# Claude Code DTS MCP Plugin

Private Claude Code plugin for the DTS Engine gateway at
`https://192.168.50.170:8770/mcp`.

It lets Claude Code on macOS or Windows upload source data, queue Windows DTS
Engine 6.1 publishing jobs, monitor them, and download hash-verified 3DT
results. The plugin contains no DTS Engine binaries and no server secrets.

This is the Claude Code counterpart to
[`codex-dts-mcp-plugin`](https://github.com/zhouning/codex-dts-mcp-plugin),
which serves the same gateway to Codex on macOS. Both plugins can share the
same stored bearer token because they target the same gateway and the same
`DTS_MCP_TOKEN` environment variable.

## Prerequisites

- The client machine can route to `192.168.50.170:8770` through the private
  LAN or VPN.
- GitHub access can clone `zhouning/claudecode-dts-mcp-plugin`.
- Claude Code CLI is installed (`claude plugin --help` succeeds).
- The Windows DTS MCP gateway is healthy and DTS Engine is installed, licensed,
  and running in a logged-in interactive Windows session.
- You have the gateway Bearer Token through a secure channel.

Do not paste the token into a shell command. Both installers prompt without
terminal echo: `configure-macos.sh` stores it in the macOS login Keychain,
`configure-windows.ps1` stores it in Windows Credential Manager.

## Install On macOS

```bash
git clone git@github.com:zhouning/claudecode-dts-mcp-plugin.git
./claudecode-dts-mcp-plugin/plugins/dts-mcp/scripts/configure-macos.sh
```

The script imports only the public DTS MCP CA into the login Keychain, stores
the Bearer Token under service `dts-mcp`, installs a user LaunchAgent that
restores `DTS_MCP_TOKEN`, adds the `zhouning-dts` marketplace, installs
`dts-mcp@zhouning-dts`, and verifies the fixed health endpoint.

Verify with:

```bash
./claudecode-dts-mcp-plugin/plugins/dts-mcp/scripts/verify-connection-macos.sh
```

## Install On Windows

```powershell
git clone https://github.com/zhouning/claudecode-dts-mcp-plugin.git
.\claudecode-dts-mcp-plugin\plugins\dts-mcp\scripts\configure-windows.ps1
```

The script stores the Bearer Token as a Generic Credential in Windows
Credential Manager under target `dts-mcp`, persists `DTS_MCP_TOKEN` as a user
environment variable and broadcasts the change so new processes see it,
trusts the bundled CA in `Cert:\CurrentUser\Root`, adds the `zhouning-dts`
marketplace, installs `dts-mcp@zhouning-dts`, and verifies the fixed health
endpoint.

Verify with:

```powershell
.\claudecode-dts-mcp-plugin\plugins\dts-mcp\scripts\verify-connection-windows.ps1
```

Restart Claude Code and open a new session after installation on either
platform.

## Update

```bash
git -C claudecode-dts-mcp-plugin pull --ff-only
claude plugin marketplace update zhouning-dts
claude plugin install dts-mcp@zhouning-dts
```

Restart Claude Code and use a new session after an update.

## Rotate The Bearer Token

Rotate the token on the Windows gateway first, then run:

```bash
./claudecode-dts-mcp-plugin/plugins/dts-mcp/scripts/configure-macos.sh --rotate-token
```

```powershell
.\claudecode-dts-mcp-plugin\plugins\dts-mcp\scripts\configure-windows.ps1 --rotate-token
```

## Refresh The CA

After the Windows host address or DTS MCP CA changes, update the checkout and
run:

```bash
git -C claudecode-dts-mcp-plugin pull --ff-only
./claudecode-dts-mcp-plugin/plugins/dts-mcp/scripts/configure-macos.sh --refresh-ca
./claudecode-dts-mcp-plugin/plugins/dts-mcp/scripts/verify-connection-macos.sh
```

```powershell
git -C claudecode-dts-mcp-plugin pull --ff-only
.\claudecode-dts-mcp-plugin\plugins\dts-mcp\scripts\configure-windows.ps1 --refresh-ca
.\claudecode-dts-mcp-plugin\plugins\dts-mcp\scripts\verify-connection-windows.ps1
```

The refresh does not read or rewrite the Bearer Token. Discard signed URLs
issued before an endpoint or signing-key change.

## Remove

macOS:

```bash
claude plugin uninstall dts-mcp
claude plugin marketplace remove zhouning-dts
launchctl bootout "gui/$UID/com.dts.mcp.token" 2>/dev/null || true
rm -f "$HOME/Library/LaunchAgents/com.dts.mcp.token.plist"
rm -rf "$HOME/Library/Application Support/dts-mcp"
security delete-generic-password -a "$USER" -s dts-mcp
launchctl unsetenv DTS_MCP_TOKEN
```

Windows:

```powershell
claude plugin uninstall dts-mcp
claude plugin marketplace remove zhouning-dts
[Environment]::SetEnvironmentVariable('DTS_MCP_TOKEN', $null, 'User')
cmdkey /delete:dts-mcp 2>$null
```

Remove the `DTS MCP Local CA` certificate from the login Keychain
(`security delete-certificate`) or `Cert:\CurrentUser\Root`
(`Remove-Item`) only after confirming its fingerprint.

## Publishing Constraints

- Only `road` is verified end to end.
- Road inputs require a projected CRS and `domPath`; a matching DEM is strongly
  recommended.
- OSGB publishing requires both stages and must use `dts_publish_osgb`.
- Remote path flags use artifact IDs and artifact-relative paths, never Windows
  paths.
- Upload and download bytes use signed HTTPS URLs without the Bearer Token.
- The remote gateway registers 14 tools; `dts_validate` remains local-only.
- A successful result ZIP must retain both its `.3dt` data and
  `DataInfor.txt`.

## Troubleshooting Order

1. Confirm private routing to `192.168.50.170:8770`.
2. Confirm the Windows host is logged in and the DTS MCP gateway is healthy.
3. Run the platform's `verify-connection-*` script and fix the first failed
   layer.
4. Use `--rotate-token` for authentication failures.
5. Use `--refresh-ca` after an address or certificate change.
6. Confirm `dts-mcp` appears in `claude plugin list`.
7. Confirm `dts` appears in `claude mcp list`.
8. Start a new Claude Code session and call `dts_ping`.

## Verification Status

- DTS server remote gateway implementation and its own remote smoke test: not
  re-verified from this repository; see `zhouning/dts-mcp-server`.
- Plugin manifests, Skill, certificate, script syntax, and secret checks: covered
  by this repository's tests.
- Windows Credential Manager and macOS Keychain acceptance is pending on
  target machines.
- Do not report end-to-end plugin success until a target machine completes a
  real road upload, publish, download, and SHA-256 verification.