1. Service Scope
Barvinca is a hosted web application and Model Context Protocol service for supported Autodesk Platform Services and Autodesk Construction Cloud workflows, including controlled Bulk User Manager operations.
Barvinca is independent from Autodesk and uses Autodesk APIs only as authorized by customers and supported by Autodesk Platform Services.
2. Authentication And Authorization
- Browser users authenticate through Autodesk OAuth. Remote MCP clients use authorization-code OAuth with Dynamic Client Registration and S256 PKCE.
- Each MCP grant is bound to the exact MCP resource, registered OAuth client, signed-in Barvinca user, and selected ACC account.
- Independent read-domain and write scopes are enforced server-side. A read-only grant is never silently upgraded to write.
- Customer-directed Autodesk workflows require appropriate Autodesk account and project permissions.
- CREDS balance and subscription entitlements are enforced server-side where applicable.
- Administrative tools are separated from customer-facing routes.
3. Credential Handling
- Barvinca does not handle Autodesk passwords, and customers do not paste APS Client Secrets or Autodesk tokens into AI clients.
- Stored Autodesk access and refresh credentials are encrypted at rest.
- A Barvinca MCP bearer token is never forwarded to Autodesk, and Autodesk credentials never become MCP bearer tokens.
- Credentials are used only to perform customer-directed workflows.
- Disconnecting a client or signing out of Barvinca invalidates the applicable server-side MCP session grant.
4. Transport Security
Barvinca public endpoints enforce HTTPS and redirect HTTP requests to HTTPS. Cloudflare's edge requires TLS 1.2 or newer and supports TLS 1.3. MCP responses use HTTP Strict Transport Security, no-store caching, and browser security headers.
The MCP gateway validates the Origin header when a client supplies one, rejects requests larger than 1 MiB, and applies separate edge, bearer-token, and OAuth abuse limits. Native clients that do not send an Origin remain supported. Secrets should never be sent through email or support tickets.
5. Data Protection
Barvinca protects customer data with tenant and project access checks, encrypted credential storage, bounded responses, private exports, rate limiting, abuse protections, audit records, preflight previews, and operation history.
6. Infrastructure
The hosted service runs on Cloudflare Workers and related managed storage and routing services. The public MCP gateway reaches the Barvinca platform through a private Cloudflare service binding. Before an Autodesk API request, the platform independently rechecks the session, grant, scope, ACC account, and project authorization.
7. Logging And Monitoring
Barvinca may log bounded request metadata, operation IDs, tool usage, redacted error classes, event status, rate-limit decisions, and security-relevant events for debugging, abuse prevention, reliability, and support. Barvinca does not log APS Client Secrets, OAuth tokens, passwords, private keys, or complete sensitive payloads.
8. Bulk Operation Safety
Supported mutations use bounded preflight plans, explicit human review, an exact expiring approval digest, idempotent execution, item-level tracking, conservative cancellation, CREDS reconciliation, exportable results, and recovery evidence. Retry and rollback create a new plan and require new approval.
9. MCP And AI Assistant Use
Barvinca MCP exposes a fixed, typed tool catalog rather than a generic HTTP passthrough. Tool annotations guide clients but are not treated as a security boundary; authorization, input validation, tenant isolation, scope checks, bounded output, and approval-bound writes are enforced by the service.
See the MCP product and trust page and MCP setup and security guide for the current public endpoint, supported clients, permission scopes, and reconnect instructions.
10. Vulnerability Disclosure
Report suspected vulnerabilities to security@barvinca.com. Please include affected URL or feature, steps to reproduce, security impact, and any relevant logs or screenshots with secrets removed.
11. Shared Responsibility
Barvinca is responsible for operating the hosted service securely. Customers are responsible for managing Autodesk accounts, licenses, permissions, authorized users, credentials, devices, dry-run review, internal approvals, and compliance with Autodesk terms and applicable laws.