erd-editor
Design database schemas as ERDs in your browser, VS Code, JetBrains IDEs or Obsidian. Import SQL, DBML and GraphQL, export DDL and code, and let coding agents edit live over MCP.
No outside reports on file
erd-editor is a design tool that needs file access and can let AI agents edit your database schemas, so use it only with trusted projects and be careful what files and databases you import into it.
Based on public adoption and transparency signals as of Oct 22, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesReads local filesNOTED
- Command executionNo shell command runner notedLOW
- Network reachFetches arbitrary web URLsREVIEW
- CredentialsNo API token requiredLOW
- Package sourceGitHub (dineug/erd-editor)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
No npm or PyPI package is listed. Install from source: github.com/dineug/erd-editor ↗
About Erd Editor
erd-editor is a tool for drawing database schema diagrams (Entity-Relationship Diagrams) in your browser, VS Code, JetBrains IDEs, or Obsidian. It can import existing databases from SQL, DBML, and GraphQL formats, then export database creation code (DDL) and other programming code. It also lets AI coding agents make live edits to your database schemas through an MCP connection.
Who it’s for
Database designers, software developers, and teams using AI coding assistants who want to visualize and edit database structures in their favorite editor. It's useful for anyone who needs to import or export database definitions.
Alternatives
- dbdiagram.io: Web-based ERD tool with import/export features (no direct AI agent integration). - Lucidchart: General diagramming tool with database templates and collaboration. - SchemaCrawler: Command-line tool for visualizing and analyzing existing databases. - DBeaver: Full database IDE with schema visualization and editing built in.
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README for installation instructions for your specific editor (browser, VS Code, JetBrains, or Obsidian). The project repository is at https://github.com/dineug/erd-editor (opens external site). Setup varies by platform.
Why this grade
Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 1.7k
- Listing last refreshed
- 2026-10-29
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Security reports
No reports found for this package in our research (last checked 2026-10-29).
Risks to watch for
- Database schema exposure: The tool can read and edit your database design files, which may contain sensitive structure information that reveals how your data is organized. - Import injection: When importing SQL or DBML files, malicious code in those files could potentially cause unexpected behavior or expose information. - AI agent access: Through MCP, a coding agent gets direct ability to modify your database schema diagrams, so a compromised agent could alter your designs. - Export leakage: When exporting DDL or code, sensitive naming patterns or business logic hints could be saved to files an attacker might access. - File system access: The tool needs to read and write files on your computer, so it can touch any database design files in your project folders.
How to lower the risk
Least-privilege permissions
- Only connect the MCP server when you're actively working with trusted AI agents.
- Don't grant the tool access to folders containing unrelated sensitive data.
Network isolation
- Use erd-editor locally; avoid cloud versions if your schemas contain sensitive business logic.
- Keep imported SQL and DBML files from trusted sources only.
Monitoring
- Review any schema changes the AI makes before saving or deploying them.
- Check exported code files before using them in production databases.
Red flags to watch for
- Unexpected changes to database design files you didn't request.
- Import errors or strange behavior when loading external schema files.
- AI agent making schema edits you didn't authorize through the MCP connection.
Questions
How do I install Erd Editor?
Erd Editor does not publish a standalone npm or PyPI package. Clone or follow the setup instructions in its source repository at github.com/dineug/erd-editor.
Are there security reports about Erd Editor?
No reports found for this package in our research (last checked 2026-10-29). Erd Editor currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include database schema exposure.
Is Erd Editor actively maintained?
Erd Editor has 1.7k GitHub stars. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/dineug/erd-editor before pinning it in production.
What are alternatives to Erd Editor?
Notable alternatives to Erd Editor include dbdiagram.io (Web-based ERD tool with import/export features (no direct AI agent integration). - **Lucidchart**: General diagramming tool with database templates and collaboration. - **SchemaCrawler**: Command-line tool for visualizing and analyzing existing databases. - **DBeaver**: Full database IDE with schema visualization and editing built in). You can also compare Erd Editor side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use Erd Editor? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/dineug-erd-editor)HTML embed:
<a href="https://agentarmorhq.com/skills/dineug-erd-editor"><img src="https://agentarmorhq.com/api/badge/dineug-erd-editor" alt="AgentArmorHQ Risk Grade for Erd Editor" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "dineug-erd-editor"Share with your security lead
Need sign-off to use erd-editor? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: erd-editor
- **Listing URL:** https://agentarmorhq.com/skills/dineug-erd-editor
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 1.7k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** Reads local files
- **Command execution:** No shell command runner noted
- **Network reach:** Fetches arbitrary web URLs
- **Credentials:** No API token required
- **Package source:** GitHub (dineug/erd-editor)
#### Recommended Hardened Setup
- **Source Repo:** https://github.com/dineug/erd-editor
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 22, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- dineug
- Source code
- github.com/dineug/erd-editor
- Est. context load
- ~700 tokens / turn (~4 tool schemas, 0.35% of 200k context)
- Popularity
- 1.7k GitHub stars
- Last updated
- 2026-10-29
- Last graded
- 2026-10-22
Community
Discussions for Erd Editor
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude