CAD-MAX
Connects to AutoCAD for read-only status and health checks, with future capabilities for DWG file operations.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@CAD-MAXwhat is the status of the current drawing?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
CAD-MAX
CAD-MAX is a safety-first foundation for connecting an MCP client to AutoCAD through a Python MCP server and a localhost C# bridge.
Current version: 0.1.0. Phase 0 repository bootstrap is complete. Phase 1 is active; its plan/governance batch is accepted, and the plugin-bootstrap batch has not started.
Project governance / 项目治理
当前 Phase、下一允许动作和安全能力状态以
current status 顶部的 cad-max-current-authority 区块为唯一
authority。事实源职责、文档预算、验证证据和 CI 生命周期见
current docs。任何 CI 绿色都不表示真实 AutoCAD 或 DWG 能力已实现。
Related MCP server: AutoCAD MCP Server - Codex Edition
Current real completion
Implemented now:
Python 3.12 package cad-max-mcp with stdio and Streamable HTTP transports.
MCP tools cad_system for health, version, and capabilities.
MCP tool drawing with the read-only status operation.
NullCadBackend for machines without AutoCAD.
AutoCadBridgeBackend with bounded localhost HTTP calls and structured failures.
Shared versioned JSON contracts and matching Python/C# models.
.NET 8 bridge dispatcher, localhost development Host, and test suite.
A compilable net8.0-windows AutoCAD plugin boundary with no Autodesk references.
Read-only, write-disabled, script-disabled, loopback-only defaults.
Not implemented:
Real AutoCAD attachment.
Reading a live drawing.
Creating, modifying, saving, exporting, or validating DWG content.
Any script, AutoLISP, arbitrary code, write, or remote-network tool.
CAD-MAX does not currently modify DWG files. When no bridge is configured, drawing status returns BACKEND_NOT_CONFIGURED. The development bridge has no AutoCAD command handlers, so an unknown command returns NOT_IMPLEMENTED rather than fake success.
Architecture
MCP client
|
| stdio or Streamable HTTP at 127.0.0.1:47771/mcp
v
Python cad-max-mcp
|
| localhost HTTP and versioned JSON
v
C# CadMax.Bridge.Host at 127.0.0.1:47770
|
| future AutoCAD Managed .NET API adapter
v
AutoCAD 2025 or 2026 plugin
|
v
2D DWG document contextPython owns the MCP protocol and client-facing validation. C# will own all future AutoCAD execution because Autodesk's supported managed API, application context, and document context belong inside the AutoCAD process. See Architecture and ADR 0001.
Supported baseline
Windows 10 or 11 for the future AutoCAD bridge.
Python 3.12.
uv.
.NET 8 SDK.
AutoCAD 2025 or 2026 for future plugin integration.
2D DWG scope only.
AutoCAD 2024, AutoCAD LT, ZWCAD, GstarCAD, Tianzheng, SolidWorks, FreeCAD, 3D modeling, and cloud batch processing are explicitly outside this phase.
Local setup
Install Python 3.12, uv, and the .NET 8 SDK. Then run:
uv sync --frozen
uv run cad-max-mcp doctorThe doctor command emits structured JSON and returns exit code 0 when the safe base configuration is valid.
Start the MCP server
Stdio:
uv run cad-max-mcp serve --transport stdioStreamable HTTP:
uv run cad-max-mcp serve --transport streamable-httpThe HTTP endpoint is http://127.0.0.1:47771/mcp. Configuration rejects 0.0.0.0 and other non-loopback hosts.
PowerShell wrappers are also available:
.\scripts\run-mcp-stdio.ps1
.\scripts\run-mcp-http.ps1Start the development bridge
The bridge does not require AutoCAD and exposes only health, capabilities, and a fail-closed command dispatcher:
dotnet run --project src/dotnet/CadMax.Bridge.HostEndpoints:
No CAD command handler is registered in Phase 0.
Test and verify
Python:
uv sync --frozen
uv run ruff check .
uv run ruff format --check .
uv run mypy src/python
uv run pytest.NET:
dotnet restore src/dotnet/CadMax.sln --locked-mode --configfile NuGet.Config
dotnet build src/dotnet/CadMax.sln --configuration Release --no-restore
dotnet test src/dotnet/CadMax.sln --configuration Release --no-buildUnified PowerShell verification:
.\scripts\verify.ps1The script stops with a non-zero exit code on the first failed check.
MCP client configuration example
Replace the path with your local checkout:
{
"mcpServers": {
"cad-max": {
"command": "uv",
"args": [
"--directory",
"C:\\path\\to\\CAD-MAX",
"run",
"cad-max-mcp",
"serve",
"--transport",
"stdio"
]
}
}
}More examples are in MCP client setup.
Configuration and safe defaults
Environment variables use the CAD_MAX_ prefix. The committed .env.example contains names and safe example values only. A real .env file is ignored and is not loaded implicitly by the application.
readOnly is true.
allowWrite is false.
allowScript is false.
httpHost is 127.0.0.1.
allowedRoots is empty.
bridgeUrl is unset.
Future file operations must normalize an absolute path and prove it is inside an allowed root. An empty allowlist grants no file access.
Why Autodesk DLLs are not in this repository
AcDbMgd.dll, AcMgd.dll, AcCoreMgd.dll, Autodesk SDK files, and AutoCAD redistributables are proprietary and installation-specific. They must be referenced from a licensed local AutoCAD installation through uncommitted machine-local MSBuild configuration. CI does not install AutoCAD and does not need these DLLs. See AutoCAD SDK setup.
Security warning
CAD automation can alter valuable drawings. Keep the HTTP services on loopback, keep writes and scripts disabled, never expose the development Host through a tunnel, and work on backed-up test drawings when a future write phase is enabled. See Security model.
Roadmap
The ordered delivery plan is in ROADMAP.md. Phase 1 will establish a real AutoCAD 2025/2026 connection and lifecycle boundary without enabling arbitrary DWG editing. The executable read-only scope and numbered work batches are in the Phase 1 AutoCAD Connection plan; that plan does not replace current authority.
License
MIT. See LICENSE.
Available Tools
2 toolscad_systemC
Inspect health, version, or the truthful capability inventory.
| Name | Required | Description | Default |
|---|---|---|---|
| operation | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | Yes | |
| status | Yes | |
| message | Yes | |
| success | Yes | |
| traceId | Yes | |
| warnings | No | |
| errorCode | No | |
| requestId | Yes | |
| durationMs | No | |
| schemaVersion | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden, and it doesn't state that these are read-only/safe inspection operations, whether any call has side effects, or any auth/rate considerations. The odd qualifier 'truthful capability inventory' hints at something meaningful about capability reporting but is never explained.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence, front-loaded with the verb and the three kinds of information available, so there is no wasted text. The phrase 'truthful capability inventory' is slightly cryptic relative to its length, but the sentence is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (one enum param) and an output schema exists, so return-value explanation is not required. However, the description leaves the read-only/safety character of the operations and the distinction from the sibling 'drawing' tool unstated, which for a no-annotation tool is a gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and there is one enum parameter, but the enum values are self-explanatory; the description merely restates 'health, version, capabilities'. It adds slight nuance to the 'capabilities' value with 'truthful capability inventory' but no format or selection guidance beyond the enum itself.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a clear verb ('Inspect') plus the resources it can report on (health, version, capability inventory), which an agent can map directly onto the operation enum. It does not, however, differentiate this tool from its sibling 'drawing' or explain how cad_system relates to drawing work.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisites, and no mention of the sibling tool 'drawing' as an alternative. The only usage signal is the implied match between the three listed nouns and the operation enum, which the schema already carries.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
drawingC
Inspect only allowlisted read-only document metadata through the AutoCAD bridge.
| Name | Required | Description | Default |
|---|---|---|---|
| operation | Yes | ||
| deadline_ms | No | ||
| expected_document_id | No | ||
| expected_instance_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | Yes | |
| status | Yes | |
| message | Yes | |
| success | Yes | |
| traceId | Yes | |
| warnings | No | |
| errorCode | No | |
| requestId | Yes | |
| durationMs | No | |
| schemaVersion | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses read-only operation, allowlisted access, and inspection-only scope, but omits auth requirements, rate limits, mutation guarantees, and per-operation behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The definition is a single front-loaded sentence with no filler. It is appropriately compact, though sparse given the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with seven enum operations, four parameters, no annotations, and no schema descriptions, the description provides only a high-level safety scope. It leaves invocation details and guard-parameter semantics unstated, though an output schema exists so return values need not be explained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for four parameters. The description adds no parameter-level meaning: it does not explain the operation enum values, expected_document_id, expected_instance_id, or deadline_ms. It fails to compensate for the undocumented schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Inspect') and resource ('read-only document metadata') with scope ('allowlisted') and the bridge context. It does not differentiate this tool from the sibling cad_system, but the core purpose is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives, no prerequisites, and no exclusions. The phrase 'Inspect only allowlisted read-only document metadata' implies a safe read context but does not tell an agent when to select this tool over cad_system or other options.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v0.1.0- First observed
cad_system - First observed
drawing
TDQS
Scored across 2 tools
cad_system targets server health/version/capability inventory, while drawing targets allowlisted read-only document metadata. They are mostly distinct, though both are read-only inspection tools and could be momentarily confused.
The names use mixed conventions: cad_system is a prefixed snake_case compound, while drawing is a bare noun. Both are readable, but there is no consistent verb_noun or noun_noun pattern.
Two tools is far too thin for a CAD server; the surface only supports introspection and metadata inspection. It lacks the operation breadth expected for CAD-MAX.
The server only exposes system health and read-only drawing metadata, with no create, modify, delete, export, or geometry query operations. This is severely incomplete for a CAD domain.
Maintenance
Related MCP Connectors
MCP server for Codat — companies, connections, invoices, bills and financial statements.
Remote MCP server to read and manage your Atako AI agents, messages, files, and integrations.
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
Trust checks for MCP servers: trust scores, tool-drift detection, signed diligence receipts. Free.
Related MCP Servers
- FlicenseNot gradedqualityCmaintenanceMCP server that connects an LLM assistant to Autodesk Civil 3D via COM, enabling direct manipulation of surfaces, alignments, COGO points, layers, profiles, and more through natural language.-
- AlicenseAqualityAmaintenanceMCP server for full AutoCAD automation, AutoCAD LT automation, and headless DXF generation. It provides 8 consolidated tools for drawing, entity, layer, block, annotation, P&ID, view, and system operations via MCP stdio transport.1223MIT
- AlicenseAqualityCmaintenanceMCP server for AutoCAD LT automation and headless DXF generation, exposing tools for drawing, entities, layers, blocks, annotations, P&ID, and view operations via natural language.8MIT
- AlicenseAqualityCmaintenanceAn MCP server that enables natural-language control of AutoCAD via file IPC or headless DXF generation, with tools for drawing, entities, layers, blocks, annotations, P&ID, views, and system operations.8MIT