B — Some risk signals Graded October 16, 2026Minor concerns worth a quick check.Based on public adoption and transparency signals as of October 16, 2026. Our opinion, not a code audit or security guarantee.
AI agent skill · Data & databases, Cloud & infrastructure
mcp-server-chart
🤖 A visualization mcp & skills contains 25+ visual charts using @antvis. Using for chart generation and data analysis.
Bottom line: Signal-based grade (4/7 points): well starred on GitHub, listed in several sources, public source code. This reflects adoption and transparency, not a code review.
- Popularity score
- 45/100
- Rank
- #203 of 500
- GitHub stars
- 4.4k
What it does
Generates 25+ interactive data visualizations using the AntV charting library, enabling AI agents to create charts, graphs, and visual analyses from datasets. Supports chart generation and data analysis workflows through an MCP connector that integrates with Claude and other AI platforms.
Who it’s for
Data analysts, business intelligence teams, and builders needing programmatic chart generation within AI agent workflows. Product teams integrating visualization capabilities into AI-powered dashboards or reporting systems.
Copy-paste setup
Check these steps against the project’s own instructions before running anything.
Verify against the repo README for latest instructions. Likely installation via npm: npm install @antv/mcp-server-chart. For Claude Desktop integration, add to claude_desktop_config.json under mcpServers. Exact configuration details should be confirmed at https://github.com/antvis/mcp-server-chart (opens external site).
Risks
- Data exfiltration: Chart generation may transmit dataset contents to external servers depending on implementation; verify data handling in documentation.
- Prompt injection: User-supplied data or chart specifications could manipulate visualization output or expose underlying system behavior.
- Supply chain: Dependency on AntV library and npm ecosystem; monitor for upstream vulnerabilities.
- Scope creep: No obvious credential handling, but verify the tool doesn't inadvertently capture or log chart data.
- Transparency gap: Limited documentation available; security model and data flow should be reviewed before production use.
How to stay secure
Least-privilege permissions
- Restrict the agent to chart-generation functions only; disable any data export, download, or file-saving capabilities
- Limit access to this skill to authorized users only; remove it from general-access AI assistants
- Prevent the agent from accessing sensitive datasets; use filtered or anonymized data samples for testing and demos
- Do not grant file system access or credential storage permissions to this skill
Network isolation
- Route all chart requests through your organization's firewall with outbound traffic inspection enabled
- Verify that chart data never leaves your network; confirm AntV library processes visualizations locally, not on external servers
- Disable internet connectivity for this agent if it doesn't require live library updates or cloud rendering
- Block access to unknown or suspicious domains that the underlying libraries might attempt to contact
Monitoring
- Log all chart generation requests, including input data size and user identity, for audit trails
- Set alerts for unusual activity: excessive data volume, repeated failed requests, or requests outside business hours
- Review network traffic monthly to detect unexpected outbound connections or data transfers
- Audit the skill's dependencies (npm packages) quarterly for published security vulnerabilities
Red flags to watch for
- Chart visualizations displaying data you didn't provide or content that appears manipulated or corrupted
- Users requesting charts with unusual specifications or attempting to include code, commands, or special characters in data labels
- Unexpected network activity or performance slowdowns when the agent generates charts
- Security updates or patches released for AntV or its dependencies without clear documentation of what was fixed
Alternatives
- Plotly MCP connector — broader chart types and Python/R integration
- Observable Plot — lightweight visualization focused on exploratory data analysis
- Apache ECharts wrappers — similar charting capability with different feature set
- Vega-Lite agents — declarative visualization specification with strong community tooling