AUTOM8LABS | MCP Connector for AutoCAD

What it does

An AutoCAD add-in that lets your existing AI assistant read and edit the drawing that is open on the user's machine. You bring your own AI subscription. Supported on AutoCAD 2022 to 2027.

How edits are controlled

The AI does not have unattended access to the drawing. Every tool call is initiated from the AI client by the user, in a session the user is watching.

The free tier is read-only. Its tools query and report on the drawing and cannot modify it.

Tools that modify the open drawing run inside standard AutoCAD transactions and in command context, so each tool call is a single step in the AutoCAD undo history and can be reversed with UNDO. If a tool fails part-way, its transaction is discarded rather than committed.

Folder tools are the exception. They work on drawing files on disk rather than on the open document, so they sit outside the undo history and outside AutoCAD's drawing lock. Every folder tool defaults to a dry run that reports what would change, and writes files only when told to.

The connector never saves, closes or overwrites a drawing on its own. Writing to disk happens only through tools whose purpose is to save or process files. Referenced drawings are never written: xref tools edit only the host drawing.

Where model data goes

To whichever AI provider you already use, under your existing contract with that provider. AUTOM8LABS never receives your model data, never stores it, and is not a processor of it.

The add-in runs inside AutoCAD on the workstation. The component that talks to your AI client makes no outbound network connections of its own.

What AUTOM8LABS receives

Licence activation and validation	Licence key, a hashed machine identifier, the Windows machine name, and the version number. Installs with no licence make no licence-related connection at all.

The machine identifier is a SHA-256 hash of hardware values. The underlying hardware identifiers never leave the machine.

What is stored

Model content	Never received or stored
File names and paths	Never received or stored
Licence records	Licence key, hashed machine identifier, machine name and client version. Held for the duration of the licence and deleted on request
Payment records	Stripe for website purchases, Autodesk for store purchases. AUTOM8LABS does not store card data

On the workstation

No listening port. The add-in communicates with your AI client over a Windows named pipe, not a network socket.
Access restricted to the same Windows user. The pipe is scoped to the account AutoCAD is running under, and no other account on the machine can open it. A pipe that cannot be scoped that way is never created.
No log file by default. Diagnostics are off unless a user enables them for troubleshooting. When enabled, the log records lifecycle and licence events, and it never leaves the machine.
Stored credentials are encrypted. The licence and entitlement caches are protected with Windows DPAPI.
No elevated privileges are required at runtime.

Supply chain

All third-party .NET components are widely used libraries from the official NuGet ecosystem. Every component declares a licence. All are MIT except one, which is Apache-2.0. There are no copyleft licences in the shipped product.

The component that talks to your AI client is a self-contained executable built on a pinned Node.js runtime. Its own dependency set is MIT, ISC or BSD licensed, again with no copyleft.

A CycloneDX Software Bill of Materials is produced for each supported AutoCAD version, because the dependency set differs between them, and a further one for the bridge executable. At version 2.0.1 no shipped component on either side carries a known vulnerability, and the build fails if that stops being true.

SBOMs are available on request from security@autom8labs.io.

Assurance

Every binary and installer is code-signed as AUTOM8LABS LTD through Azure Trusted Signing.

See the Trust Center for the full assurance position and the sub-processor list.