN_MCP_PORT (default 3003)MCP_WS_PORT (default 3002)AGENT_TRIGGER_DEBOUNCE_MS (default 3000)NAPKIN_TRIGGER_WEBHOOK (optional global webhook URL)NAPKIN_COMPACT_TRIGGERS (true/false, default false)NAPKIN_TRIGGER_INCLUDE_CANVAS (true/false, default false)NAPKIN_SESSION_TTL_MS (default 7200000)NAPKIN_EXPORT_DIR (optional base dir for relative exports)ANTHROPIC_API_KEY (required for vision tools only