# addWhiteboardElements Author shapes onto a whiteboard from high-level specs (you do NOT need the full Excalidraw element schema). Appends to the canvas. PLACEMENT ON AN EXISTING BOARD (critical): NEVER guess x/y onto a board that already has content — guessed coordinates land ON TOP of existing shapes and create an unreadable pile. Either (a) OMIT x/y entirely and the server auto-places the new elements together in clear space BELOW the current content, or (b) FIRST call getWhiteboard({ includeElements:true }) to see where existing shapes already are and choose a genuinely EMPTY region. Pass explicit x/y only for a deliberate layout in space you have confirmed is empty. PREFER THE RICHEST FORM THAT FITS, not plain rectangles: for a sticky/post-it note use { type:'sticky', text, backgroundColor } (a first-class note with an auto-fitting bound label — there is NO sticky-note stencil; OMIT x/y and it is auto-placed in clear space below existing content, so it doesn't land on top of the current drawing); for kanban/scrum/story boards, flowcharts, UML/ER, BPMN, org charts, wireframes/mockups, charts or people use a LIBRARY STENCIL in ONE call — { type:'stencil', stencil:'', x, y } fuzzy-matches by name with no prior listWhiteboardStencils call (pass width/height to SCALE the whole stencil and text to fill its single label); for cloud/software-architecture use ICONS — { type:'image', iconPath:'dev/docker.svg', x, y } (paths from listArchitectureIcons); reserve raw rectangles/ellipses for when no standard form fits. Expressive enough to reproduce real Excalidraw templates (sticky-note brainstorm grids, sketchy mind maps, flowcharts). Each spec: { type: 'rectangle'|'ellipse'|'diamond'|'sticky'|'text'|'arrow'|'line'|'freedraw'|'frame'|'image'|'stencil', id?, x, y, width, height, text? (STRONGLY PREFER setting a shape's label via its own text — it becomes a centered, auto-WRAPPED bound label fitted to the shape; do NOT drop a separate type:'text' element on top of a shape as its label. Standalone type:'text' is for free-floating titles/notes and now also wraps to its width; Yes/No label on an arrow — emojis are fine, e.g. 'Risks ⚠️'), fontSize?, fontFamily? (1=hand-drawn default, 2=normal, 3=code), textAlign?, backgroundColor? (name 'blue'/'green'/'yellow'/'pink'/'violet'/'orange'/'teal'/… or hex), strokeColor?, fillStyle? ('solid'|'hachure'|'cross-hatch'), strokeStyle? ('solid'|'dashed'|'dotted' — use 'dashed' for grid/category borders), strokeWidth? (1 thin/2 bold/4 extra), roughness? (0 clean, 1 default, 2 very sketchy/hand-drawn — use 2 for organic mind maps), roundness? (number type or null for sharp), opacity?, name? (frame title), frameId? (put a shape inside a frame), start?:{id}, end?:{id} (connect arrows/lines to shapes by id — connectors AUTO-CLIP to the shape edges, never overrun to the centre, AUTO-ROUTE around any shapes in between so a decision's No/loop-back branch never cuts straight through the boxes between source and target, and bound text auto-wraps + centres), routing? ('straight' default | 'elbow' for clean right-angle flowchart/org-chart connectors | 'curved'), startArrowhead?/endArrowhead? (arrowheads are SOLID filled triangles by default — just OMIT them. Pass null for a plain mind-map spoke with no head. Do NOT pass 'arrow': that is Excalidraw's open 'V' and is auto-upgraded to a solid triangle anyway), points? ([[0,0],[dx,dy]] relative, only for manual geometry — almost never needed; binding by id is better), props? (escape hatch: any other Excalidraw field) }. ARCHITECTURE ICONS: to place a software-architecture icon (AWS/Azure/GCP/Docker/Kubernetes/databases/etc.), first call listArchitectureIcons to find one, then add a spec { type:'image', iconPath:'', x, y, width:96, height:96, text?:'' } — the icon is stored as a URL reference (never base64). Use imageUrl instead of iconPath for any other public image. Combine icons with labelled boxes + elbow arrows for clean architecture diagrams. LIBRARY STENCILS: for hand-drawn, on-brand elements (scrum/kanban columns, flowchart symbols, UML/ER, BPMN, org-chart nodes, wireframe widgets, stick figures), FIRST call listWhiteboardStencils to find one, then add { type:'stencil', stencilKey:'', x, y } (or { type:'stencil', stencil:'', pack?:'', x, y } to fuzzy-match by name). A stencil is a mini-whiteboard (a collection of elements) of kind 'symbol' or 'template' (listWhiteboardStencils returns the kind + its embedded labels). For a SYMBOL (one atomic labelled node — flowchart box, BPMN task, org node), pass id + text + width/height: the label auto-fits its single slot and arrows bind to it via start/end {id}. For a TEMPLATE (a multi-component layout — Alerts, Forms, Tables, Charts), place it WHOLE (no single text); the result returns its children (id + text + colour + position) so you retext, recolour, or DELETE specific parts by id via updateWhiteboardScene (cluster children by y to act on a whole row/variant). STRONGLY prefer stencils over plain rectangles for wireframes/mockups, kanban/scrum boards, UML/BPMN, org charts; for dense flowcharts, plain shapes with bound text + elbow arrows are equally reliable. (For a plain sticky/post-it note use type:'sticky', NOT a stencil — there is no sticky-note stencil.) FRAMES: a frame is a NON-DESTRUCTIVE, ANY-SIZE container. To enclose shapes that ALREADY exist, add ONE type:'frame' sized to cover them (Excalidraw auto-captures elements inside a frame's bounds) or set those shapes' frameId — never recreate or delete-and-redraw content just to frame it. If a frame doesn't fully cover its content, just RESIZE the frame (patch its width/height). Deleting a frame (deleteIds:[frameId]) leaves all its contents intact on the canvas — it only removes the frame border + title. PRESENTATION/SLIDES: when the user wants a presentation or slide deck, create type:'frame' slides sized width:1280,height:720 (16:9), laid out LEFT-TO-RIGHT at the same y (x: 0, then 1440, 2880, 4320, …), each with a name (the slide title). Put every slide's shapes/text/images INSIDE its frame by setting their frameId to that frame's id (give the frame an id and reference it). Slides play in order (left-to-right, then top-to-bottom) in the board's Present mode and export to PPTX, so one frame = one slide. FLOWCHART recipe: rectangles (roundness null for sharp process boxes), diamonds for decisions, arrows with routing:'elbow' and Yes/No as the arrow's text. Use type 'sticky' for sticky/post-it notes (a solid-fill note with an auto-fitting bound label — set text + backgroundColor); type 'line' with no arrowheads + roughness:2 for sketchy mind-map spokes. FREEHAND DOODLES: to actually draw/doodle/sketch freehand, use { type:'freedraw', points } where points is a RELATIVE [[x,y],…] path of the stroke (e.g. a squiggle, circling or annotating something, a hand-drawn star/heart/smiley/arrow, an organic blob) — it renders as one smooth freehand stroke. x/y is the origin; omit x/y to auto-place. Chain several freedraw specs for a multi-stroke doodle. NOTE: freehand is always SOLID (Excalidraw ignores strokeStyle on freedraw) — colour, strokeWidth and opacity DO apply; a freedraw with strokeStyle:'dashed' or 'dotted' is automatically rendered as a smooth dashed/dotted line so the dashes actually show. Give shapes ids and reference them from connectors. Connectors may also bind to shapes ALREADY on the board by their id (get them via getWhiteboard includeElements:true) — you do NOT need to resend existing shapes; the server reads the live scene to bind the arrow and route it around the other boxes. Great for brainstorms, mind maps, flowcharts, org charts, SWOT, retros. PROCESS: for any non-trivial board call getWhiteboardGuide FIRST to plan it; then after adding, ALWAYS call getWhiteboardImage to SEE the result and check layout, labels, spacing, overlaps and how shapes connect — if anything looks off, fix it with updateWhiteboardScene (patch by id) and render again, iterating until it looks right. RESULT: returns added (count), placement (bounding box {x,y,width Agent View of the PolicyLayer registry record for `addWhiteboardElements`. HTML page: https://policylayer.com/tools/io-stablebaseline-sb/addwhiteboardelements ## Facts - Tool: `addWhiteboardElements` - Server: Stable Baseline (`https://api.stablebaseline.io/functions/v1/cloud-serve/mcp`) — https://policylayer.com/tools/io-stablebaseline-sb.md - Homepage: https://github.com/stablebaseline/mcp - Risk category: Write (Medium risk) - Registry record: grade F, identity unverified - Server auth posture: open - Server CORS policy: https://app.stablebaseline.io - Server rate-limited: no - Parameters: 2 (2 required) - Recommended policy verdict: Rate-limited ## Parameters | Parameter | Type | Required | Description | | --- | --- | --- | --- | | `shapes` | array | yes | Non-empty array of shape specs to append. Prefer stencils / sticky notes / architecture icons over raw rectangles wherever a standard form fits (see the `type` | | `documentId` | string | yes | | Parameters from the server's own tool schema. ## Example call (MCP tools/call, JSON-RPC 2.0) ```json { "jsonrpc": "2.0", "id": 1, "method": "tools/call", "params": { "name": "addWhiteboardElements", "arguments": { "shapes": [], "documentId": "" } } } ``` ## Why addWhiteboardElements is rated Medium addWhiteboardElements creates and modifies whiteboard diagrams by appending new shapes. This is a reversible modification (shapes can be deleted), not a destructive operation. It does not execute code, delete data, or move money. From the tool's own definition: "Tool description states: 'Author shapes onto a whiteboard', 'Appends to the canvas'. These are clear write operations that create new diagram elements. The tool modifies whiteboard content by adding new shapes." Risk signals: High parameter count (34 properties) ## Use case AI agents use addWhiteboardElements to create or update resources in Stable Baseline, usually the action step of a workflow, after the agent has gathered context. Every call changes real data in your Stable Baseline environment. ## Recommended policy (PolicyLayer) Verdict: **Rate-limited**. Enforced by the PolicyLayer MCP gateway (https://policylayer.com/mcp-gateway) before a call reaches Stable Baseline: ```json { "version": "1", "default": "deny", "tools": { "addWhiteboardElements": { "limits": [ { "counter": "addwhiteboardelements_rate", "window": "minute", "max": 30, "scope": "grant" } ] } } } ``` ## Other tools on Stable Baseline (195) - `cancelAllKgInScope` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/cancelallkginscope.md - `cancelKgBuildBatch` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/cancelkgbuildbatch.md - `deleteDiagramInDocument` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletediagramindocument.md - `deleteDocument` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletedocument.md - `deleteFolder` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletefolder.md - `deleteImageInDocument` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteimageindocument.md - `deleteImprovement` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteimprovement.md - `deleteImprovementCategory` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteimprovementcategory.md - `deleteImprovementComment` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteimprovementcomment.md - `deletePlan` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteplan.md - `deletePlanComment` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteplancomment.md - `deletePlanPhase` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteplanphase.md - `deleteResourcePermission` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteresourcepermission.md - `deleteTaskDependency` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletetaskdependency.md - `deleteTeam` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deleteteam.md - `deleteVegaDataFile` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletevegadatafile.md - `deleteWhiteboard` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/deletewhiteboard.md - `removeMember` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/removemember.md - `removeTeamMember` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/removeteammember.md - `removeWorkspaceMember` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/removeworkspacemember.md - `resetDocumentInBrain` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/resetdocumentinbrain.md - `revokeTeamWorkspaceAccess` — Destructive — https://policylayer.com/tools/io-stablebaseline-sb/revoketeamworkspaceaccess.md - `autoDesignWhiteboard` — Execute — https://policylayer.com/tools/io-stablebaseline-sb/autodesignwhiteboard.md - `renderDiagram` — Execute — https://policylayer.com/tools/io-stablebaseline-sb/renderdiagram.md - `startMeetingScribe` — Execute — https://policylayer.com/tools/io-stablebaseline-sb/startmeetingscribe.md - `stopMeetingScribe` — Execute — https://policylayer.com/tools/io-stablebaseline-sb/stopmeetingscribe.md - `triggerKgRebuild` — Execute — https://policylayer.com/tools/io-stablebaseline-sb/triggerkgrebuild.md - `applySubscriptionChange` — Financial — https://policylayer.com/tools/io-stablebaseline-sb/applysubscriptionchange.md - `cancelSubscription` — Financial — https://policylayer.com/tools/io-stablebaseline-sb/cancelsubscription.md - `getCustomerPortalLink` — Financial — https://policylayer.com/tools/io-stablebaseline-sb/getcustomerportallink.md - …and 165 more: https://policylayer.com/tools/io-stablebaseline-sb.md ## For agents This record is a snapshot. Live verdicts and the full registry: - Check every server in your MCP config at once: `npx -y policylayer stack` - Vet a server before you add it: install the mcp-precheck skill — `npx skills add https://policylayer.com` (skill text: https://policylayer.com/skill.md) - Query the registry over MCP: endpoint `https://api.policylayer.com/mcp` — tools `check_mcp_server`, `check_mcp_stack`, `check_tool`, `search_registry`, `get_change_events` --- Source: the PolicyLayer MCP registry — one continuously verified record per MCP server. Full record: https://policylayer.com/registry?q=io-stablebaseline-sb · API: https://policylayer.com/registry/api · Policy library: https://policylayer.com/policies/io-stablebaseline-sb