CadPlot MCP

CadPlot MCP

CadPlot MCP is a safety-first MCP server for repeatable AutoCAD plotting workflows.It is designed for architecture offices that need to inspect many revised drawings,identify sheet frames, map company page setups, and publish PDFs consistently.

Current milestone: approval-gated AutoCAD publish candidate

The repository now provides:

• recursive DWG discovery inside explicitly allowed folders;
• read-only layout and plot-setting inspection through a running AutoCAD instance;
• named page-setup inspection with expected PC3 and CTB/STB verification;
• detection of paper-size labels such as 70x100, 700x1000 mm, or 50 × 70 cm;
• configuration-based paper profile matching;
• structured warnings suitable for an approval-first publish plan.
• copy-only staging with a second SHA-256 check in the plug-in;
• an opt-in, bounded queue drained on AutoCAD's main application context;
• durable, authenticated queue intent: a Windows DPAPI-protected key outside the workspace signsexact approvals; never-started work recovers after restart while an interrupted running job isheld as job_interrupted and is never replayed automatically;
• durable pending cancellation: an exact signed tombstone survives restart, while a runningPlotEngine operation is never force-aborted;
• in-memory layout/page-setup/viewport creation and one PDF per sheet;
• bounded, snapshot-consistent structural, physical-size, and nonblank PDF auditing, including a64 MiB decoded-content cap and allocation-safe, 8 MiB marking lexer;
• deterministic CycloneDX 1.7 SBOM generation bound to the exact commit, lock, runtime dependencyinventory, wheel/source archive, and release DLL hashes, with no workstation paths or Autodeskbinaries.

The executor compiles against an installed AutoCAD 2024 managed API surface. AutoCAD 2016 and2025 release builds and live plotting still require the matching Autodesk SDK references and alicensed-workstation acceptance test. Compile-only evidence is not presented as live evidence.The repository and kit verifiers also do not claim Authenticode signing; an organization-ownedsigning certificate and timestamp policy remain an external release gate. See thesoftware bill of materials.The completion audit maps every project requirement to its currentauthoritative evidence and keeps licensed/company-only gates explicit.At load time the plug-in normalizes the real ACADVER value and refuses to enable publishing whenthe loaded adapter does not match the running AutoCAD release.

Safety contract

• No arbitrary AutoLISP or AutoCAD command execution.
• No implicit use of ActiveDocument as the target.
• Every DWG path must be inside an allowed root.
• Every approved plan is bound to a two-pass stable source DWG SHA-256/size/time/file-identityfingerprint; redirected leaves and in-flight changes fail closed.
• Drawings opened by the inspector are opened read-only and closed without saving.
• Existing open drawings are never closed by the server.
• Existing layouts are never selected as write targets; target-name collisions block the plan.
• Staging copies a DWG into a new isolated job folder and refuses symlink/junction workspaces.
• Python staging/audit and the plug-in re-hash the staged DWG before execution; Python evidence alsorequires two identical streaming fingerprint passes without loading large DWGs into memory.
• Layouts and viewports are execution scaffolding: they are discarded after plotting, keeping thestaged DWG byte-identical for the final audit.
• Every sheet plots to an owned temporary PDF; final names appear only after every plot completesand the staged DWG closes without saving. A later promotion failure rolls back earlier unchangedoutputs by length and SHA-256 when the filesystem permits it.
• Existing PDFs, layouts, or busy plot engines cause refusal; overwrite remains disabled.
• Publish commands are disabled unless the AutoCAD process starts withCADPLOT_ENABLE_PUBLISH=1 and a trusted workspace.
• Queue acceptance is acknowledged only after an immutable job-local intent is persisted. Aseparate started marker prevents ambiguous crash recovery from silently plotting twice.
• Pending cancellation requires the exact plan and manifest digests, persists before memory statechanges, and is idempotent. Running or terminal work cannot be cancelled in place.
• All MCP tools expose closed top-level structured-output schemas; plan and receipt identities alsocarry exact digest patterns. Successful schema-v2 receipts bind the ordered PDF output set bysheet index, filename, byte length, and SHA-256. The real STDIO smoke test exercises this contractwith call_tool.
• MCP tool annotations distinguish local write actions from read-only tools; clients must stillenforce their own approval policy because annotations are hints, not authorization.

Install

Requirements: Windows, Python 3.11+, and AutoCAD for live DWG inspection.

cd cadplot-mcp
uv sync --extra autocad --extra dev
Copy-Item examples/config.example.yaml config.yaml
$env:CADPLOT_CONFIG = "$PWD\config.yaml"
uv run cadplot-mcp

For an administrator-authorized Secure MCP Tunnel developer pilot, run the same tool surface on aloopback-only Streamable HTTP endpoint:

uv run cadplot-mcp-http --port 8765

This binds only 127.0.0.1 at /mcp, enforces exact Host/Origin guards, and caps requests at1 MiB. It is not an authenticated public server and must not be forwarded with a generic tunnel orreverse proxy. See loopback Streamable HTTP transport.

For the recommended private ChatGPT pilot target over STDIO, generate a secret-free administratorhandoff report without contacting OpenAI or launching AutoCAD:

uv run cadplot-tunnel-preflight --transport stdio --probe-target `
  --output C:\CadPlotPilot\chatgpt\tunnel-preflight.json

See Secure MCP Tunnel administrator handoff. Platform tunnelcreation, runtime credentials, workspace permissions, and the live app scan remain administratorgates.

After those external gates pass, prepare the hash-bound 13-case ChatGPT tool-selection evaluation:

uv run cadplot-chatgpt-eval prepare `
  --preflight C:\CadPlotPilot\chatgpt\tunnel-preflight.json `
  --output-dir C:\CadPlotPilot\chatgpt\evaluation-001

The sanitized validator tests direct, indirect, follow-up, approval, adversarial, edge,cancellation, and recovery behavior without retaining company paths or raw chat content. It provesthe ChatGPT tool contract only and cannot replace licensed AutoCAD 2016/2025 evidence. SeeChatGPT tool-selection evaluation.

Before connecting an MCP client, diagnose the local installation without launching AutoCAD:

uv run cadplot-doctor --mode config
uv run cadplot-doctor --mode inspection
uv run cadplot-doctor --mode full

config checks paths and policy only; inspection additionally requires a running AutoCAD COMsession; full also requires the installed local named-pipe plug-in and its trusted workspace.Every mode is read-only and returns machine-readable JSON plus a nonzero exit code when not ready.

For a first office inventory, create a new empty local pilot folder without overwriting anything:

.\scripts\new-local-pilot.ps1 -DestinationRoot C:\CadPlotPilot -WhatIf
.\scripts\new-local-pilot.ps1 -DestinationRoot C:\CadPlotPilot

The script copies only the public non-matching inventory config and creates empty pilot-input andpilot-work folders. It never copies company assets or enables publishing.

AutoCAD must already be running for inspect_drawing. The server will not launch it silently.Each drawing inspection runs in a separate helper process with the boundedinspection_timeout_seconds deadline (default 120). A hung COM call becomes an isolated file errorinstead of freezing the MCP server or batch page. Seeinspection isolation.

The local Python client and AutoCAD plug-in use the current-user pipe cadplot-mcp by default.When licensed AutoCAD 2016 and 2025 instances must run at the same time, start each AutoCAD processand its corresponding MCP server with the same distinct safe CADPLOT_PIPE_NAME, for examplecadplot-mcp-2016 and cadplot-mcp-2025. Also select read-only COM inspection withCADPLOT_AUTOCAD_PROGID=AutoCAD.Application.20.1 for 2016 orAutoCAD.Application.25.0 for 2025. CadPlot verifies the returned application version and refusesambiguous/foreign ProgIDs. Safe pipe names match [A-Za-z0-9._-]{1,128}; invalid names fail closedon both sides. Never point one MCP process at an unverified AutoCAD instance.

Before AutoCAD testing, run the clearly labelled platform-independentsynthetic demo:

uv run python scripts/run-synthetic-demo.py

MCP tools

• validate_environment: report configuration and AutoCAD connection readiness.
• get_autocad_plugin_status: verify the local read-only .NET plug-in bridge. When publishing isenabled it also reports queueCapacity, queuePending, queueRunning, queueAvailable, and theexact queueAuthentication scheme so large-run clients can apply backpressure without trustingan unsigned restart queue.
• scan_drawings: find DWG files under an allowed project folder.
• inspect_drawing: read layouts, plot properties, labelled rectangular polylines, and strictlyvalidated orthogonal block frames backed by instance attributes or bounded read-only nesteddefinition text; the detector never explodes a block.
• inventory_office_resources: produce a read-only exact-name inventory for frame labels, namedpage setups, plotters, plot styles, canonical media, and candidate paper-space layouts withoutapproving any mapping.
• create_publish_plan: generate a deterministic, hashed dry-run plan with blockers.
• create_batch_publish_plans: inspect up to 50 drawings per restartable page while isolatingper-file blockers and AutoCAD errors; subsequent pages require the first page's exactmetadata-bound inventory ID.
• preview_publish_plan: send only ready, hash-verified plan metadata to the local plug-in;it never edits, saves, or plots the drawing.
• stage_publish_job: require the exact approved plan ID, re-inspect and re-hash the DWG,then create a verified working copy and audit manifest without plotting.
• stage_publish_batch: stage at most 20 unique, explicit DWG/plan-ID approvals per call whileisolating per-file reinspection or approval failures.
• validate_staged_job: ask the local plug-in to cross-check the staged manifest against itsindependently configured trusted workspace; it first rejects a source DWG changed since stagingand does not queue or plot the job.
• queue_publish_job: require the exact staged plan_id and manifest_sha256, then enqueue thebyte-bound copy-only job when the installed plug-in has explicitly enabled publishing. SourceSHA-256, byte length, and modification time are rechecked before the pipe call.
• cancel_publish_job: durably cancel only the exact Pending plan/manifest identity. The signedcancellation survives restart; the tool never interrupts a Running AutoCAD plot.
• queue_publish_batch: queue at most 20 unique manifest/plan/hash approvals while isolating eachplug-in refusal or connection error. Schema v2 distinguishes retryable deferred items frompermanent failed items and stops issuing pipe requests after the first queue_full response.
• get_publish_job_status: report Pending, Running, Succeeded, Failed, or Cancelled plus a boundedmachine-safe failure code.
• get_publish_batch_status: read up to 20 exact plan IDs in one bounded MCP call, summarize livestates, and take one final internally consistent queue-capacity sample without writing files.
• read_publish_receipt: recover immutable, manifest-and-output-digest-bound terminal executionevidence from the staged job even after AutoCAD has restarted.
• create_publish_operations_report: page through up to 50 staged workspace jobs with a stablecursor, terminal evidence, output issues, safe next actions, and exact requeue approvals.
• audit_publish_outputs: verify job boundaries, staged-DWG integrity, PDF structure, one-pagecount, expected physical paper dimensions, nonblank marking content, sizes, SHA-256 hashes, andexecution evidence without changing output. publish_verified=true requiressource_unchanged=true, valid nonblank PDFs, and a successful receipt whose canonical output-setbinding independently revalidates.
• match_paper_profile: map a detected label to a configured office profile.

Configuration

Copy examples/config.example.yaml. Set workspace_root to a local,dedicated output folder that is not a symlink or junction and does not overlap any allowed_rootssource tree. Unknown fields, malformed profile types, empty resource names, non-finite numericvalues, and unsafe tolerance ranges are rejected at startup. Company-owned DWT, CTB/STB,PC3/PMP, title blocks, and project drawings must not be committed to this repository.Run uv run python scripts/audit-source-tree.py before publication; CI and local preflight rejecttracked/non-ignored CAD assets, plot resources, archives, local config, and high-confidence secrets.The same audit requires immutable full-SHA GitHub Action references, exact read-only workflowpermissions, non-persistent checkout credentials, and no pull_request_target; Dependabot isconfigured for uv, NuGet, and Actions updates.CI runs the complete Python suite on 3.11, 3.12, and 3.13, then runs the heavier canonicalrelease/MCP/.NET preflight once on 3.12. Full-SHA pinning alone is insufficient: the source auditalso rejects action repositories outside the explicit reviewed allowlist.For a network-backed, lock-exact dependency check, runscripts/run-local-preflight.ps1 -AuditDependencies. It audits the exported production Python lockwith hashes, all transitive .NET packages, and the Python license declarations. The resulting JSONis bound to uv.lock; unknown licenses or known vulnerabilities fail the gate. Results are apoint-in-time database check, not a permanent security guarantee, and they do not launch AutoCAD.If the exact office resource names are not yet known, follow theread-only office profile onboarding with the deliberatelynon-matching inventory config; do not guess production profile values.

A generic local stdio client example is available atexamples/mcp.local.example.json. Client configuration formatsvary; see deployment modes before connecting a managed ChatGPTworkspace. The ChatGPT connection architecture separates theimplemented local worker/loopback tunnel target from the still-unimplemented managed HTTPS bridge.An optional validated Codex plugin wrapper is available underintegrations/codex/cadplot-mcp. It invokes an alreadyinstalled cadplot-mcp CLI and intentionally packages no DWGs, credentials, Autodesk binaries, oroffice configuration.

drawing_unit_mm declares how many millimetres one model-space unit represents. Frame geometryand the detected paper label are used to derive rotation and scale. Only values listed underscale_denominators within scale_tolerance_ratio are accepted; nonstandard or distorted framesremain blockers in the dry-run plan.

With require_page_setup_match: true (the default), a sheet is ready only when the named pagesetup exists, its plot type is exactly Layout, its plotter and plot style match the configuredprofile, and its paper-space plot scale is verifiably 1:1. Scale-to-fit is rejected becauseviewport scale already carries the approved model-to-paper ratio. Planned layout names uselayout_prefix plus a deterministic index and frame handle; any existing-name collision blocksthe plan instead of overwriting a layout.

For custom PC3 paper definitions, set profile canonical_media to the exact value returned byAutoCAD. The comparison is deliberately case-sensitive. Leave it unset only when the named pagesetup is the accepted source of media configuration and the office has approved that policy.pdf_page_tolerance_mm controls the final PDF MediaBox comparison and is capped at 10 mm.minimum_frame_confidence defaults to 0.85; ambiguous/nested frame detection remains a blockerbelow that threshold. See frame detection.Set optional frame_layers when the office has a reliable frame-layer allowlist.

Set optional profile template_layout when each source DWG already contains an approvedpaper-space title-block layout with exactly one floating viewport. The executor clones that layout,preserves its paper-space geometry, and retargets the cloned viewport to the approved model windowand scale. Missing/model-space templates or zero/multiple floating viewports block execution.

An approved external DWG/DWT can be used only through the explicit three-part contract:top-level template_roots, profile template_drawing, and the reviewed exacttemplate_sha256, together with template_layout. Planning inspects that asset read-only and bindsits layout/page setup/fingerprint into the plan ID. Staging re-hashes it and copies it under theisolated job; the plug-in imports only that staged copy, re-hashes it again, and discards all importedscaffolding with the staged DWG after plotting. No filename search or implicit office-library trustis performed.

For large folders, retain the first create_batch_publish_plans result's inventory_id, then passit as expected_inventory_id with each returned next_offset until has_more=false. Paginationfails closed if the DWG inventory changes. The hard page limit prevents a 300-file run from becomingone fragile, opaque MCP request.After staging and approving the returned manifest digests, use queue_publish_batch in boundedpages; do not submit all 300 jobs as one call.Read queueAvailable from get_autocad_plugin_status or the most recent queue/status response,then retry the unchanged exact approvals reported as deferred when slots reopen. A queue_fullresult is backpressure, not a publish failure and not permission to alter or silently replace anapproval. The MCP server instructions direct capable clients to keep feeding an already approvedlarge run autonomously; the operator still retains AutoCAD's publish opt-in gate.Use get_publish_batch_status for bounded live polling instead of issuing one MCP call per plan;its queue telemetry is sampled once after the per-job reads and is not claimed to be a simultaneoussnapshot of every job transition.Restart state is reconstructed only from authenticated durable intent and immutable terminalreceipt.json evidence. Never-started pending work is restored; started work without a receipt isheld as job_interrupted and is not replayed. Use read_publish_receipt or the audit report toresume verification without guessing from PDFs alone. Copying the workspace to another Windowsuser or machine does not transfer pending authorization because the DPAPI key remains user-bound.If a wrong profile or batch scope is discovered, call cancel_publish_job with the unchanged exactplan and manifest digest for each still-pending item. Retry is idempotent. A job already reported asRunning is deliberately not aborted; wait for terminal evidence and review its outputs.For a large run, call create_publish_operations_report until has_more=false, passing eachnext_after_job_id to the next call. Its summary is page-local; retain every report_page_id as acheckpoint. Only items in awaiting_execution include a queue_approval, and live status must bechecked before submitting it. A structurally valid cancellation marker is reported ascancelled_hold without requeue approval; only the live plug-in authenticates it as Cancelled.If the original DWG changed after staging, the item is source_changed, has no requeue approval,and must be planned, approved, and staged again so a PDF from the older snapshot is never reportedas the current revision.

The local preflight also runs an explicit 300-drawing synthetic scale rehearsal:

uv run python scripts/run-synthetic-batch-demo.py --drawings 300

It creates 300 non-DWG synthetic fixtures in a temporary directory, plans them in 15 immutablepages, stages 300 independently hash-bound copies in 15 approval batches, saturates a syntheticseven-slot queue and retries only the exact deferred approvals, walks the restart report withoutrepeats, reads all 300 plan identities through 15 bounded batch-status calls, and structurallyaudits 300 generated PDFs. It deliberately creates no plug-inreceipt. Before the valid PDFs, it proves a portrait PDF cannot satisfy the landscape orientationderived from the frame and records orientation_mismatch_rejected=true, including effective PDFpage rotation. It also proves a correctly sized blank page is rejected, then requires all 300 validPDFs to contain at least one decoded marking operator. All 300 validsynthetic outputs still remain manual_review, execution_verified=0, andpublish_verified=0. This proves bounded local orchestration and fail-closed recovery at the targetcount; it is not AutoCAD execution evidence.

Delivery gates

1. Completed locally: discovery, inspection, deterministic planning, staging, queue protocol,executor source, synthetic workflow, and PDF audit.
2. Compile-verified locally: the shared executor against installed AutoCAD 2024 API assemblies.
3. Still required: matching-SDK bundle builds and live acceptance on licensed AutoCAD 2016 and2025 with authorized office page setups/plot resources.
4. Implemented locally: loopback Streamable HTTP tunnel target with real protocol/header smoke.
5. Still external/optional: Secure MCP Tunnel admin provisioning or a managed authenticated remotegateway for a company ChatGPT workspace.

AutoCAD plug-in builds

The repository contains separate adapters for AutoCAD 2016 (net45, release R20.1) andAutoCAD 2025 (net8.0-windows, release R25.0). A normal solution build validatesthe shared protocol without Autodesk binaries. A distributable bundle must be built with localObjectARX/AutoCAD managed reference folders:

.\scripts\build-bundle.ps1 `
  -AutoCAD2016SdkDir "C:\ObjectARX2016\inc" `
  -AutoCAD2025SdkDir "C:\ObjectARX2025\inc" `
  -DotNet "$env:USERPROFILE\.dotnet\dotnet.exe"

The script intentionally fails if the Autodesk reference assemblies are missing. Autodesk SDKassemblies are development inputs and are not committed or copied into the public bundle. Beforecompilation, all three managed assemblies must expose one consistent release series and the buildrequires exactly R20.1 for the 2016 adapter and R25.0 for the 2025 adapter; a folder from anotherinstalled AutoCAD release is rejected even when it contains the same DLL filenames.

An authorized operator can run the rehearsal, dependency audit, both exact-SDK builds, bundleverification, combined release-kit build, and final verification with one no-overwrite command:

.\scripts\build-complete-release.ps1 `
  -AutoCAD2016SdkDir "C:\ObjectARX2016\inc" `
  -AutoCAD2025SdkDir "C:\ObjectARX2025\inc" `
  -DotNet "$env:USERPROFILE\.dotnet\dotnet.exe"

See Autodesk SDK prerequisites. The SDK agreement remains anexternal operator gate; the project does not download, install, accept, or redistribute Autodeskdevelopment files.

A real build also requires a clean Git worktree and never replaces an earlier artifact. Its defaultoutput is artifacts/cadplot-bundle-<version>-<commit>/, containing the extracted bundle, bundleZIP, and bundle-build.json. That manifest binds the exact commit, package version, redacted SDKassembly identities/hashes, verified bundle file hashes, and archive hash while retainingautocad_launched=false and live_publish_proven=false. verify-bundle-release.ps1 independentlychecks the directory, manifest, ZIP entry set, and every inner file hash without extracting it.After the clean matching-SDK bundle and a readiness report exist for the same commit,scripts/build-release-kit.ps1 creates a no-overwrite transfer root containing that full bundlerelease, the readiness-bound Python wheel, lock data, a git archive source snapshot, safe installscripts, the inventory-only config, pilot evidence commands, and operator runbooks. The kit carriesits own hash-bound verify-release-kit.ps1, so verification and pilot collection need no separatesource checkout. The verifier checks bothmanifests, the exact tree, embedded bundle/API evidence, current lock-bound Python/.NET vulnerabilityevidence, the complete Python license inventory, and every outer ZIP entry without extracting it.See verified release-kit installation. The kit keepslicensed_live_pilot_ready=false, public_release_ready=false, and live_publish_proven=false;only separately retained licensed 2016/2025 pilot evidence can change those claims.Its install-release-kit.ps1 provides a single -WhatIf-capable, resumable first-install command:it reuses only verified matching components, prepares pilot/Python first, and exposes the bundle lastwithout launching AutoCAD, changing global PATH, or enabling publish.Bundle mutations refuse to run while acad.exe is active. A successful orchestrated install retainsa no-overwrite local receipt binding the release manifest, Python manifest, bundle hashes, and paths.The included read-only verify-release-install.ps1 independently replays that complete evidencechain later; expected inventory-config edits are reported without weakening immutable hash checks.uninstall-release-kit.ps1 provides a receipt-bound, -WhatIf-capable and resumable rollback: itremoves the verified bundle before Python while deliberately preserving pilot data and the receipt.The kit's install-python.ps1 first revalidates the whole transfer, installs exact frozen/hash-required dependencies plus the wheel into a unique staging venv, and atomically names a version/commit target without changing global PATH. verify-python-install.ps1 rechecks its retained wheel,lock, requirements digest, command surface, and installed distribution inventory.uninstall-python.ps1 revalidates that exact version/commit environment, previews with -WhatIf,and removes only an atomically renamed quarantine; modified or redirected directories are preserved.The smaller local demo builder creates a no-overwrite delivery directory containing the exact kit,its ZIP, and an outer demo-kit-build.json. The embedded verify-demo-archive.ps1 checks the ZIPwithout extraction, including safe entry names, exact membership, per-entry hashes, inner-manifestidentity, and false live-evidence flags. verify-demo-kit.ps1 independently verifies the flat kit,which omits machine-local API directory paths from its portable manifest.Before archiving or installing, scripts/verify-bundle.ps1 requires the exact six-file bundle,checks both module routes and managed assembly identities, rejects extra files/reparse points, andprints SHA-256 hashes. The build and install scripts invoke it automatically.Licensed pilot assembly additionally binds JSON parsing and SHA-256 to one bounded stablebundle-build.json snapshot, fingerprints the bundle ZIP before and after inspecting every entry,and rejects redirected or in-flight changed evidence.It also reads each 2016/2025 one-sheet and recovery JSON through an exact bounded two-pass snapshotand rechecks all four after bundle and schema validation, before creating the no-overwrite combinedpilot record.

Installation copies into a uniquely named non-loadable staging directory, verifies every copiedfile hash against the already verified source, and only then atomically renames it toCadPlotMcp.bundle. The verifier rejects redirected files as well as redirected directories.If copying or hash verification fails, the uniquely named non-loadable staging directory isretained for explicit inspection instead of being recursively deleted by the installer.scripts/run-local-preflight.ps1 exercises -WhatIf, installation, copied-hash verification,-WhatIf removal, and removal with a clearly labelled protocol-only fixture; this smoke neverlaunches AutoCAD and is not a matching-SDK or live-publish result.

The installer never overwrites an existing bundle. It accepts only the exact CadPlotMcp.bundlechild of a full release root, then re-verifies the sibling ZIP, bundle-build.json, exact commit,and matching-SDK evidence before copying anything. Protocol-only fixtures require an explicittest-only switch and cannot pass as a real install. For an upgrade, close AutoCAD, preview the exactremoval with scripts/uninstall-bundle.ps1 -WhatIf, run it only after checking the target, then passthe new build JSON's bundle path explicitly as install-bundle.ps1 -SourceBundle ....The uninstaller rejects junctions and any directory whosepackage name/ProductCode does not match CadPlot MCP. It also requires the exact verified bundlecontents and hashes twice, atomically renames the exact target to a unique non-.bundle quarantine,and recursively removes only that checked quarantine. A rename/removal failure preserves evidence.

To compile-check the shared executor against a locally installed API without launching AutoCAD:

powershell -ExecutionPolicy Bypass -File .\scripts\probe-autocad-api.ps1 `
  -AutoCADApiDir "C:\Program Files\Autodesk\AutoCAD 2024"

The probe derives the managed target from the assembly identities (R20.1 → net45, R25.0 → net8.0-windows) instead of compiling every release through net48; unknown series are rejected.

This is only an API-signature probe. It does not validate plotting or version compatibility.See publish executor and thelicensed-workstation pilot. A concise Turkish presentation flow is in theMonday demo runbook.The final two-version acceptance record is checked by the installed cadplot-validate-pilotcommand (with scripts/validate-pilot-evidence.py retained asa source-checkout wrapper); its completed companyevidence file stays outside the public repository. Live status exposes the embedded build commitand running adapter DLL SHA-256. The pilot assembler derives the release commit from the verifiedbundle-build.json, re-hashes every bundle ZIP entry, and refuses either version when its runningbinary does not match the corresponding adapter artifact. Pilot schema v7 also requires the exactauthenticated durable-queue scheme and derives apath-redacted external-template record from each immutable job manifest and requires the approved,post-pilot company-source, and staged-copy hashes to remain identical. Each run also binds theauthorized one-page reference PDF and published output by path-redacted SHA-256/size/page geometry,and independently revalidates the schema-v2 receipt's exact output count and output-set digest,rejects a reference outside allowed roots or with different orientation/size during collection andlater validation, and requires seven separate visual-check attestations instead of one blanket switch.It additionally requires a path-redacted 2–20 job post-restart recovery record from an isolatedworkspace for each AutoCAD release; cadplot-collect-recovery independently replays everymanifest/receipt/PDF and source/staged hash before the final assembler can succeed.After both one-sheet runs and both per-release recovery records pass, the installedcadplot-acceptance finalizer binds that evidence to the exactrelease-kit directory/ZIP, wheel, bundle, build manifest, commit, and package version. Its sanitizedreport excludes company-run details and keeps public_release_ready=false until separate companypublication and maintainer release approvals are explicit; seerelease acceptance.The finalizer uses bounded stable JSON snapshots, pre/post release-ZIP fingerprints, retainedper-file fingerprints, and a final exact-tree comparison so a readiness result cannot mix releasemanifest, pilot, archive-entry, or kit-file generations.

Before enabling writes on either licensed host, run the release kit'sscripts/test-licensed-workstation.ps1 with the exact install receipt and release (2016 or 2025).It requires the version-specific COM ProgID/pipe, a running matching plug-in, unchanged install/configevidence, and CADPLOT_ENABLE_PUBLISH unset. Its no-overwrite record proves only read-only workstationreadiness; it deliberately retains live_publish_proven=false and licensed_live_pilot_ready=false.After every successful check it also emits a separate no-overwrite standard mcpServers JSON entrybound to the verified installed interpreter, config, workspace, ProgID, and pipe. The read-only entryomits the publish flag. Before recording success, the verifier launches that exact entry in asanitized environment and performs only MCP initialize and tools/list; it requires the exact20-tool contract and records mcp_tools_called=false. This proves that the client entry is executable,not that AutoCAD was launched, a DWG was opened, or a PDF was produced. The installedcadplot-probe-client-config command can repeat this bounded check without invoking a CadPlot tool.After the approved restart with CADPLOT_ENABLE_PUBLISH=1, run the same command with-SessionMode Publish -ReadOnlyPreflightPath <the prior record> and a new output path. This secondgate uses cadplot-doctor --expect-publish-enabled to require the same install/runtime/binary identityplus the DPAPI/HMAC authenticated queue. It does not queue a job or prove a PDF, so live and licensedpilot readiness remain false until the one-sheet receipt, PDF audit, and visual review pass. Only aconfig emitted by that successful publish-session gate contains exact CADPLOT_ENABLE_PUBLISH=1 andmay be merged into an approved local MCP client's configuration.

Before launching AutoCAD for staged-job validation, set CADPLOT_WORKSPACE_ROOT in the environmentthat starts AutoCAD. It must resolve to the same directory as Python configurationworkspace_root. The plug-in never accepts a trusted workspace path from an MCP request.Keep publishing off for inspection and staging validation. Enable it only for the authorized livepilot by setting CADPLOT_ENABLE_PUBLISH=1 before starting AutoCAD; restart AutoCAD after changingeither environment variable.

License

MIT. Autodesk and AutoCAD are trademarks of Autodesk, Inc. This project is not affiliated withor endorsed by Autodesk.