# Give AI useful ACC tools, not raw API access. Barvinca MCP Barvinca's hosted Model Context Protocol server lets Claude, Codex, Cursor, and compatible AI clients inspect Autodesk Construction Cloud data and prepare controlled administration work through narrow, typed, account-bound tools. [Install Barvinca](#install) [Compare with OpenAPI](#comparison) **Endpoint**`https://mcp.barvinca.com/mcp` ## Every request passes through Barvinca controls - 1 **Identity and consent** — OAuth scopes bind the client to your signed-in Barvinca session. - 2 **Account authorization** — The requested ACC account must match the account verified for the session. - 3 **Purpose-built tools** — No generic HTTP passthrough and no arbitrary Autodesk endpoint execution. - 4 **Approval-bound writes** — An immutable preflight and exact digest are required before execution. - **30** — focused MCP tools - **7** — independent OAuth scopes - **50** — maximum records or write items per call - **0** — Autodesk secrets shared with the AI client Choose your AI client ## Install Barvinca where you work. You select the agent application—Codex, Claude, Cursor, or another compatible MCP client. The language model remains a setting inside that application; Barvinca installs the same account-bound tools regardless of the model you choose. ![](/icons/barvinca-icon-192.png) ### Codex Desktop, CLI, and IDE Recommended Install the official Barvinca plugin globally. It includes the correct icon, hosted MCP endpoint, and OAuth resource so Codex can complete sign-in without a stale Safari approval loop. `codex plugin marketplace add dmytro-yemelianov/barvinca-codex-plugin codex plugin add barvinca@barvinca` [View plugin on GitHub](https://github.com/dmytro-yemelianov/barvinca-codex-plugin)[Codex setup](/help/mcp.md#codex) ![](/icons/barvinca-icon-192.png) ### Claude, Cursor, and other clients Remote MCP connection Add Barvinca as a remote Streamable HTTP MCP server. Compatible clients discover OAuth automatically; do not paste Autodesk tokens, APS credentials, or a Client Secret. `https://mcp.barvinca.com/mcp` [Choose client instructions](/help/mcp.md)[Review security](/security.md) The Codex plugin is installed for your local Codex user profile on that machine, not into the Rapsody project or any individual repository. Repeat the install in other environments, and restart Codex Desktop so the marketplace label and icon cache refresh. What MCP changes ## A protocol designed around tools an AI can discover and use. MCP is a standard connection between an AI client and a tool server. Instead of teaching every model how to construct Autodesk HTTP requests, Barvinca publishes named tools with descriptions, validated inputs, structured outputs, and safety annotations. ### Discoverable The client receives a live catalog of purpose-built tools such as project listing, Issue evidence, user-add preflight, execution, cancellation, and recovery status. ### Structured Inputs and outputs use explicit schemas. Pagination, identifiers, supported actions, and result shapes are bounded instead of being inferred from a generic API description. ### State-aware Tools can enforce Barvinca session state, ACC account ownership, OAuth scopes, operation lineage, CREDS accounting, and durable workflow status on the server. MCP vs OpenAPI + LLM ## OpenAPI describes endpoints. Barvinca MCP delivers a controlled workflow. OpenAPI remains excellent for documenting and generating conventional API clients. It can be secured well. The difference is that a schema alone does not provide Barvinca's account policy, approval lifecycle, billing reconciliation, or operation evidence. | Concern | Plain OpenAPI exposed to an LLM | Barvinca MCP | | --- | --- | --- | | **Interface** | The model chooses paths, methods, parameters, and often must interpret a large generic schema. | **Thirty named tools** express the supported jobs directly. | | **Authentication** | Each integration must build secret storage, OAuth discovery, token refresh, and tenant binding around the schema. | **Hosted OAuth** with Dynamic Client Registration and S256 PKCE; no Client Secret or Autodesk token is pasted into the AI client. | | **Least privilege** | A broad API credential may make every documented endpoint reachable unless an additional gateway narrows it. | **Separate read domains and write scope**; every tool checks its required permission server-side. | | **Writes** | A valid request can become an immediate mutation unless the application adds its own review protocol. | **Preflight first**, then human review, then an exact approval digest to execute the immutable plan. | | **Retries** | An LLM retry can accidentally repeat a mutation unless idempotency is designed across the entire integration. | **Idempotency is built in**; replaying an approved execution returns the original operation without another dispatch or charge. | | **Results** | Large raw payloads increase context use and may expose fields the task did not need. | **Bounded, sanitized output** with cursor pagination and domain-specific field selection. | | **After execution** | Audit evidence, recovery, cancellation, and billing usually require separate systems. | **One operation model** exposes item outcomes, approval lineage, CREDS, safe event timelines, exports, and recovery guidance. | **The honest distinction:** MCP is not automatically safer than OpenAPI. Barvinca is safer because the MCP server enforces narrow tools, scoped consent, tenant checks, approval-bound writes, idempotency, limits, and evidence at execution time. Trust boundary ## Your AI client never becomes an Autodesk credential holder. The client receives a Barvinca MCP grant. Autodesk access stays inside Barvinca's managed integration and is resolved only after the signed-in session, grant, scope, account, and project checks succeed. - **AI client** — Chooses a named tool and sends validated arguments. - **Barvinca OAuth** — Validates the bearer grant, requested scope, and active session lease. - **MCP policy layer** — Checks account ownership, project context, limits, and tool contract. - **Operation layer** — Handles preflights, approvals, workflows, CREDS, evidence, and recovery. - **Autodesk ACC** — Receives only an authorized, supported read or approved mutation. Security and safety ## Controls are enforced by the server, not left to the model's judgment. Tool descriptions and annotations help an AI client behave well. Barvinca does not treat those hints as security. Authorization, validation, approval, execution, accounting, and evidence checks happen behind the MCP boundary. ### Encrypted, bounded transport HTTP redirects to HTTPS at Cloudflare's edge. TLS 1.2 is the minimum and TLS 1.3 is enabled, with HSTS, no-store responses, strict Origin validation when a client supplies an Origin, a 1 MiB request limit, and separate edge, token, and OAuth abuse limits. ### Resource-bound private backend Every grant is bound to the exact MCP resource, registered OAuth client, Barvinca user, and ACC account. The public MCP Worker reaches the platform through a private Cloudflare service binding, and Autodesk credentials never become MCP bearer tokens. ### OAuth without pasted secrets Remote clients use authorization-code OAuth, Dynamic Client Registration, and S256 PKCE. Implicit flow, plain PKCE, and token-exchange grants are disabled. ### Least-privilege consent `barvinca.read`, five ACC domain-read scopes, and `barvinca.write` are independent. Read-only access is never silently upgraded to write. ### Tenant and project binding The ACC account must match the one verified for the Barvinca session. Live domain reads also verify that the requested project belongs to that account. ### No raw API escape hatch The hosted MCP catalog contains supported Barvinca workflows. It does not expose an arbitrary URL, method, headers, or generic Autodesk HTTP request tool. ### Bounded data access List and evidence calls return at most 50 records per page. Sensitive or high-volume domain fields are intentionally excluded, and clients must follow explicit cursors. ### Approval cannot drift Mutation review produces a SHA-256 approval digest for an immutable, expiring plan. Execution rejects the wrong account, changed plan, expired plan, or mismatched digest. ### Safe replay and cancellation Idempotency prevents duplicate dispatch and duplicate CREDS charges. Cancellation refunds items proven not to have reached Autodesk while treating uncertain in-flight outcomes conservatively. ### Evidence and recovery Owned operations expose outcomes, approval lineage, CREDS reconciliation, bounded event history, private exports, workflow health, staleness, and the safest next action. Safe write lifecycle ## An AI can prepare a change. It cannot skip the review boundary. Adding or removing ACC project members and updating roles use one controlled lifecycle. Retry and rollback do not reuse old authority; they generate a new plan and require a new approval. 1 ### Prepare The client submits 1–50 intended changes with a request-specific idempotency key. 2 ### Preflight Barvinca validates account, projects, users, roles, limits, and expected CREDS without changing ACC. 3 ### Review The human reviews the exact bounded plan and authorizes its unexpired SHA-256 digest. 4 ### Execute Barvinca reserves CREDS and dispatches the immutable plan through a durable workflow. 5 ### Prove Item results, lineage, billed/refunded CREDS, events, exports, and recovery status remain inspectable. Current capability ## Focused coverage for real ACC administration and evidence work. The catalog favors small, composable reads plus higher-level safety workflows for mutations. This keeps common tasks discoverable without turning the server into a raw Autodesk proxy. ### Connection and directory Verify access and navigate the authorized account context. connectionaccountsprojectsmembersroles ### Live ACC domains Bounded reads from supported project domains using separately consented scopes. IssuesRFIsAssetsSubmittalsForms ### Evidence Capture sanitized pages with provenance, pagination, and canonical SHA-256 digests. JSONformula-safe CSVprivate download ### Operation insight Inspect owned operations, item outcomes, approval lineage, CREDS, and safe event history. listdetailevidenceexport ### Approval-bound mutations Prepare controlled membership and role changes, then execute only an approved plan. add userremove userupdate role ### Recovery controls Cancel safely, inspect workflow health, and prepare a newly approved retry or rollback. cancelrecoveryretryrollback ### Secure does not mean autonomous. Barvinca reduces credential exposure, tenant confusion, unbounded requests, duplicate writes, and untraceable execution. It does not make an LLM infallible or replace an ACC administrator's responsibility to review consequential changes. - Autodesk permissions still determine what the signed-in user and Barvinca integration can access. - An AI can still misunderstand a request, select the wrong read tool, or produce an incomplete analysis. - Human review remains required before providing the approval digest for a write. - Tool annotations inform compatible clients; Barvinca's server-side checks are the actual enforcement boundary. - Only the documented tools and ACC domains are supported. MCP does not grant blanket access to Autodesk APIs. Questions ## What teams usually ask first. ### Do users create their own APS application? No personal APS application is required. Barvinca uses its managed APS application after an ACC administrator authorizes the Barvinca Client ID in Autodesk Custom Integrations. ### Does the AI client receive Autodesk tokens? No. The client receives a scoped Barvinca OAuth grant. Autodesk access and refresh tokens stay inside Barvinca and are never returned through MCP. ### Can a read-only client make changes? No. Mutation preflights, execution, cancellation, retry preparation, and rollback preparation require an explicitly consented `barvinca.write` grant. ### Does a preflight consume CREDS? No. Preflight validates and estimates only. Execution reserves CREDS for actionable items; proven undispatched cancellations are refunded. ### Can the LLM call any Autodesk endpoint? No. Barvinca exposes a fixed catalog of typed tools. There is no generic HTTP or arbitrary Autodesk API passthrough in the hosted MCP server. ### Which clients can connect? Claude, Codex surfaces, Cursor, and compatible remote Streamable HTTP MCP clients. The connection guide records which clients have completed production verification and any current limitations. Connect safely ## Start read-only. Add only the scopes your workflow needs. Use the client-specific guide for Claude, Codex, ChatGPT, and Cursor. It covers setup, scope selection, reconnecting, revocation, Custom Integration, and troubleshooting. [Open connection guide](/help/mcp.md)[Sign in to Barvinca](/auth/login)[Security overview](/security.md) Remote Streamable HTTP endpoint`https://mcp.barvinca.com/mcp` --- Canonical HTML: https://barvinca.com/mcp