Revit (HassanElmathary) MCP Server
revit-mcp-server
npm
v2.0.1
Published by hassanelmathary — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
MCP Server for Autodesk Revit — 179 AI-powered tools for BIM automation. Works with Claude Desktop, Cursor, Windsurf, and any MCP client. Supports Revit 2020–2026.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 4 = 96. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −3 | capability blast radius (moderate) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 2
medium Hardcoded egress to an external endpoint (build/integrations/notion-client.js)MTC-SRC-003
In the server's implementation (`build/integrations/notion-client.js:101`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const response = await fetch(`https://api.notion.com/v1/databases/${databaseId}/query`, { method: "POST",
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/integrations/notion-client.js
medium Dynamic module load from a non-literal (build/tools/register.js)MTC-SRC-005
In the server's implementation (`build/tools/register.js:17`): Loading a module chosen at runtime (from a variable) can pull in and run attacker-influenced code paths. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const module = await import(importPath); const registerFn = Object.keys(module).find((key) => key.startsW
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server build/tools/register.js
Tools 179
Each tool and what it can reach — statically extracted from the published source.
export_to_excelnetwork egressexport_to_google_sheetsnetwork egressexport_to_notionnetwork egressexport_to_powerbinetwork egressexport_to_sqlitenetwork egressadd_revisionno sensitive capabilityadd_shared_parameterno sensitive capabilityai_analyze_datano sensitive capabilityai_analyze_modelno sensitive capabilityai_chatno sensitive capability
Show 169 more tools ↓
ai_clear_historyno sensitive capabilityai_element_filterno sensitive capabilityai_generateno sensitive capabilityai_generate_codeno sensitive capabilityai_map_fieldsno sensitive capabilityai_summarize_and_pushno sensitive capabilityalign_elementsno sensitive capabilityalign_viewportsno sensitive capabilityapply_view_templateno sensitive capabilityaudit_modelno sensitive capabilityauth_statusno sensitive capabilityauto_join_elementsno sensitive capabilityauto_renumberno sensitive capabilitybatch_create_sheetsno sensitive capabilitybatch_modify_parametersno sensitive capabilitybatch_modify_thicknessno sensitive capabilitybulk_parameter_transferno sensitive capabilitycad_to_linesno sensitive capabilitycategory_to_worksetno sensitive capabilitychange_link_pathno sensitive capabilitychange_typeno sensitive capabilitycheck_links_statusno sensitive capabilitycheck_naming_conventionsno sensitive capabilitycheck_room_complianceno sensitive capabilitycheck_warningsno sensitive capabilityclose_documentno sensitive capabilityclose_viewno sensitive capabilitycolor_elementsno sensitive capabilitycompare_snapshotsno sensitive capabilityconnect_mep_elementsno sensitive capabilityconvert_categoryno sensitive capabilitycopy_elementno sensitive capabilitycopy_from_linkedno sensitive capabilitycreate_ceilingno sensitive capabilitycreate_checkpointno sensitive capabilitycreate_curtain_wallno sensitive capabilitycreate_detail_arcno sensitive capabilitycreate_detail_linesno sensitive capabilitycreate_dimensionno sensitive capabilitycreate_ductno sensitive capabilitycreate_electrical_circuitno sensitive capabilitycreate_elevation_viewsno sensitive capabilitycreate_family_extrusionno sensitive capabilitycreate_filled_regionno sensitive capabilitycreate_flex_ductno sensitive capabilitycreate_floorno sensitive capabilitycreate_gridno sensitive capabilitycreate_legendno sensitive capabilitycreate_levelno sensitive capabilitycreate_line_based_elementno sensitive capabilitycreate_mep_spaceno sensitive capabilitycreate_model_linesno sensitive capabilitycreate_new_familyno sensitive capabilitycreate_new_projectno sensitive capabilitycreate_pipeno sensitive capabilitycreate_point_based_elementno sensitive capabilitycreate_railingno sensitive capabilitycreate_roofno sensitive capabilitycreate_roomno sensitive capabilitycreate_scheduleno sensitive capabilitycreate_section_viewsno sensitive capabilitycreate_sheetno sensitive capabilitycreate_spot_elevationno sensitive capabilitycreate_stairsno sensitive capabilitycreate_tagno sensitive capabilitycreate_text_noteno sensitive capabilitycreate_viewno sensitive capabilitycreate_viewportno sensitive capabilitycreate_wallno sensitive capabilitycrop_region_syncno sensitive capabilitydeep_purgeno sensitive capabilitydelete_elementsno sensitive capabilitydelete_empty_groupsno sensitive capabilitydelta_syncno sensitive capabilitydetach_from_centralno sensitive capabilityduct_sizingno sensitive capabilityedit_familyno sensitive capabilityedit_scheduleno sensitive capabilityedit_sketchno sensitive capabilityexport_dwgno sensitive capabilityexport_revit_datano sensitive capabilityexport_scheduleno sensitive capabilityexport_view_imageno sensitive capabilityfilter_selectionno sensitive capabilityfind_cad_importsno sensitive capabilityfind_duplicatesno sensitive capabilityfind_replace_namesno sensitive capabilitygenerate_legendno sensitive capabilityget_current_view_elementsno sensitive capabilityget_current_view_infono sensitive capabilityget_elementsno sensitive capabilityget_familiesno sensitive capabilityget_gridsno sensitive capabilityget_levelsno sensitive capabilityget_line_stylesno sensitive capabilityget_link_infono sensitive capabilityget_linked_modelsno sensitive capabilityget_materialsno sensitive capabilityget_mep_systemsno sensitive capabilityget_model_statisticsno sensitive capabilityget_parametersno sensitive capabilityget_phasesno sensitive capabilityget_project_infono sensitive capabilityget_roomsno sensitive capabilityget_schedulesno sensitive capabilityget_selected_elementsno sensitive capabilityget_sheetsno sensitive capabilityget_sketchno sensitive capabilityget_sqlite_snapshotsno sensitive capabilityget_viewsno sensitive capabilityget_warningsno sensitive capabilityget_worksharing_infono sensitive capabilitygoogle_sign_inno sensitive capabilitygoogle_sign_outno sensitive capabilitygoogle_signinno sensitive capabilitygroup_elementsno sensitive capabilityimport_data_from_csvno sensitive capabilityinverse_selectionno sensitive capabilitylist_commandsno sensitive capabilitylist_google_spreadsheetsno sensitive capabilityload_familyno sensitive capabilitymanage_link_positionno sensitive capabilitymirror_elementno sensitive capabilitymodify_object_stylesno sensitive capabilitymodify_parameterno sensitive capabilitymove_elementno sensitive capabilityollama_chatno sensitive capabilityopen_documentno sensitive capabilityopen_viewno sensitive capabilityoverride_element_in_viewno sensitive capabilityparameter_case_convertno sensitive capabilityplace_view_on_sheetno sensitive capabilitypost_commandno sensitive capabilitypreview_codeno sensitive capabilityprint_sheetsno sensitive capabilitypurge_unusedno sensitive capabilityread_google_sheetsno sensitive capabilityread_notion_databaseno sensitive capabilityreassign_levelno sensitive capabilityrelinquish_allno sensitive capabilityreset_viewno sensitive capabilityresolve_warningsno sensitive capabilityrollback_to_checkpointno sensitive capabilityroom_to_floorno sensitive capabilityrotate_elementno sensitive capabilitysave_as_documentno sensitive capabilitysave_documentno sensitive capabilitysave_familyno sensitive capabilityselect_by_parameterno sensitive capabilityselect_by_worksetno sensitive capabilityselect_elementsno sensitive capabilitysend_code_to_revitno sensitive capabilityset_line_styleno sensitive capabilityset_materialno sensitive capabilityset_phaseno sensitive capabilityset_sketch_profileno sensitive capabilityset_sun_settingsno sensitive capabilityset_view_propertiesno sensitive capabilityset_visual_styleno sensitive capabilityset_worksetno sensitive capabilitysnap_beams_to_columnsno sensitive capabilitysync_to_centralno sensitive capabilitytag_all_in_viewno sensitive capabilityundo_last_operationno sensitive capabilityunload_linksno sensitive capabilityvalidate_parametersno sensitive capabilitywall_floor_syncno sensitive capabilityzoom_to_elementno sensitive capabilityzoom_to_fitno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (179 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v2.0.1 latest |
A 96/100 | 2 | 1.13.0 | 2026-09-07 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan revit-mcp-server --onlineOther implementations of Revit 4
Independent packages implementing the same tool, scanned with the same engine. Compare all 5 side by side →
MCP Server for Revit integration - AI-Powered Revit Control
MCP server for interacting with Autodesk Revit through AI assistants like Claude
revit integration through the Model Context Protocol
Enhanced Revit MCP server with AutoCAD, PDF, and Excel integration. Includes elevator automation, floor duplication, intelligent element search, and cross-platform data exchange. Secure implementation with authentication and rate limiting.
More in Developer Tools
Hotel booking MCP server — 300K+ properties, real confirmation numbers, loyalty programs. Builders monetize every booking via Stripe Connect. The first MCP server that completes real hotel reservations inside AI conversations.
Manage AdGuard Home through AI assistants
Read-only Azure DevOps for MCP clients using only your existing browser session — no PAT, no Azure CLI. Browse work items, pull requests, comments, attachments and Artifacts feeds across every project, repo and feed you can access.
MCP server for Adobe Experience Manager Assets integration development
Servidor MCP para el tiempo oficial de España (API pública OpenData de AEMET). Predicción, observación y avisos como herramientas MCP tipadas.
A standalone MCP stdio bridge for Affinity by Canva's local MCP SSE server.