Back to Browse

Autodesk Revit MCP Server

Developer ToolsUse Caution1.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

MCP server connecting AI assistants to Autodesk Revit through a local bridge.

About

MCP server connecting AI assistants to Autodesk Revit through a local bridge.

Security Report

1.2
Use Caution1.2Critical Risk

This Revit MCP server contains several critical security vulnerabilities that pose significant risks. The most severe issues are: (1) an arbitrary Python code execution tool (`revit_execute_python`) that runs without validation or sandboxing, (2) unrestricted reflection-based API access (`revit_invoke_method`, `revit_reflect_get/set`) allowing any .NET code execution, (3) no authentication or authorization controls despite the README claiming optional OAuth2, and (4) dangerous filesystem operations (CSV/file export) without path validation. While the server's core architecture and HTTP bridge design are reasonable, the "power tools" batch of capabilities fundamentally bypass security boundaries and should not be exposed to untrusted AI clients. Supply chain analysis found 4 known vulnerabilities in dependencies (0 critical, 3 high severity).

3 files analyzed · 16 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

Shell Command Execution

Runs commands on your machine. Be cautious — only use if you trust this plugin.

process_spawn

Check that this permission is expected for this type of plugin.

system_info

Check that this permission is expected for this type of plugin.

arbitrary_code_execution

Check that this permission is expected for this type of plugin.

Unverified package source

We couldn't verify that the installable package matches the reviewed source code. Proceed with caution.

What You'll Need

Set these up before or after installing:

Workspace root directory for server file operations.Optional

Environment variable: MCP_REVIT_WORKSPACE_DIR

Semicolon-delimited allow-list of directories the server can access.Optional

Environment variable: MCP_REVIT_ALLOWED_DIRECTORIES

Server mode: mock or bridge.Optional

Environment variable: MCP_REVIT_MODE

Bridge URL, for example http://127.0.0.1:3000 (required when MCP_REVIT_MODE=bridge).Optional

Environment variable: MCP_REVIT_BRIDGE_URL

Path to the audit log file.Optional

Environment variable: MCP_REVIT_AUDIT_LOG

Python log level, for example INFO or DEBUG.Optional

Environment variable: MCP_REVIT_LOG_LEVEL

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-sam-aec-autodesk-revit-mcp-server": {
      "env": {
        "MCP_REVIT_MODE": "your-mcp-revit-mode-here",
        "MCP_REVIT_AUDIT_LOG": "your-mcp-revit-audit-log-here",
        "MCP_REVIT_LOG_LEVEL": "your-mcp-revit-log-level-here",
        "MCP_REVIT_BRIDGE_URL": "your-mcp-revit-bridge-url-here",
        "MCP_REVIT_WORKSPACE_DIR": "your-mcp-revit-workspace-dir-here",
        "MCP_REVIT_ALLOWED_DIRECTORIES": "your-mcp-revit-allowed-directories-here"
      },
      "args": [
        "revit-mcp-server"
      ],
      "command": "uvx"
    }
  }
}

Reviews

No reviews yet

Be the first to review this server!