How do I install Iqms?

Iqms is a local plugin. Install it using the provided package and add the generated configuration snippet to your AI app's MCP config file. Then restart your AI app.

Yes. Iqms passed MCP Marketplace's automated security scan with a score of 7.4/10 (low risk). Every server on MCP Marketplace is security-scanned before it's listed; see the full security report on this page for the findings and permissions.

What credentials does Iqms need?

Iqms requires the following credentials or environment variables: IQMS_ORACLE_CONNECT_STRING, IQMS_ORACLE_USER, IQMS_ORACLE_PASSWORD, MCP_TRANSPORT, AUTH_MODE, LOG_LEVEL. You can find setup instructions on the server detail page.

What AI apps work with Iqms?

Iqms uses the Model Context Protocol (MCP) and works with any MCP-compatible AI app, including Claude, ChatGPT / Codex, Gemini, Copilot, Cursor, and more.

Back to Browse

Iqms MCP Server

by WYRE AI

Developer ToolsModerate7.4MCP RegistryLocal

Free

Server data from the Official MCP Registry

MCP server for IQMS (DELMIAworks) ERP — manufacturing, inventory, production, and quality.

About

MCP server for IQMS (DELMIAworks) ERP — manufacturing, inventory, production, and quality.

Security Report

7.4

Moderate7.4Low Risk

The iqms-mcp server enforces fail-closed HMAC-based S2S authentication on HTTP, rejects placeholder secrets, scopes per-request credentials via AsyncLocalStorage, and uses Oracle read tools plus gated WebAPI writes that match its ERP purpose. Only minor concerns remain: the stateless transport design requires ongoing review, and the snippet of server-dispatch tests is truncated so its dispatch logic could not be fully verified. No malicious patterns, hardcoded secrets, or shell execution were found in the provided code. Supply chain analysis found 2 known vulnerabilities in dependencies (0 critical, 1 high severity).

7 files analyzed · 8 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

database

Check that this permission is expected for this type of plugin.

env_vars

Check that this permission is expected for this type of plugin.

network_websocket

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

Oracle connection string for the IQMS database (e.g. host:port/service)Optional

Environment variable: IQMS_ORACLE_CONNECT_STRING

IQMS Oracle DB usernameOptional

Environment variable: IQMS_ORACLE_USER

IQMS Oracle DB passwordRequired

Environment variable: IQMS_ORACLE_PASSWORD

Transport mode for the server. Set to 'stdio' for local CLI use; the image defaults to 'http' for gateway hosting.Optional

Environment variable: MCP_TRANSPORT

Credential source: 'env' reads vars locally, 'gateway' expects header injection from the WYRE MCP Gateway.Optional

Environment variable: AUTH_MODE

Log verbosity: debug, info, warn, errorOptional

Environment variable: LOG_LEVEL

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-wyre-ai-iqms-mcp": {
      "env": {
        "AUTH_MODE": "your-auth-mode-here",
        "LOG_LEVEL": "your-log-level-here",
        "MCP_TRANSPORT": "your-mcp-transport-here",
        "IQMS_ORACLE_USER": "your-iqms-oracle-user-here",
        "IQMS_ORACLE_PASSWORD": "your-iqms-oracle-password-here",
        "IQMS_ORACLE_CONNECT_STRING": "your-iqms-oracle-connect-string-here"
      },
      "args": [
        "-y",
        "@wyre-ai/iqms-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

`iqms-mcp`

MCP server for IQMS / DELMIAworks (EnterpriseIQ), the manufacturing ERP from Dassault Systèmes.

Status: Read tools issue queries through @wyre-technology/node-iqms against the Direct Oracle path (always available). Write tools route through the licensed DELMIAworks WebAPI module — an optional add-on — and throw DriverNotConfiguredError until X-IQMS-WebAPI-Base-URL credentials are supplied.

Why this exists

EnterpriseIQ doesn't have a public REST API. The realistic integration paths are:

Direct Oracle (universal at every install) — read-only queries
WebAPI module (paid licensed add-on) — transactional writes

This MCP server exposes both behind a single decision-tree-navigated tool surface.

Tools

Initial discovery surface (always available):

iqms_navigate — list tools in a domain
iqms_status — credential / connection check

Domains: workorders, inventory, boms, sales_orders, purchase_orders, schedule, quality.

Read tools (Oracle, available always):

Tool	Purpose
`iqms_workorders_list`	Open / in-progress work orders
`iqms_workorders_get`	Full work order detail incl. routings
`iqms_inventory_onhand`	On-hand by item / location / lot
`iqms_inventory_lot_trace`	Lot genealogy walk
`iqms_boms_explode`	BOM explosion
`iqms_boms_where_used`	Where-used reverse lookup
`iqms_sales_orders_list`	Open SOs / ship status
`iqms_purchase_orders_list`	Open POs / expected receipts
`iqms_schedule_capacity`	Machine schedule + capacity load
`iqms_quality_ncrs`	Non-conformances / CARs / CAPAs

Write tools (WebAPI, gated):

Tool	Purpose
`iqms_workorders_create`	Create a new work order
`iqms_workorders_post_production`	Post qty made / scrapped
`iqms_inventory_adjust`	Inventory transaction
`iqms_quality_create_ncr`	Open a non-conformance record

Run modes

Local (stdio)

IQMS_ORACLE_USER=eiq_ro \
IQMS_ORACLE_PASSWORD=… \
IQMS_ORACLE_CONNECT_STRING=eiq-db.example.com:1521/EIQ \
npx -y github:WYRE-AI/iqms-mcp

Gateway (HTTP, stateless)

CONDUIT_S2S_SECRET is required. If it is empty or a known placeholder (changeme, placeholder, your-s2s-secret, and the other example values rejected at startup), the HTTP server logs an error and exits non-zero. It never prints the secret. Set MCP_ALLOW_INSECURE_DEV=1 only for local development to start without the secret; the process logs a warning, does not check X-Gateway-S2S, and binds 127.0.0.1 only. A non-loopback MCP_HTTP_HOST (including 0.0.0.0) is ignored in that mode and the override is logged. A placeholder secret still refuses to start.

MCP_HTTP_HOST is honored when CONDUIT_S2S_SECRET is set, and defaults to 0.0.0.0 when unset. With no secret, the listener is 127.0.0.1. The container image sets MCP_HTTP_HOST=0.0.0.0 and AUTH_MODE=gateway.

CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" \
MCP_TRANSPORT=http \
MCP_HTTP_PORT=8080 \
AUTH_MODE=gateway \
node dist/http.js

Local HTTP without a secret is development-only and always binds 127.0.0.1:

MCP_ALLOW_INSECURE_DEV=1 npm run start:http

`X-Gateway-S2S`

With MCP_TRANSPORT=http and a real CONDUIT_S2S_SECRET, every /mcp request must include X-Gateway-S2S:

t=<unix seconds>,v1=<hex hmac-sha256>

The signature is HMAC-SHA256 of the literal message t=<unix seconds> (the same t= prefix that appears in the header), keyed with CONDUIT_S2S_SECRET, and hex-encoded. A missing or invalid header returns 401. /health stays unauthenticated and does not read vendor credentials. The stdio transport does not use CONDUIT_S2S_SECRET.

In AUTH_MODE=gateway, /mcp also requires the Oracle headers below. Those headers are the only credential source for that request. A request missing any of them returns 401 and does not fall back to IQMS_* in the process environment.

Header	Required	Notes
`X-Gateway-S2S`	yes, when `CONDUIT_S2S_SECRET` is set	`t=<unix seconds>,v1=<hmac-sha256 hex of t=...>`
`X-IQMS-Oracle-User`	yes	Oracle DB user
`X-IQMS-Oracle-Password`	yes	Oracle DB password
`X-IQMS-Oracle-Connect-String`	yes	Easy Connect or TNS
`X-IQMS-WebAPI-Base-URL`	no	Enables write tools when all three WebAPI headers are present
`X-IQMS-WebAPI-User`	no
`X-IQMS-WebAPI-Password`	no

Single-tenant HTTP (`AUTH_MODE=env`)

/mcp still requires a valid X-Gateway-S2S header. Vendor credentials come from IQMS_ORACLE_USER, IQMS_ORACLE_PASSWORD, and IQMS_ORACLE_CONNECT_STRING. Optional IQMS_WEBAPI_* variables enable write tools. This mode is separate from the gateway Compose service, which does not inject those variables.

Docker

The image listens on 0.0.0.0 inside the container and defaults to AUTH_MODE=gateway. Publish the port on loopback and pass the S2S secret. In gateway mode, IQMS credentials arrive on each request as headers; they are not read from the environment.

docker build -t iqms-mcp .
docker run \
  -e CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" \
  -p 127.0.0.1:8080:8080 \
  iqms-mcp

Compose refuses to start when CONDUIT_S2S_SECRET is unset, sets AUTH_MODE=gateway, publishes 127.0.0.1:8080:8080, and does not inject static IQMS_* credentials:

CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" docker compose up

License

Apache-2.0

Reviews

No reviews yet

Be the first to review this server!

More Developer Tools MCP Servers

Rea

Free

by Morluto · Developer Tools

Reverse engineer anything from your terminal or agent with one CLI and MCP server.

Paperclip

Free

by Paperclipai · Developer Tools

Trending hip-hop artist momentum scores across four cultural dimensions.

Git

Free

by Modelcontextprotocol · Developer Tools

Read, search, and manipulate Git repositories programmatically

Toleno

Free

by Toleno · Developer Tools

Toleno Network MCP Server — Manage your Toleno mining account with Claude AI using natural language.

MCP Marketplace

Free

by mcp-marketplace · Developer Tools

Search and install MCP servers from inside your AI client.

mcp-creator-python

Free

by mcp-marketplace · Developer Tools

Create, build, and publish Python MCP servers to PyPI — conversationally.

Iqms MCP Server

About

Security Report

Findings (8)Action required

Permissions Required

What You'll Need

How to Install

Documentation

iqms-mcp

Why this exists

Tools

Run modes

Local (stdio)

Gateway (HTTP, stateless)

X-Gateway-S2S

Single-tenant HTTP (AUTH_MODE=env)

Docker

License

Reviews

No reviews yet

More Developer Tools MCP Servers

Rea

Paperclip

Git

Toleno

MCP Marketplace

mcp-creator-python

`iqms-mcp`

`X-Gateway-S2S`

Single-tenant HTTP (`AUTH_MODE=env`)