Security Data Sheet

MCP Connector for Advance Steel

Version 1.1.0, reviewed 12 October 2026.

What it does

MCP Connector for Advance Steel lets an AI application inspect and edit Advance Steel models and drawings on your Windows computer. It supports Advance Steel 2022 to 2027. It includes the AutoCAD drawing tools and adds steel objects, assemblies, numbering, properties, detail drawings, dimensions, labels and material lists. You choose and configure the AI application separately.

Product and pricing · Setup and tool reference

Where drawing data goes

Tool results go to the AI application you connect. If it uses a cloud AI provider, project information is processed under your account settings and agreement with that provider. A local AI setup can keep inference on your own computer or server. Running the connector locally does not, by itself, make the AI processing local.

The connector does not send model content or tool results to AUTOM8LABS. Your AI application controls what it sends to its provider. Files, images and reports requested through tools can contain project information and can be written to locations available to your Windows account, including network shares.

How edits are controlled

The free edition provides AutoCAD drawing inspection, measurement and navigation. Steel-specific tools require Pro, including steel queries. Licence enforcement happens inside the Advance Steel plug-in. The AI application determines whether it asks for approval before a call; the connector does not require a separate confirmation for every edit.

Read-Only Session blocks tools that change the drawing or steel model. With Pro active it retains the steel inspection tools as well as the free drawing tools. It can still change the selection, export a material list and save an annotation template beside the drawing. Read-only therefore does not mean no files can be written.

Bulk steel-property changes, beam-section changes and deletion of detail annotations default to a preview. Other authoring operations can apply immediately. Steel edits use Advance Steel document-access scopes; multi-step operations can keep work that completed before a later step failed.

Keep a separate model copy before bulk edits. Undo and checkpoint rollback use the host's undo history where available. The connector refuses Redo in this release because it could not be relied on in the tested Advance Steel host. Do not rely on redo to recover work after an undo.

Detail-drawing creation and update can write drawing files beside the model. Saves, exports, material lists, annotation templates and folder operations write to disk within your Windows permissions and are not reversed by the open drawing's Undo history.

Raw AutoCAD command and AutoLISP execution are disabled by default and require both explicit configuration and Pro. When enabled, they are not sandboxed and have the capabilities of commands and scripts running under your Windows account.

Administrator controls

With Pro, an administrator can block tools by name or permit only an approved list. These restrictions apply when tools are listed and when a call is executed, including calls inside a batch. They restrict the licensed tools; they do not grant additional access. The controls are off unless configured.

Policies can be assigned by computer or by user through Group Policy or Intune using the supplied template. Where policies overlap, the stricter tool restrictions apply. An administrator can also force Read-Only Session; the user cannot turn that lock off in the connection dialog.

What AUTOM8LABS receives

Licence activation and validation send the licence key, product code, hashed machine identifier, Windows machine name and client version to the AUTOM8LABS licence service over HTTPS. Floating-seat acquisition, renewal and release also use a session identifier. The licence dialog can retrieve the seat roster. With no licence configured, the connector makes no licence-related request.

Drawing content and tool results are not included in these requests. Licence records are held for the duration of the licence and deleted on request. Website payments are handled by Stripe; AUTOM8LABS does not store card data.

On the workstation

The plug-in and its AI connection communicate through a Windows named pipe rather than a listening TCP port. The pipe is restricted to the Windows account running Advance Steel, and is not created if that restriction cannot be applied. Any program running under that account can use it.

Validated licence records are encrypted using Windows DPAPI at machine scope. A key awaiting validation may be stored before encryption; it does not grant Pro access. Diagnostic file logging is off by default and can be enabled for troubleshooting. Diagnostic logs stay on the workstation unless shared by the user.

Setup and the connection controls update supported AI applications' local MCP settings. This includes supported clients in WSL, reached by running wsl.exe. The connector runs with the Windows user's permissions. Installation requires administrator rights; normal use does not.

Optional audit log

The optional Pro audit log is off by default. When an administrator enables it, the connector records tool calls, including refusals and batch steps. Records contain the Windows user and computer, host version, project name or path, AI app name, tool, outcome, duration and shortened arguments and error text. These fields can contain project information. Tool results are not copied into the audit log.

An administrator can also request a short reason from the AI for each call. This is the AI's account of the request, not a copy of the user's chat. Logs are written locally and can be copied to an administrator-selected folder or network share. Local audit files are retained for 90 days; retention and access at the destination are controlled by your organisation. AUTOM8LABS does not receive them.

Audit recording is best effort. A failed write or unavailable share does not block the tool, so the log is not a guaranteed or tamper-proof record.

Release assurance

The v1.1.0 installer, bridge executable and AUTOM8LABS plug-in DLLs are code-signed as AUTOM8LABS LTD through Azure Trusted Signing. The release payload and signatures were checked on 12 October 2026. Third-party libraries ship as their publishers release them.

Dependency inventories cover the plug-in and its AI connection component, including the bundled runtime. CycloneDX SBOMs are available on request for this release. Release package checks on 12 October 2026 reported no known vulnerabilities in the dependencies checked. This is a dated check, not a guarantee against vulnerabilities discovered later.

This sheet describes the v1.1.0 website release, based on source review, release checks and recorded host tests. See the Trust Center for company security information and the Privacy Policy for personal data handling.

Questions for your IT team

Contact [email protected] for security questions, dependency inventories or deployment information.