ACC MCP
REMOTE · ACC-MCP.ITMARTIN24.WORKERS.DEV · SCANNED AUG 3
Autodesk Construction Cloud via APS — projects, issues, RFIs, documents, submittals.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score →
Endpoint Security77
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation is enforced on tool calls, but the challenge carries no valid RFC 9728 metadata, so a client cannot discover where to get a token. See how to fix → View diagnostics → Fail
- HTTPS check failed: the endpoint is reachable over plaintext HTTP. See how to fix → View diagnostics → Fail
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC check failed: this domain isn't protected by DNSSEC. See how to fix → View diagnostics → Fail
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability57
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 3452 tokens (~383/item across 9 items; 9 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management27
- Stability observed for 8 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities20
- Spec-recency check failed: implements MCP spec 2024-11-05; the latest is 2026-07-28. See how to fix → Fail
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
remote · acc-mcp.itmartin24.workers.dev
claude mcp add --transport http io-scanbimlabs-acc-mcp https://acc-mcp.itmartin24.workers.dev/mcp
[mcp_servers.io-scanbimlabs-acc-mcp] url = "https://acc-mcp.itmartin24.workers.dev/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"io-scanbimlabs-acc-mcp": {
"type": "remote",
"url": "https://acc-mcp.itmartin24.workers.dev/mcp",
"enabled": true
}
}
} openclaw mcp add io-scanbimlabs-acc-mcp --url https://acc-mcp.itmartin24.workers.dev/mcp --transport streamable-http
mcp_servers:
io-scanbimlabs-acc-mcp:
url: "https://acc-mcp.itmartin24.workers.dev/mcp" {
"mcpServers": {
"io-scanbimlabs-acc-mcp": {
"type": "http",
"url": "https://acc-mcp.itmartin24.workers.dev/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Aug 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 20 to 23. That category is still filling its 30-day observation window: 6 days of observed history at the previous scan, 7 at this one. The score rises as the window fills, whether or not the server changes.
- 31 Jul 26 +4
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 30 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 29 Jul 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 7 to 10. That category is still filling its 30-day observation window: 2 days of observed history at the previous scan, 3 at this one. The score rises as the window fills, whether or not the server changes.
- 28 Jul 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 27 Jul 26 0
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 26 Jul 26 60
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Probed https://acc-mcp.itmartin24.workers.dev/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=itmartin24.workers.dev | CN=YE2,O=Let's Encrypt,C=US | 9 Jun 2026 | 7 Sept 2026 | ECDSA 256 | ECDSA-SHA384 | 51b8c3464cfda01685cac764fb826f64277 |
| SANs: *.itmartin24.workers.dev, itmartin24.workers.dev | ||||||
| CN=YE2,O=Let's Encrypt,C=US (CA) | CN=Root YE,O=ISRG,C=US | 3 Sept 2025 | 2 Sept 2028 | ECDSA 384 | ECDSA-SHA384 | 4df3b15dd6c0784c507cd37b58e6f115 |
| CN=Root YE,O=ISRG,C=US (CA) | CN=ISRG Root X2,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | ECDSA-SHA384 | 872165fc34b6e5fba8add5b3705fb53a |
| CN=ISRG Root X2,O=Internet Security Research Group,C=US (CA) | CN=ISRG Root X1,O=Internet Security Research Group,C=US | 13 May 2026 | 2 Sept 2032 | ECDSA 384 | SHA256-RSA | 6c8f1dc727c7117f7baf853ac980f9cd |
DNSSEC insecure
Validation of acc-mcp.itmartin24.workers.dev. — Not signed
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| dev. | present | 60074 | 8 | Verified |
| workers.dev. | absent | Unsigned (proven) parent-signed NSEC/NSEC3 proves an unsigned delegation |
Authentication Challenged, unverified
The endpoint asked for a token, but we could not retrieve and validate the RFC 9728 metadata that tells a client how to obtain one.
| Result | Challenged, unverified |
|---|---|
| Enforced | On tool calls |
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains; preload |
| content-security-policy | default-src 'self'; script-src 'self' 'unsafe-inline' https://fonts.googleapis.com https://developer.api.autodesk.com; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: blob:; connect-src 'self' https://*.autodesk.com https://uptime.scanbimlabs.io https://developer.api.autodesk.com |
| x-content-type-options | nosniff |
| x-frame-options | DENY |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=() |
Protected resource metadata
| Retrieved | No |
|---|---|
| Problem | no_resource_metadata |
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://acc-mcp.itmartin24.workers.dev/mcp | Verified | 200 | |
| http (plaintext) | http://acc-mcp.itmartin24.workers.dev/mcp | Served over HTTP | 200 |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
acc_create_issue ~478
Create a new ACC issue (field observation, coordination clash, safety, quality, etc.) in the target project via the APS Construction Issues API. When to use: The user wants to log a new issue — e.g. 'open a high-priority issue about the leaking valve on level 3' or a downstream agent detected a defect during a model review and needs to record it for the project team. When NOT to use: Do not use to modify an existing issue (use acc_update_issue) and do not use for RFIs (use acc_create_rfi). APS scopes: data:read data:write account:read. Rate limits: ACC Issues API limited to ~100 req/min per app; APS default ~50 req/min per endpoint — batch creations with backoff. Errors: 401 (APS token expired — refresh); 403 (user lacks 'Create Issues' permission on the project or scope insufficient — surface to user); 404 (project_id not found — verify the 'b.' prefix and that the project belongs to a hub the app can see via acc_list_projects); 422 (validation — required field like title/description missing or priority enum invalid); 429 (rate limit — retry after 60s); 5xx (ACC upstream — retry with jitter, do not double-create). Side effects: Creates a persistent issue record visible to all project members. NOT idempotent — a retry on a 5xx may create duplicates; dedupe by title before retrying.
| Name | Type | Req | Description |
|---|---|---|---|
| assigned_to | string | — | Optional APS user ID (oxygen ID / ACC user UUID) of the assignee. Leave null for unassigned. |
| description | string | yes | Detailed issue description / body. Plain text, up to ~10,000 chars. Required. |
| due_date | string | — | Optional due date in ISO 8601 date format (YYYY-MM-DD). |
| priority | string | — | Issue priority. Defaults to 'medium' if omitted. |
| project_id | string | yes | ACC project ID. MUST use the 'b.' prefix literal (e.g. 'b.a1b2c3d4-...'). The worker strips the prefix internally for the Issues endpoint. Obtain via acc_list_projects. |
| title | string | yes | Short issue title, 1–255 chars. Required. |
No output schema declared.
No examples provided.
acc_create_rfi ~402
Create a new Request For Information (RFI) in an ACC project via the APS Construction RFIs API. RFI is created in 'draft' status — the project workflow owner typically transitions it to 'submitted'. When to use: The user needs a formal question-of-record to the design or GC team — e.g. 'raise an RFI asking for clarification on the Level 2 beam schedule'. RFIs are the auditable channel for clarifications; issues are for field observations. When NOT to use: Do not use for informal observations (use acc_create_issue) or to answer an existing RFI (not supported here). APS scopes: data:read data:write account:read. Rate limits: APS default ~50 req/min per endpoint per app. RFIs share the Construction API umbrella with issues (~100 req/min combined). Errors: 401 (APS token expired — refresh); 403 (user lacks RFI create permission on project); 404 (project_id not found — verify 'b.' prefix and hub membership); 422 (validation — subject/question missing or priority enum invalid); 429 (rate limit — back off 60s); 5xx (ACC upstream — retry with jitter, check for duplicate before retrying). Side effects: Creates a persistent RFI record. NOT idempotent — retry on 5xx risks duplicates; dedupe by subject before retrying.
| Name | Type | Req | Description |
|---|---|---|---|
| assigned_to | string | — | Optional APS user ID of the person the RFI is directed to. |
| priority | string | — | RFI priority. Defaults to 'medium' if omitted. |
| project_id | string | yes | ACC project ID. MUST use 'b.' prefix literal. Obtain via acc_list_projects. |
| question | string | yes | Full RFI question body. Plain text, up to ~10,000 chars. Required. |
| subject | string | yes | Short RFI subject/title, 1–255 chars. Required. |
No output schema declared.
No examples provided.
acc_list_issues ~359
List and filter issues from a single ACC project (limit 50 per call) via the APS Construction Issues API. When to use: The user or upstream agent needs to review open issues, count issues by status/priority, or look up an issue_id before calling acc_update_issue. E.g. 'show me all critical open issues on the Tower project'. When NOT to use: Do not use to fetch RFIs (use acc_list_rfis) or to search documents. APS scopes: data:read account:read. No write scope required. Rate limits: ACC Issues API ~100 req/min per app; results pageable (limit 50 here, max 200 upstream). For large projects, call once and filter client-side instead of looping. Errors: 401 (APS token expired — refresh); 403 (user lacks 'View Issues' permission on project or scope insufficient); 404 (project_id not found — verify 'b.' prefix and hub membership via acc_list_projects); 422 (invalid filter value — check status/priority spelling); 429 (rate limit — back off 60s); 5xx (ACC upstream — retry with jitter). Side effects: None. Read-only and idempotent.
| Name | Type | Req | Description |
|---|---|---|---|
| assigned_to | string | — | Optional assignee APS user ID filter. Accepted but not currently forwarded as a URL filter by this server — filter client-side if needed. |
| priority | string | — | Optional priority filter. Typical values: critical, high, medium, low. |
| project_id | string | yes | ACC project ID. MUST use 'b.' prefix literal. Obtain via acc_list_projects. |
| status | string | — | Optional status filter. Typical values: open, in_review, closed, draft. |
No output schema declared.
No examples provided.
acc_list_projects ~282
Enumerate every ACC and BIM 360 project the authenticated APS app can see by walking all accessible hubs and their project lists. When to use: The agent needs to discover project IDs before calling any other tool (e.g. the user says 'show me my projects' or 'find issues in the Tower project' and no project_id is known yet). Also useful to confirm hub membership for a project. When NOT to use: Do not call this repeatedly in a loop — cache the result; if the user already supplied a project_id starting with 'b.', skip discovery. APS scopes: data:read account:read. No write scope needed. Rate limits: APS default ~50 req/min per app per endpoint; BIM 360 hubs endpoints are pageable (limit 200). This tool fans out 1 hubs call + N project calls (one per hub) so call it sparingly on tenants with many hubs. Errors: 401 (APS token expired — refresh and retry once); 403 (app not provisioned in the BIM 360/ACC account — ask user to have an account admin add the APS client_id); 404 (rare, indicates hub deleted mid-call); 429 (rate limit — back off 60s); 5xx (ACC upstream — retry with jitter). Side effects: None. Read-only and idempotent.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
acc_list_rfis ~282
List and filter RFIs from a single ACC project (limit 50 per call) via the APS Construction RFIs API. When to use: The user wants to review open RFIs, count outstanding ones, or look up an RFI ID. E.g. 'how many RFIs are still open on the Tower project?' When NOT to use: Do not use for issues (use acc_list_issues) or document search (use acc_search_documents). APS scopes: data:read account:read. No write scope required. Rate limits: APS default ~50 req/min per endpoint; ACC Construction API shared ~100 req/min cap. Pageable (limit 50 here; upstream max 200). Errors: 401 (APS token expired — refresh); 403 (user lacks RFI view permission); 404 (project_id not found — verify 'b.' prefix and hub membership); 422 (invalid filter value); 429 (rate limit — back off 60s); 5xx (ACC upstream — retry). Side effects: None. Read-only and idempotent.
| Name | Type | Req | Description |
|---|---|---|---|
| project_id | string | yes | ACC project ID. MUST use 'b.' prefix literal. Obtain via acc_list_projects. |
| status | string | — | Optional RFI status filter. Typical values: draft, submitted, open, answered, closed, void. |
No output schema declared.
No examples provided.
acc_project_summary ~374
Fetch the full ACC project metadata record (name, type, status, dates, extension attributes) for a single project via APS Data Management. If hub_id is omitted the tool picks the first accessible hub, which may be wrong on multi-hub tenants. When to use: The user asks 'tell me about project X' or an agent needs project metadata (start/end dates, type, Forma/BIM 360 flavor) before deciding which downstream tool to call. When NOT to use: Do not use as a cheap existence check — prefer acc_list_projects which returns hub_id with every project and is one call regardless of tenant size. APS scopes: data:read account:read. Forma / BIM 360 hubs endpoints only require data:read. Rate limits: APS default ~50 req/min per endpoint; BIM 360 hubs endpoints pageable (limit 200). Cache results for the session. Errors: 401 (APS token expired — refresh); 403 (user lacks project view or app not in account); 404 (project not in the chosen hub — supply the correct hub_id, or call acc_list_projects first); 422 (malformed project_id — confirm 'b.' prefix); 429 (rate limit — back off 60s); 5xx (ACC upstream — retry). Side effects: None. Read-only and idempotent.
| Name | Type | Req | Description |
|---|---|---|---|
| hub_id | string | — | Optional ACC/BIM 360 hub ID. Also uses the 'b.' prefix literal. If omitted, the first hub returned by APS is used — prefer supplying this explicitly on multi-hub tenants to avoid 404s. |
| project_id | string | yes | ACC project ID. MUST use 'b.' prefix literal (this endpoint — unlike Issues/RFIs — wants the prefixed form). Obtain via acc_list_projects. |
No output schema declared.
No examples provided.
acc_search_documents ~365
Full-text search the ACC Docs repository of a project for drawings, specs, submittals, and other files via the APS Data Management search endpoint. When to use: The user wants to find a document by keyword (filename, sheet number, or metadata match). E.g. 'find the latest A-201 sheet' or 'search for mechanical specs on Tower project'. When NOT to use: Do not use to upload a file (use acc_upload_file); do not use to fetch issues/RFIs. If you already have a document URN, fetch it directly with an agent that has Data Management folder/item access. APS scopes: data:read account:read. No write scope required. Rate limits: APS Data Management ~50 req/min per app per endpoint; pageable (limit 200 upstream). Avoid tight query loops. Errors: 401 (APS token expired — refresh); 403 (user lacks Docs view permission on the project); 404 (project_id not found — verify 'b.' prefix and hub membership); 422 (invalid filter syntax — simplify query text); 429 (rate limit — back off 60s); 5xx (ACC upstream — retry with jitter). Side effects: None. Read-only and idempotent.
| Name | Type | Req | Description |
|---|---|---|---|
| document_type | string | — | Optional APS document type filter (e.g. 'items:autodesk.bim360:File', 'items:autodesk.bim360:Document'). |
| project_id | string | yes | ACC project ID. MUST use 'b.' prefix literal. The worker re-adds the prefix for Data Management URL formatting. Obtain via acc_list_projects. |
| query | string | yes | Free-text search string matched against filenames, titles, and indexed metadata. 1–500 chars. |
No output schema declared.
No examples provided.
acc_update_issue ~376
Patch an existing ACC issue — change status, priority, assignee, or description via the APS Construction Issues API. When to use: The user asks to close/reopen/escalate an issue, reassign it, or edit its body. Typical agent flow: acc_list_issues → pick an id → acc_update_issue. When NOT to use: Do not use to create issues (acc_create_issue) or to add comments (not supported by this server). APS scopes: data:read data:write account:read. Rate limits: ACC Issues API ~100 req/min per app; APS default ~50 req/min per endpoint. Errors: 401 (APS token expired — refresh); 403 (user lacks edit permission or status transition not allowed by project workflow); 404 (project_id or issue_id not found — verify 'b.' prefix on project_id and that issue_id belongs to that project); 422 (validation — invalid status/priority enum or illegal state transition); 429 (rate limit — back off 60s); 5xx (ACC upstream — retry with jitter). Side effects: Mutates the issue record. Idempotent when the same body is resent (PATCH semantics) — safe to retry.
| Name | Type | Req | Description |
|---|---|---|---|
| assigned_to | string | — | APS user ID of the new assignee. Omit to leave unchanged. |
| description | string | — | Replacement description body. Plain text. |
| issue_id | string | yes | UUID of the issue to update, as returned by acc_list_issues or acc_create_issue. |
| priority | string | — | New priority. |
| project_id | string | yes | ACC project ID. MUST use the 'b.' prefix literal. Obtain via acc_list_projects. |
| status | string | — | New status. Project workflow may forbid certain transitions (e.g. draft → closed). |
No output schema declared.
No examples provided.
acc_upload_file ~534
Upload a file from a public source URL into an ACC project folder. Runs the full four-step APS Data Management flow: top-folder discovery → storage object creation → OSS PUT of bytes → first-version item creation. When to use: The user wants to push a document/photo/model into ACC Docs — e.g. 'upload this site photo to the Tower project Photos folder' or an automation needs to archive an exported report into Project Files. When NOT to use: Do not use for files already in ACC; do not use for files behind auth-gated URLs (fetch step is an unauthenticated GET). For very large files (>100MB), prefer the chunked/signed-S3 upload flow, not this single-PUT implementation. APS scopes: data:read data:write data:create account:read. Rate limits: APS Data Management ~50 req/min per endpoint; OSS upload bandwidth typically 100 MB/min per app. This tool issues 3–5 APS calls per upload, so budget accordingly. Errors: 401 (APS token expired — refresh); 403 (user lacks folder write permission — ask account admin to grant 'Edit' on folder); 404 (project_id not found or folder_path does not match any top folder — verify 'b.' prefix, hub membership, and folder name); 422 (invalid file_name or conflicting version); 429 (rate limit — back off 60s); 5xx (ACC/OSS upstream — retry with jitter BUT be cautious: storage object may already be created so reuse, do not re-create). Also: if source file_url returns non-2xx, the tool throws before touching ACC. Side effects: Creates a storage object, uploads bytes, and creates a versioned item in the target folder. NOT idempotent — a retry may create a duplicate item with a new version. Surface the returned item_id to the user to avoid re-uploads.
| Name | Type | Req | Description |
|---|---|---|---|
| file_name | string | yes | Destination filename in ACC, including extension. 1–255 chars. Avoid path separators. |
| file_url | string | yes | Publicly fetchable HTTPS URL of the source file. Must return 2xx to an unauthenticated GET. Max practical size ~100MB for this single-PUT implementation. |
| folder_path | string | — | Case-insensitive substring of the target top-level folder's display name. Defaults to 'Project Files'. Common values: 'Project Files', 'Plans', 'Photos', 'Submittals'. |
| project_id | string | yes | ACC project ID. MUST use 'b.' prefix literal. Obtain via acc_list_projects. |
No output schema declared.
No examples provided.