AutoCAD MCP Pro

Production-grade AutoCAD automation for AI agents. Live through COM on Windows, or headless through ezdxf anywhere — one typed contract, two engines.

Install · What's new · Tools · Engines · Evidence · Limits · Config · Changelog

_{Not a mockup. Every line on this sheet was drawn by the tools this server exposes — ISO layers, involute gear geometry, DIN 6885 keyway, section A-A, ISO 129 dimensions, an ISO 286 H7 bore fit, ISO 7200 title block — then rendered headlessly by view_screenshot. drawing_critique returns 0 issues on it. Rebuild it with python scripts/render_readme_showcase.py.}

v1.7 release snapshot: 248 tools · 11 resources · 5 prompt templates · 6060 collected tests. 248 is the registered count; a default install advertises 243 over tools/list, because ENABLE_3D is unset. system_about is the runtime authority.

What's new in 1.7

1.6 taught the server to draw whole sheets and to read other people's drawings. 1.7.0 makes what it draws provable and what it runs safe (design). One new tool, drawing_verify_requirements, and three new resources; the rest is what the existing 247 tools now guarantee.

The verification workflow

drawing_preflight(intent, requirements)        typed items: id, quantity, target + unit, feature, source
drawing_plan(..., persist_requirements=True)   the set travels inside the DWG/DXF
mech_part_draw(spec)                           every entity tagged with its feature
drawing_verify_requirements(use_stored=True)   measured on the document: pass / fail / unknown / ambiguous
drawing_critique(focus=None)                   drafting checks over every entity of every space
drawing_deliver(..., requirements=...)         exported, reopened, measured again on the file
drawing_verify_requirements(manifest_path=)    later: has anything in the delivery changed since?

A drafting score is not an acceptance. drawing_finalize still returns its 0–100 score, but with requirements= a requirement that does not pass blocks it (failed_acceptance), whatever the score.

TOOL_PACKS keeps a client from paying for the tracks it does not use (idle cost below).

_{A mechanical sheet, gated. The mech_assembly benchmark sheet: a hub drawn from its part model with a full section and chain dimensions, a flange with its bolt-circle end view, two ISO 4014 M12×60 bolts and ISO 4032 nuts inserted as blocks, the ISO 7573 parts list read off the drawing, balloons linked to its rows, an ISO 5457 frame and an ISO 7200 title block. drawing_critique(focus=None) returns 0 issues and the finalize score is 100. Rebuild it with python scripts/render_readme_mech.py.}

_{A floor plan whose areas nobody typed. arch_plan_from_spec's example, drawn in one transaction: a 250 mm brick ring split by a 100 mm AAC wall, two doors, two windows, a straight stair and exterior dimension chains at 1:50. The rooms measure 27.74 and 21.99 m², read from the faces the walls enclose, and the door, window and room schedules are read off the drawing. drawing_critique(focus=None) returns 0 issues. Rebuild it with python scripts/render_readme_arch.py.}

_{The same server as a P&ID drafter. pid_from_spec placed five catalogue symbols as real blocks with TAG attributes and named ports and routed four port-to-port lines with ISA-5.1 classes and line numbers, all in one transaction. Then pid_graph read the sheet back: 5 nodes, 4 edges, 0 dangling ends, confidence_min 1.0. Rebuild it with python scripts/render_readme_pid.py.}

_{The catalogue, authored in code. 43 ISO 10628-2 / ISA-5.1 symbols: 11 valve bodies × 6 actuators, 6 rotating machines, 4 heat exchangers, 6 parametric vessels, 7 inline items, the instrument bubble in 4 types × 5 locations, 5 line markers and 3 connectors. Every one was placed through pid_symbol_insert's own path. Rebuild it with python scripts/render_pid_catalog.py.}

Why this exists

A big MCP server is expensive to be connected to. The full catalog costs a client 89,226 tokens before it has asked for anything. Discovery mode replaces it with three tools and costs 503.

A drafter searches for FILLET, not entity_fillet. Before the corpus, those command names appeared in no tool name or description. That was df = 0 against a stock index: the tools were not ranked badly, they were absent. The fix was data: an authored corpus of 206 AutoCAD command names and 1459 synonym phrases covering all 248 tools. A test refuses to let a tool exist without one.

Install

pip install autocad-mcp-pro     # or: uvx autocad-mcp-pro
autocad-mcp                     # stdio MCP server, backend auto-selected

AUTOCAD_MCP_BACKEND=ezdxf autocad-mcp    # portable DXF engine, no AutoCAD needed
AUTOCAD_MCP_BACKEND=com   autocad-mcp    # live AutoCAD (needs the [com] extra)

As a Claude Code plugin

The server and the premium skill install together. The skill teaches the measured workflow: requirements → geometry → verified on the CAD → saved → reopened → delivered.

claude plugin marketplace add U-C4N/Autocad-MCP
claude plugin install autocad-mcp-pro@autocad-mcp

The plugin runs uvx --from "autocad-mcp-pro[com,pdf,office]==1.7.0" autocad-mcp, which is this release at exactly the plugin's version, so it needs uv. Set AUTOCAD_MCP_SOURCE to a checkout (C:/path/to/Autocad-MCP[com,pdf,office]) to run that code instead. Already running the server yourself? Keep one: turn the plugin's server off in /mcp, or copy .claude/skills/autocad-mcp-premium/ into your .claude/skills/ instead. plugin/README.md has the details.

{
  "mcpServers": {
    "autocad": {
      "command": "autocad-mcp",
      "env": {
        "AUTOCAD_MCP_BACKEND": "auto",
        "ALLOWED_PATHS": "C:\\Users\\you\\Documents\\AutoCAD",
        "TOOL_PROFILE": "full",
        "TOOL_PACKS": "all",
        "DISCOVERY_MODE": "off"
      }
    }
  }
}

What you get

_{248 tools in 28 groups. TOOL_PACKS=core hides these from a client that needs none of them: the nine pid_* tools, the 22 environment tools, the 14 mechanical tools, the 12 architectural tools and the two plant takeoffs. TOOL_PACKS=core,mech keeps the mechanical ones, TOOL_PACKS=core,arch the architectural ones, and TOOL_PACKS=core,plant the takeoffs. There are also 11 resources that cost nothing in the tool budget (autocad://drawing/info, layers, blocks, entities/stats, entities/{layer_name}, system/status, pid/symbols, standards/isa51, standards/coverage, and the task recipes recipes/index and recipes/{recipe_id}) and 5 prompt templates.}

Two rules worth knowing.

• Every coordinate in and out of a tool is WCS on both engines. The one exception is TEXT rotation, which stays in the entity frame: a mirrored TEXT is mirror-imaged, and no scalar angle expresses that.
• Never read vertices back and shoelace them. That silently loses 28.2% of the area on a semicircular edge. analysis_measure_entity(handle) reads the real geometry and states its own accuracy.

The two engines

One contract across 23 modules in backends/contracts/. @capability(key, reason=…) supplies a default that refuses, and a test holds both backends' capability key sets equal. There are 42 capability keys. Read system_capabilities at runtime rather than trusting the table: several depend on what the machine has installed (matplotlib, openpyxl, the ODA File Converter).

_{ᵐ Needs matplotlib ([pdf]/[full]). Without it, png, pdf, viewport_render and handle_overlay report unsupported headlessly.
ᵒ Needs openpyxl ([office]/[full]). Without it, XLSX is refused with xlsx_write and CSV is still written.
ᶜ Headless CHSPACE has four restrictions, named in its capability reason: top-view untwisted viewports only; dimensions refused unless frozen; ACIS, proxy and table entities refused; viewport clipping reported rather than applied.}

Evidence

Everything below is produced by scripts in benchmarks/ and published as JSON under benchmarks/results/published/.

Against the other AutoCAD MCP servers

A fixed 100-point rubric applied to nine public AutoCAD MCP servers (source_review.json). Stars and raw tool counts score nothing. 1.6.0 is scored per category, with the evidence for every point withheld:

A second lane runs tasks instead of reading source. Every task in the fixed-task matrix can fail, and its artifacts are verified by re-opening the DXF, never by trusting a response. This server passes 31 / 31 of matrix v8. The two competitors with adapters, pinned at their July 2026 commits, passed 5 / 10 and 4 / 10 of the ten v2 tasks they were run on. The twenty-one tasks added since were never put to them, so their lanes record them as not_run or environment_blocked, never as zero:

Correctness — every release re-proves itself

61 deterministic headless checks against the previous tag and the current tree. Each runs in its own subprocess, so a hard crash counts as a miss rather than killing the run.

The 48 checks v1.6.0 was released on all still pass. Thirteen rows are fixed. Four are reliability defects 1.6.0 shipped with, each reproduced on v1.6.0 (fail → pass) and fixed in 1.7.0; the other nine are the roadmap's acceptance scenarios, which 1.6.0 could not even attempt (miss → pass: the verification engine they call is new in 1.7.0):

The twenty-two checks 1.6 added against v1.5.1 (miss → pass) each pin a number computed by hand, not read back from the code that drew it:

The task matrix — tasks that can fail

An early matrix scored this server 10/10, which carried no information: every task exercised something the server was built around. Since 1.5 a task joins the matrix only if it can fail. Three of 1.5's five did while being written.

1.7 adds ten (matrix v8, 31 tasks). Five test what 1.7.0 promises, and five stand on ground a rival server claims:

• requirements_roundtrip: a plate verified on the document; then its bore is moved 3 mm inside the saved file, with counts and extents unchanged. Exactly that requirement must fail on the reopened file;
• cancel_safety, qa_large_drawing (offenders at the 5,001st entity, after the 10,000th and on a paper layout), export_safety and stale_preview;
• revision_guarded_edit (beiming183's revision discipline), pid_file_roundtrip (puran-water's P&ID tools), foreign_edit_verified, damaged_dxf_refusal (refused by name; recovery is 1.7.1) and dimension_binding.

The tasks added in 1.5 and 1.6, with what each is verified against:

Headless performance

The workloads call the same backend methods the MCP tools call, so server-side overhead is included. Numbers move with hardware; the report records the machine fingerprint. Read the next section before quoting them. Entity creation is still slower than in v1.4.0.

1.7.0 against 1.6.0: not slower beyond the noise. benchmarks/perf_compare.py builds a v1.6.0 worktree and measures both trees in alternating rounds, base, head, head, base, with one interpreter. The A/A calibration measures the base against itself in every round. Values are medians of 20 rounds after 5 warm-ups, and each ratio is the median of the paired per-round ratios (perf-v1.6.0-vs-v1.7.0.json):

The gate holds every ratio at or below 1 + max(0.05, 2 × the A/A spread). This run was taken on an idle machine: the A/A spread was 5.5 %, so the bound was 1.11. The region query's 1.02 is inside that noise. Its two medians differ the other way (1,377.6 vs 1,012.8 ms) because the ratio column pairs each round's base and head before taking the median, and the paired figure is the one the gate trusts. These runs use CPython 3.13 and the table below uses 3.11.15, so compare ratios, never milliseconds across tables.

What this release is bad at

A page that only lists strengths is a page that has not been measured.

Headless entity creation is slower than v1.4.0, and neither 1.6 nor 1.7 won it back. 1.7.0 is not slower than 1.6.0 (above); the loss is 1.6's against v1.4.0, and winning it back is 1.7.1's first item. These are medians of five alternating runs on one machine, with one interpreter (CPython 3.11.15) and one ezdxf, v1.4.0's code against 1.6.0's (perf-v1.4.0-vs-v1.6.0.json):

The per-call timeout stops one hung call from wedging a server whose document lock is a single asyncio.Lock. It explains only part of the slowdown: switched off, creation is still 1.17× and 1.20× slower. The rest is extra work per call that 1.6 has not removed. A cProfile of the event-loop thread counts 491,071 function calls for the 2,000 creates, against v1.4.0's 319,038. Earlier READMEs said that switching the timeout off returned creation to v1.4.0's numbers. Measured this way, it does not. The region-query row, which moves the wrong way, shows this machine's noise floor (about ±10 %). Roadmap criterion 7 is not met and moves to 1.7.1.

Four mechanical feature tables ship empty. DIN 471/472 retaining-ring grooves, DIN 509 undercuts, DIN 332 centre holes and ISO 3601-2 O-ring grooves have their drawing code and their provenance tests, but no rows. A groove diameter written from memory is a wrong workshop drawing, while a narrow table is merely narrow. So every size is refused by name until rows verified against the standard's own table are transcribed. That is a data edit; each module's docstring says how.

Takeoffs are estimates, and they say so.

• A layout length is the rectilinear minimum spanning tree of the tags a run connects, plus a stated vertical allowance, and it is labelled an estimate.
• A P&ID length is used only when drawing_scale_check calls the P&ID to scale.
• A power the P&ID does not state stays empty and becomes an open item, and no cable-section table is authored: a section comes only from your section_rules.
• Where no callout names a panel, the nearest panel is inferred and flagged.
• Detail copies of equipment are flagged, and excluded only when you ask.

The readers were tuned on the synthetic plant pair and on one real P&ID / layout pair that is not in this repository. Another drafting office's layer and text conventions may need vocabulary.

Verification measures what it can bind, and says so when it cannot. A requirement is measured on a feature it can identify: by handle, by the feature tag this server's generators write, by an architectural element, by a geometric predicate or by a DIMENSION's defpoints. On somebody else's drawing that usually means a predicate. Two equal candidates are ambiguous, and a spline or a tilted plane is unsupported. Neither is a pass, so a report full of unknown is a report that needs better selectors, not a clean part.

A live revision sees the operator's object edits, not everything. No COM event sink is used (one left the seat refusing Documents.Add()); a transient AutoLISP database reactor in the bound document, read through VL.Application.16, counts object changes, and a change since the server's previous call is one more revision. Measured on AutoCAD 2026: an entity added, moved, re-propertied or deleted, a layer added or changed, ERASE and U each move it by one. A view change and a system variable written with SetVariable do not, an edit made while a server call runs is folded into that call, and without Visual LISP the revision counts this server's writes only (system_status.operator_edits says which). Two counter reads per live call, 0.6-1.2 ms each (median, two runs). Two servers bound to one document each keep their own counter id, so a read by one never moves the other's revision; a write by one is an outside edit to the other. The preview's entity fingerprints still back every apply. The operation journal is in memory: a server restart forgets every operation id (durable in 1.8).

A damaged DXF is refused, not recovered. A truncated file is refused by name and the open document is kept. ezdxf.recover arrives in 1.7.1.

No Plant 3D. The roadmap's track D (read-only queries of a Plant 3D project) was dropped: the maintainer does not use Plant 3D, and a reader tested against nobody's real projects would be a guess. Roadmap criterion 5 is withdrawn, not met.

No REGION or 2D booleans headlessly. add_region() produces a REGION with zero ACIS bytes, and the greiner_hormann substitute loses 28.2% of the area on a square with one semicircular edge.

system_run_command / system_run_lisp are a guardrail, not a security boundary. The rejection message says so in those words. A 36-verb denylist refuses the obvious cases, but AutoCAD accepts hundreds of commands, and DANGEROUS_COMMANDS_ENABLED=true switches the list off entirely.

Path validation is per-tool, and unscoped until you scope it. With ALLOWED_PATHS empty (the default), the only positive bound is a ten-entry system-directory denylist that does not include C:/Users, /home, /root or /var. Set ALLOWED_PATHS.

Non-AutoCAD ProgIDs are unverified. CAD_PROGID changes which COM application the backend attaches to; nothing beyond the connection has been tested against BricsCAD, ZWCAD or GstarCAD.

Known limitations of the P&ID track

The router is orthogonal and blind. pid_line_draw picks auto from seven orthogonal candidates, by fewest bends then length:

• straight;
• one bend;
• two bends through the midline;
• a stub out of each port joined by three bends.

You can also take direct, or pass waypoints. It counts the lines it crosses (crossings comes back in every result, and pid_from_spec sums it), but it does not route around them. Obstacle-avoiding routing is not in 1.7 (it is planned for 1.8); move the symbol or pass waypoints.

A foreign drawing is read at the confidence it earns, and no higher. A block this server did not place classifies at 0.6, with inferred ports, by its TAG-style attribute or a keyword in its name. It classifies at 0.3 when a line merely touches it, and a 0.3 guess can neither raise nor suppress a critique finding.

On the live engine, an INSERT turned off a right angle has members ActiveX cannot measure, so it reports an approximate box. pid_graph takes the tighter wall of that box and the attribute-inclusive box on every side. Even so, a line ending on such a body's true edge can still be reported dangling, with the nearest port as the hint. Read stats.confidence_min first.

Same-file only, DXF headlessly. Off-page connectors link within one drawing; links across files are not resolved. The headless engine reads DXF; a DWG P&ID is read through the live backend. There is no DEXPI/Proteus export and there are no ISA-5.2 binary-logic symbols in this release. Both cuts are recorded in the spec so nobody re-derives them.

Known limitations of the settings track

Layer states are ours. layer_state_save writes a portable snapshot into an ACADMCP_LAYERSTATES XRECORD. It survives save/reopen on both engines and travels with the DWG/DXF. It is not an AutoCAD LAYERSTATE and does not appear in the Layer States Manager, which is why system_capabilities reports layer_states as mode: "xrecord".

Six of the 22 environment tools need a live seat. Preferences, launching, the operator prompts and the five summary fields of document properties are refused headlessly with preferences / dwgprops / live_application / interactive_prompt. Each is a refusal, not a stub.

A .dwt template is the same case (dwt_write): a .dwt is a DWG container, so headlessly the template is saved as DXF. mleaderstyle_create is not such a case. ActiveX has no MLeaderStyle collection, but the ACAD_MLEADERSTYLE dictionary holds full IAcadMLeaderStyle objects, so both engines create leader styles.

A headless dimension does not re-render. On the ezdxf engine, dimstyle_modify reports dimensions_using_style and rerender_required: true, and the DIMENSION keeps its rendered block until it is redrawn. AutoCAD regenerates on the next regen.

Known limitations of the architecture track

Nominal, not standard. The furniture and sanitary blocks carry nominal catalogue sizes and say so. The stair tool reports the Blondel relation (2R + G within 600–650 mm) as a design rule, never as a building code. The arch layer colours are a repository convention: ISO 13567 fixes the names, not the colours. Labels speak English or Turkish; any other lang is refused with the list.

Configuration

Nothing loads a .env file — export these, or set them in your MCP client's env block.

Architecture

flowchart LR
  A[MCP host / AI agent] --> B[FastMCP 3 server]
  B --> C[Error · audit · timing · logging · capability-refusal middleware]
  C --> D[Typed contract · 23 modules · 42 capability keys]
  D --> E[COM backend<br/>single-STA thread]
  D --> F[ezdxf backend<br/>asyncio.to_thread]
  E --> G[Live AutoCAD]
  F --> H[Headless DXF]
  E --> I[Engineering · critique · scoring · delivery]
  F --> I

drawing_new()                                    ISO linetypes + layers bootstrapped
drawing_apply_iso_layers("mech")                 ISO 128 lineweights per layer
drawing_settings({units: "mm", linear_precision: 2})

gear_draw_spur_front_view(                       involute flanks, not a decorated circle
    module=6, teeth=24, center=[135, 172],
    bore_diameter=40, keyway_width=12, keyway_depth=3.3)
gear_draw_section_aa(x_offset=300, face_width=46)

dimension_linear(...)                            ISO 129
dimension_diameter(..., fit="H7")                deviations from authored ISO 286 tables
titleblock_apply_iso_a3(title="SPUR GEAR m6 z24", material="C45E", ...)

drawing_critique(focus=None)                     -> []  must be empty before finalize
view_screenshot()                                -> PNG

Development

uv sync --locked --all-extras
uv run pytest
uv run ruff check . && uv run ruff format --check .

uv.lock pins the whole transitive graph, so this reproduces CI exactly. CI runs Linux (3.11 / 3.12) and Windows (mocked COM), plus package, Docker and MCP-registry jobs. It also runs claude plugin validate --strict on the marketplace and the plugin, the generated-file gates (build_plugin.py --check, generate_tool_inventory.py --check, check_doc_numbers.py) and a contents check of the built wheel and sdist: the wheel holds the server and nothing else, and the sdist holds only what git tracks. The release gate runs the same three test lanes, plus a headless lane that runs the correctness suite against the previous tag with --fail-on-regression, before anything reaches PyPI. Releases are tag-driven: git tag vX.Y.Z && git push origin vX.Y.Z.

The live COM paths are checked on a running AutoCAD, never in CI: python scripts/smoke_verify_com.py --json out/verify.json (and the seven other scripts/smoke_*_com.py) attaches to the open seat, works only in documents it creates, and closes them.

Roadmap

1.7.1

• Speed. Win back the headless creation throughput that 1.6 lost against v1.4.0 (criterion 7). Arm the per-call timeout only where a call can block, and remove the per-call work that came with it.
• ezdxf.recover as a fallback on drawing_open.
• The XDATA rework: chunking, case and budget.

1.8

• A durable operation journal and idempotency across restarts.
• Parametric edit and rebuild of a part from its stored model.
• Obstacle-aware P&ID routing, and P&ID projects across files.
• Transcribed rows for DIN 471/472, DIN 509, DIN 332 and ISO 3601-2, each verified against the standard's own table.

1.9: IEC 60617 electrical schematics, reusing the P&ID track's symbol, port and graph machinery.

Features ship when their contracts and limitations are testable — not when they make a longer checklist.

Star History

Author

Umutcan Edizsalan · Mechanical engineering work at Anka-Makine · GitHub @U-C4N

Built from production drawing work, then made model-agnostic through MCP.

License

MIT

mcp-name: io.github.u-c4n/autocad-mcp