Foreman MCP connector.

What the MCP server is.

Foreman is a toolkit for BIM Managers and Project Admins running Autodesk Forma (Autodesk Construction Cloud) projects. The Foreman MCP server exposes the toolkit's capabilities — project setup, member & role administration, QA/QC rule enforcement across PDFs, custom-attribute management, file operations, transmittals, scheduled jobs, and audit activity — as a set of discoverable, typed tools over the Model Context Protocol.

Once connected, an AI client can read from and act on the Forma projects you have authorised, without needing direct access to Autodesk Platform Services credentials.

How to connect.

The Foreman MCP endpoint lives at:

https://foreman.issuelab.co/mcp

It works with any MCP client that supports streamable HTTP transport and OAuth 2.1 with PKCE. Tested clients:

• Claude.ai (Settings → Connectors → Add custom connector)
• Claude Desktop
• Claude Code CLI (claude mcp add)
• Cursor IDE

When your client first connects, you'll be sent through Foreman's OAuth 2.1 consent flow (sign in with your Autodesk or Foreman credentials, review the scopes you're granting, confirm). The client then stores a long-lived refresh token and calls the MCP endpoint with a short-lived Bearer access token for every tool call.

Authorization details.

Foreman's authorization server implements the OAuth 2.1 authorization code flow with PKCE, plus the MCP spec's metadata discovery conventions:

• Protected-resource metadata (RFC 9728): /.well-known/oauth-protected-resource
• Authorization-server metadata: /.well-known/oauth-authorization-server
• Dynamic client registration (RFC 7591): POST /connect/register
• Authorization endpoint: /connect/authorize
• Token endpoint: /connect/token
• Scopes: mcp openid profile email offline_access

Pre-registered clients exist for Claude.ai, Claude Desktop, Claude Code, and Cursor. Custom clients can self-register via dynamic client registration.

Available tools.

The server exposes 120+ typed tools across 18 categories including Project Management, Members & Roles, Files & Folders, Custom Attributes, QA & QC, Access Requests, Scheduled Jobs, and Organization Activity. For each tool you'll see its name, title, description, parameter list, and a safety classification.

The full live catalogue is at /mcp-settings?tab=tools — no login required to browse. The same payload is returned unauthenticated from GET /api/McpSettings/available-tools for programmatic consumers.

Classification stamps.

Every tool carries MCP annotations that let your client decide when to auto-approve vs. prompt the user:

• ReadTools that only fetch data — get_projects, search_files, get_qa_check_results. No side effects.
• WriteTools that create or modify without destroying — add_project_members, create_qa_ruleset, rename_file.
• DestructiveTools that remove or irreversibly change data — delete_custom_attribute_definition, remove_project_member.

Most bulk or destructive tools default to dryRun=true so your client can preview the plan before executing. Every successful write emits an audit event into the organization's activity feed.

Data handling.

The Foreman MCP server only accesses projects you have explicitly authorized for MCP use on your MCP Settings page. Files are streamed from Autodesk's APIs and processed in memory; they are not archived on Foreman's infrastructure beyond what your tenant's retention policy allows. The server does not access your AI client's conversation history, memory, or user files beyond the parameters your client explicitly passes to a tool call.

Full details are in our Privacy Policy and Security page.

Questions & feedback.

Issues with the MCP endpoint, feature requests, or compatibility reports for new MCP clients: email tech@issuelab.co. Status dashboard at /status.