Build an Autodesk Fusion MCP Server for Agentic CAD & AEC Workflows

By Deepak Bagada, CEO at SaaSNext & Principal AI Architect.

Autodesk has been shipping MCP servers across its platform in 2026, and the direction is unmistakable: the design industry is building for the agent era. The Fusion MCP servers run locally and let AI agents model and execute Fusion commands — with Fusion running, the agent can create geometry, edit parameters, and drive the design environment directly. The Product Help MCP server is a read-only service that lets AI agents outside Autodesk products securely access Autodesk's help documentation. And the Autodesk Platform Services MCP connectors open the data and geometry layers to agents. Together they form the reference pattern for agentic CAD and AEC workflows — and the MCP directory has been tracking exactly this wave as every engineering platform opens an agent surface.

This guide builds the production-grade version of that pattern: a Python FastMCP server, fusion-mcp, that wraps Fusion design automation and Platform Services into clean typed agent tools — model query, parameter listing and editing, geometry export, and design-task execution — with OAuth 2.0, session isolation, and an approval gate on design mutations. If you are connecting agents to a CAD platform in 2026, this is the reference architecture, and the same governance discipline runs through the AI workflows library.

Why a gateway over the official Fusion MCP servers

The official Fusion MCP servers are the fastest on-ramp: connect one, and an agent can drive Fusion out of the box. A custom FastMCP gateway is the right call when you need any of these:

• Session isolation. The official server operates against the running Fusion instance; a gateway can assign each agent its own session or design copy, so parallel agents never collide on the same model.
• An approval gate on mutations. The gateway decides which tools are read-only and which require an approval token — parameter edits and design changes never happen without a human sign-off.
• A narrower, audited surface. The gateway exposes exactly the tools your design agents are approved to touch, with per-agent rate limits and an audit row per call.
• Combined workflows in one call. A single run_design_task call that queries the model, computes a parameter proposal, and requests approval is painful to orchestrate against the raw API.

The deeper pattern is the same one that runs through the AI workflows library: CAD stops being a desktop tool and becomes an agent-callable surface, and the gateway is what makes that surface safe to expose. The design-industry shift is real — every major engineering platform is opening an agent surface in 2026, and the teams that govern those surfaces well will be the ones that scale agentic design without losing control of their models.

The tool surface and architecture

The gateway exposes five tools against the Fusion design environment and Platform Services:

Every query tool is read-only and session-scoped. set_parameter and run_design_task are mutation tools that require an approval token — a human gate issued by the workflow layer. That contract is what makes agentic CAD defensible in a shared design environment.

Step 1: Scaffold the Python FastMCP server

mkdir fusion-mcp && cd fusion-mcp
python -m venv .venv && source .venv/bin/activate
pip install "fastmcp[cli]" httpx

# server.py
import os
import time
import json
import threading
import uuid

import httpx
from fastmcp import FastMCP

FUSION_API = os.environ.get("FUSION_API", "https://fusion.internal/api")
APS_CLIENT_ID = os.environ["APS_CLIENT_ID"]
APS_CLIENT_SECRET = os.environ["APS_CLIENT_SECRET"]
TOKEN_URL = "https://developer.api.autodesk.com/authentication/v2/token"

mcp = FastMCP("fusion-mcp", instructions=(
    "Autodesk Fusion design tools. Query tools are read-only and session-scoped. "
    "set_parameter and run_design_task are mutation tools that require an approval token."
))

_token = {"value": None, "exp": 0}
_lock = threading.Lock()
_sessions = {}

def _access_token() -> str:
    with _lock:
        if _token["value"] and _token["exp"] > time.time() + 120:
            return _token["value"]
        r = httpx.post(TOKEN_URL, data={
            "grant_type": "client_credentials",
            "client_id": APS_CLIENT_ID,
            "client_secret": APS_CLIENT_SECRET,
            "scope": "data:read data:write",
        }, timeout=15)
        r.raise_for_status()
        body = r.json()
        _token.update({"value": body["access_token"], "exp": time.time() + body.get("expires_in", 3600)})
        return _token["value"]

def _session(agent_id: str) -> str:
    """Each agent gets an isolated design session; parallel agents never collide."""
    if agent_id not in _sessions:
        _sessions[agent_id] = f"session-{uuid.uuid4().hex[:12]}"
    return _sessions[agent_id]

@mcp.tool()
def query_model(agent_id: str, design_id: str) -> str:
    \"\"\"Return a model summary: components, bodies, and current state.\"\"\"
    sid = _session(agent_id)
    r = httpx.get(f"{FUSION_API}/designs/{design_id}/summary?session={sid}",
                  headers=_auth(), timeout=30)
    r.raise_for_status()
    return json.dumps(r.json(), indent=2)

@mcp.tool()
def list_parameters(agent_id: str, design_id: str) -> str:
    \"\"\"List user parameters with values, units, and constraints.\"\"\"
    r = httpx.get(f"{FUSION_API}/designs/{design_id}/parameters",
                  headers=_auth(), timeout=30)
    r.raise_for_status()
    return json.dumps(r.json(), indent=2)

@mcp.tool()
def set_parameter(agent_id: str, design_id: str, name: str, value: float,
                  approval_token: str = "") -> str:
    \"\"\"Propose a parameter change; requires an approval token to commit.\"\"\"
    if not verify_approval(approval_token, f"set_parameter:{name}"):
        return json.dumps({"error": "approval required; change not committed"})
    r = httpx.post(f"{FUSION_API}/designs/{design_id}/parameters",
                   json={"name": name, "value": value, "session": _session(agent_id)},
                   headers=_auth(), timeout=30)
    r.raise_for_status()
    audit_log(agent_id, "set_parameter", name, value)
    return json.dumps(r.json(), indent=2)

@mcp.tool()
def export_geometry(agent_id: str, design_id: str, format: str = "STEP") -> str:
    \"\"\"Export geometry (STEP, STL, DXF) for downstream analysis.\"\"\"
    r = httpx.post(f"{FUSION_API}/designs/{design_id}/export",
                   json={"format": format, "session": _session(agent_id)},
                   headers=_auth(), timeout=60)
    r.raise_for_status()
    return json.dumps(r.json(), indent=2)

@mcp.tool()
def run_design_task(agent_id: str, design_id: str, task: str,
                    approval_token: str = "") -> str:
    \"\"\"Run a parameterized design task; mutation is approval-gated.\"\"\"
    if not verify_approval(approval_token, f"run_design_task:{task}"):
        return json.dumps({"error": "approval required; task not executed"})
    r = httpx.post(f"{FUSION_API}/designs/{design_id}/tasks",
                   json={"task": task, "session": _session(agent_id)},
                   headers=_auth(), timeout=120)
    r.raise_for_status()
    audit_log(agent_id, "run_design_task", task)
    return json.dumps(r.json(), indent=2)

def _auth():
    return {"Authorization": f"Bearer {_access_token()}", "Accept": "application/json"}

if __name__ == "__main__":
    mcp.run()

Run the server with python server.py and it speaks MCP over stdio to whichever client you wire next. Two design details matter. First, session isolation: every agent gets its own session handle, so two agents querying or editing the same design work in isolated scopes and never collide. Second, the approval gate: set_parameter and run_design_task verify a human-issued approval token before any mutation reaches Fusion. Read-only by default, gated on mutation — the same contract that makes autonomous cloud operations defensible applies to autonomous design.

Step 2: inputSchema definitions published to agents

FastMCP derives JSON Schema from Python type hints, but pinning the contract helps agents call tools correctly:

{
  "set_parameter": {
    "type": "object",
    "properties": {
      "agent_id": { "type": "string", "description": "Agent identity for session isolation and audit" },
      "design_id": { "type": "string", "description": "Fusion design ID from query_model" },
      "name": { "type": "string", "description": "User parameter name" },
      "value": { "type": "number", "description": "New parameter value" },
      "approval_token": { "type": "string", "description": "Human-issued approval token; required to commit" }
    },
    "required": ["agent_id", "design_id", "name", "value"]
  },
  "query_model": {
    "type": "object",
    "properties": {
      "agent_id": { "type": "string" },
      "design_id": { "type": "string" }
    },
    "required": ["agent_id", "design_id"]
  }
}

Descriptions matter more in agent-facing schemas than in human API docs — the model chooses a tool off the description alone, so say what each tool returns and the access scope in every description string. An agent that understands set_parameter needs an approval token before it calls it will propose changes and wait for the gate instead of trying to force them through.

Step 3: Wire into Claude Desktop and Cursor

{
  "mcpServers": {
    "fusion-mcp": {
      "command": "python",
      "args": ["/absolute/path/to/fusion-mcp/server.py"],
      "env": {
        "APS_CLIENT_ID": "your-client-id",
        "APS_CLIENT_SECRET": "your-client-secret",
        "FUSION_API": "https://fusion.internal/api"
      }
    }
  }
}

The same mcpServers block works for Claude Desktop, Cursor, or any MCP client. The client secret belongs in your secret manager, never in a committed config file — the MCP directory security guides cover the credential-handling patterns in depth.

Step 4: OAuth 2.0 and the design-change gate

The security posture of the gateway is the pattern every design-platform MCP server should follow:

1. Read-only by default. query_model, list_parameters, and export_geometry run on a read scope. The gateway cannot mutate a design through any query path.
2. Approval-gated mutations. set_parameter and run_design_task require a human-issued approval token, single-use and short-lived, scoped to the specific change.
3. Session isolation. Every agent operates in its own session, so parallel agents cannot collide on the same model — the CAD version of the execution-lane isolation we document in the AI workflows library.
4. Audit everything. Every parameter change and design task writes an audit row with agent, change, and approval token ID. When a design changes at 2am, the log is the evidence.

Pair this with per-agent rate limits and short cache TTLs on model summaries, and the gateway is governable the way production design workflows demand.

Frequently Asked Questions

Q: What MCP servers has Autodesk shipped?

A: Autodesk ships local Fusion MCP servers that let agents model and execute Fusion commands while Fusion runs, a read-only Product Help MCP server exposing documentation, and Autodesk Platform Services MCP connectors for data and geometry.

Q: Why build a custom Fusion MCP gateway?

A: Use the official servers for a quick start. Build a custom FastMCP gateway when you need a narrower approved tool surface, session isolation between agents, an approval gate on design mutations, or per-agent audit and rate limits.

Q: How do you keep agentic CAD safe?

A: Session isolation (each agent works in its own session or copy), read-only defaults for query tools, and an approval gate on any mutation — parameter edits and design changes require a human approval token.

Q: What is the realistic agent use case?

A: A design-automation agent that queries a model, adjusts parameters against constraints, exports geometry for downstream analysis, and requests approval before committing changes — CAD as an agent-callable surface.

Q: What metadata should an agent see before editing?

A: The model's parameters, current values, units, constraints, and last modified state — enough to propose a change and have a human approve it with full context.

Closing thoughts

Autodesk's MCP servers are the design industry accepting the agent era — and the gateway in this guide is how you accept it safely. Typed tools over the Fusion surface, session isolation for parallel agents, read-only defaults, an approval gate on every mutation, and an audit trail on everything. Build it, wire it into a design-automation workflow, and CAD becomes a surface agents operate within a contract you control. Watch the latest AI news for the next design-platform MCP launch, and keep the MCP directory close as you expand the surface.