Connect your AI client to Barvinca
Use Barvinca's hosted MCP server to inspect ACC administration data and prepare approval-bound bulk user operations. The connection uses OAuth; do not paste Autodesk tokens, APS credentials, or a Client Secret into your AI client.
https://mcp.barvinca.com/mcp
Before you connect
- Sign in to Barvinca with Autodesk.
- Ask an ACC account administrator to authorize Barvinca's managed APS app in Autodesk Custom Integrations.
- Confirm the connection on the Barvinca dashboard or Settings page.
What you do not configure
- No personal APS application.
- No APS Client ID or Client Secret.
- No Autodesk access or refresh token.
- No static bearer token, API key, or custom authorization header.
Client compatibility
| Client | Status | Setup | OAuth and reconnect |
|---|---|---|---|
| Claude web and Desktop | Production verified | Remote custom connector in Claude account settings. | DCR, PKCE, consent, refresh, disconnect, and reconnect supported. Claude Desktop was verified against production. |
| Codex Desktop, CLI, and IDE | Official plugin | Install barvinca@barvinca once from the public Barvinca marketplace. | The plugin supplies the hosted endpoint and OAuth resource. Discovery, DCR, PKCE, consent, refresh, logout, and reconnect are supported. |
| ChatGPT web | Evaluation only | Custom app in developer mode for eligible Business, Enterprise, and Edu workspaces. | Barvinca issues refresh tokens but does not yet advertise offline_access. ChatGPT may require reauthentication after the original authorization expires. |
| Cursor | CLI production verified | Remote Streamable HTTP server in .cursor/mcp.json or global MCP settings. | Cursor Agent CLI completed production OAuth, catalog discovery, local disconnect, and reconnect. The desktop UI uses the same configuration but was not independently canaried. |
“Supported” means the client documents the required remote MCP and OAuth features; only rows marked “Production verified” have completed Barvinca's end-to-end login in that client. Claims are reviewed when client behavior or canary evidence changes.
Claude web and Claude Desktop
- Individual plans: open Customize > Connectors, click +, then choose Add custom connector.
- Team and Enterprise owners: open Organization settings > Connectors, click Add, then choose Custom > Web. Members connect the owner-provisioned connector from Customize > Connectors.
- Name the connector Barvinca, paste the endpoint above, and leave Advanced OAuth Client ID/Secret fields empty.
- Choose Connect. Sign in to Barvinca if prompted, inspect the requested permissions, and approve the OAuth consent page.
- In a conversation, use + > Connectors to enable Barvinca and only the tools needed for that task.
claude_desktop_config.json; that file is for locally launched servers.Codex Desktop, CLI, and IDE
Install the official Barvinca plugin from its public GitHub marketplace. The marketplace and plugin are global to your local Codex user profile on that machine, not tied to the project open in Codex:
codex plugin marketplace add dmytro-yemelianov/barvinca-codex-plugin
codex plugin add barvinca@barvincaRestart Codex Desktop after installation, open Plugins, select Barvinca, and authenticate when prompted. The plugin packages Barvinca's icon, hosted endpoint, and explicit OAuth resource identifier.
codex mcp add barvinca --url https://mcp.barvinca.com/mcp --oauth-resource https://mcp.barvinca.com/mcp. The --oauth-resource value prevents Codex from resuming an expired or mismatched browser authorization flow.Start read-only. Only if you need mutation preflights, explicitly replace the read-only grant with a read/write grant:
codex mcp logout barvinca
codex mcp login barvinca --scopes barvinca.read,barvinca.writeLive ACC Issues, RFIs, Assets, Submittals, and Forms reads are separately consented. Reconnect with only the domains you want:
codex mcp logout barvinca
codex mcp login barvinca --scopes barvinca.read,barvinca.issues.read,barvinca.rfis.read,barvinca.assets.read,barvinca.submittals.read,barvinca.forms.readThese live Autodesk reads are still read-only and use your signed-in Autodesk identity through Barvinca's managed integration. They never charge, grant, or refresh CREDS.
To return to read-only access, logout again and reconnect with only barvinca.read.
Use codex mcp remove barvinca only when you also want to delete the saved server configuration.
ChatGPT web
- Use an eligible Business, Enterprise, or Edu workspace. A workspace administrator must enable developer mode.
- Open Workspace settings > Apps > Create, or Settings > Apps > Create if your administrator authorized developer access.
- Enter the Barvinca endpoint, choose OAuth, then select Scan Tools.
- Complete Barvinca sign-in and consent, wait for the tool scan, then create the draft app.
- Open a new chat, select the draft Barvinca app, and confirm write actions when ChatGPT asks.
offline_access. Barvinca currently advertises and issues the refresh_token grant but does not advertise that scope, so ChatGPT may ask you to authenticate again. ChatGPT MCP apps are web-only and workspace-admin controlled.Cursor
Add this server to a project-level .cursor/mcp.json or to your global Cursor MCP configuration:
{
"mcpServers": {
"barvinca": {
"url": "https://mcp.barvinca.com/mcp"
}
}
}Open Cursor Settings > Tools & MCP, enable Barvinca, and complete the browser authorization prompt. Cursor Agent CLI users can verify the same project configuration with cursor-agent mcp login barvinca, cursor-agent mcp list, and cursor-agent mcp list-tools barvinca.
cursor-agent mcp disable barvinca is a local disconnect, not OAuth revocation. The current CLI has no logout command. To revoke the active Barvinca session grant, sign out of Barvinca, disable the connector, then start a fresh login when reconnecting.OAuth connection lifecycle
| Stage | What happens | If it fails |
|---|---|---|
| 1. Discovery | The client reads protected-resource metadata from mcp.barvinca.com, then discovers Barvinca's authorization server. | Confirm the endpoint is exact and the client supports remote Streamable HTTP MCP. |
| 2. Client registration | The client uses Dynamic Client Registration. No manually created OAuth client, Client ID, or Client Secret is needed. | Remove manually entered OAuth credentials and add the server again. |
| 3. Authorization with PKCE | The client creates a one-time S256 PKCE challenge and opens Barvinca's authorization page. | Restart connection from the client; never reuse an old authorization URL. |
| 4. Consent | Your signed-in Barvinca session selects one ACC account. Review barvinca.read, any requested ACC domain scopes, and barvinca.write only when mutations are needed. | If state expired, close the old tab and restart connection so the client generates fresh state. |
| 5. Tokens | The client exchanges the one-time code for a one-hour access token and a refresh token. Tokens contain Barvinca grant data, never Autodesk credentials. | If exchange fails, reconnect rather than pasting tokens into client settings. |
| 6. Refresh | A compatible client refreshes access until the refresh grant or underlying Barvinca session lease expires. | Sign in to Barvinca again and reconnect. |
| 7. Disconnect and revoke | Disconnect or logout in the client. Signing out of Barvinca also invalidates the server-side MCP session lease. | Remove the saved connector and add it again if the client retains stale state. |
| 8. Reconnect | The client repeats discovery, PKCE, and consent with new state. A read-only grant is never silently upgraded to write. | Request the needed scopes and approve the new consent screen. |
Transport and tenant security
| Boundary | What Barvinca enforces |
|---|---|
| Encrypted transport | HTTP redirects to HTTPS. Cloudflare's edge requires TLS 1.2 or newer, supports TLS 1.3, and adds HSTS, no-store, and browser security headers. |
| OAuth audience | Every grant is bound to the exact https://mcp.barvinca.com/mcp resource, registered OAuth client, signed-in Barvinca user, and selected ACC account. |
| Request boundary | Barvinca validates the Origin when a client supplies one, limits requests to 1 MiB, and applies separate edge, token, and OAuth rate limits. Native clients that do not send an Origin remain supported. |
| Private backend | The public MCP Worker reaches the Barvinca platform through a private Cloudflare service binding. The platform rechecks the session, grant, scope, account, and project before resolving encrypted Autodesk credentials; those credentials are never passed to the AI client. |
invalid_grant or Grant not found, disconnect or log out, then add or connect Barvinca again. Do not reuse the old browser approval URL.Evidence captures and exports
barvinca_domain_evidence captures one sanitized page of Issues, RFIs, Assets, Submittals, Forms, or form templates. The result includes capture time, Autodesk API family, pagination, and a canonical SHA-256 digest so an agent can preserve exactly what it inspected.
barvinca_domain_export writes that same bounded evidence page as JSON or formula-safe CSV to private Barvinca storage. Its download URL works only in a browser with the same signed-in Barvinca user and account; another user or account receives a not-found response.
hasMore is true, preserve the first artifact and repeat with nextCursor. Full-project file archives are not performed by these synchronous tools.Permissions and safe writes
barvinca.read
Required for connection status, cached ACC account/project/member reads, operation history, evidence, exports, and recovery status.
barvinca.issues.read
Required for live, read-only barvinca_issue_list and barvinca_issue_get calls. Project ownership is checked before Barvinca resolves your encrypted Autodesk session token.
barvinca.rfis.read
Required for live, read-only barvinca_rfi_list and barvinca_rfi_get calls. It does not grant Issue access or any mutation permission.
barvinca.assets.read
Required for live, read-only barvinca_asset_list and barvinca_asset_get calls. Asset custom attributes are excluded from hosted MCP output.
barvinca.submittals.read
Required for live, read-only barvinca_submittal_list and barvinca_submittal_get calls. Only bounded operational metadata is returned.
barvinca.forms.read
Required for live, read-only barvinca_form_list and barvinca_form_template_list calls. ACC Forms includes checklist-style workflows; field values and template definitions are excluded.
Each live-domain scope also gates that domain when selected in barvinca_domain_evidence or barvinca_domain_export. Evidence storage is private, does not grant access to a different domain, and never consumes CREDS.
barvinca.write
Required for preflight, execution, cancellation, retry preparation, and rollback preparation. A read-only grant is never silently upgraded: reconnect and explicitly approve write access when your client requests it.
Unsupported configurations
- Local-only MCP clients that cannot connect to a public Streamable HTTP endpoint.
- Clients that require a static API key, bearer token, or manually provisioned OAuth Client Secret.
- OAuth clients without authorization-server discovery, S256 PKCE, Dynamic Client Registration, and refresh-token support.
- ChatGPT mobile for custom MCP apps. Use an eligible ChatGPT workspace on the web.
- Customer-owned APS apps or Autodesk tokens. Barvinca uses its managed APS app after the ACC administrator approves the Custom Integration.
Troubleshooting and revocation
- Sign-in loop: sign in at barvinca.com in the same browser, then reconnect the connector.
- Consent state expired: do not click the old URL again. Close it and restart connection from the AI client to generate fresh state and PKCE values.
- Custom Integration required: an ACC account administrator must authorize Barvinca's managed app; return to Settings and verify it afterward.
- Insufficient scope: disconnect and reconnect so the client can request the required scope and show a fresh consent screen.
- Expired session: sign in to Barvinca again, then reconnect. The MCP token cannot outlive the underlying Barvinca session.
- Remove access: disconnect Barvinca in the client's connector or MCP settings. Signing out of Barvinca revokes the active server-side MCP session lease.