NavisworksMCP (shuotao/NAVISWORK_MCP) is an MCP server listed on the M8ven Trust Index. It scores 56 out of 100, grade D. It declares 32 tools. No publisher has claimed this listing.

D
Caution
56/100

NavisworksMCP

Enables AI platforms to control Autodesk Navisworks via natural language, supporting model analysis, selection, data extraction, and visual management.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

shuotao

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 4 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
// tools this server exposes32 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

get_document_info

取得目前開啟的 Navisworks 文件資訊(標題、檔名、單位、模型數量)

get_model_info

取得所有已載入模型的詳細資訊(檔名、根節點、子項目數量)

get_model_tree

取得模型樹結構,可指定展開深度

get_current_selection

取得目前選擇的項目清單

select_items_by_search

透過屬性搜尋並選擇項目(例如按 Element ID、名稱等)

clear_selection

清除目前的選擇

get_item_properties

取得選中項目或搜尋項目的所有屬性(按分類和屬性名列出)

get_all_categories

取得模型中所有可用的屬性分類名稱

search_items

在模型中搜尋項目,支援多種比對條件(equals、contains、greater_than、less_than)

get_viewpoints

取得所有已儲存的視點清單

set_active_viewpoint

切換到指定名稱的已儲存視點

get_clash_tests

取得所有碰撞檢測測試清單及狀態

get_clash_results

取得指定碰撞測試的詳細結果

get_selection_sets

取得所有已儲存的選擇集

select_items_by_set

選擇指定選擇集中的所有項目

get_item_geometry_info

取得選中項目的幾何資訊(包圍盒、中心點)

zoom_to_selection

將視圖縮放至目前選擇的項目

set_item_override_color

覆蓋選中項目的顯示顏色 (RGB 0-255)

clear_override_colors

清除選中項目(或所有項目)的顏色覆蓋

hide_items

隱藏目前選擇的項目

unhide_all

取消隱藏所有項目

get_selection_set_items

取得指定 Selection Set 內的所有項目(不改變選擇狀態),包含 Search Set 自動執行

execute_search_set

執行已儲存的 Search Set(搜尋集),可選擇是否同時選擇結果

get_override_status

偵測模型中被隱藏、凍結的項目狀態概覽(用於了解模型當前的篩選狀態)

get_hidden_items

列出模型中所有被隱藏的項目

get_frozen_items

列出模型中所有被凍結的項目

batch_get_properties

批量抽取多個項目的屬性資料(從當前選擇或指定 Selection Set),可指定要抽取的欄位

get_model_statistics

模型統計分析 — 按分類/圖層/來源檔案彙總項目數量,快速了解模型組成

scan_subtree

掃描指定 NWC/NWD 子樹節點下的所有幾何元素,按 Revit Category 和 Family/Type 分組統計。用於精確掃描特定來源檔案的內容,不受全模型取樣限制。

select_subtree

選取指定子樹節點下的所有幾何元素到 CurrentSelection,可搭配 batch_get_properties 使用

hide_all_except

隱藏所有項目,僅顯示指定的子樹節點。用於隔離特定系統或 NWC 檔案的視覺化。

save_viewpoint

儲存當前視圖狀態(相機位置 + 隱藏/顯示狀態)為 Saved Viewpoint

// known CVEs in dependencies4 high1 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.0.4GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highws@8.18.0GHSA-96hv-2xvq-fx4p

ws: Memory exhaustion DoS from tiny fragments and data chunks

highxlsx@0.18.5GHSA-4r6h-8v6p-xvw6

Prototype Pollution in sheetJS

highxlsx@0.18.5GHSA-5pgg-2g8v-p4x9

SheetJS Regular Expression Denial of Service (ReDoS)

ws: Uninitialized memory disclosure

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configNAVIS_MCP_PORT
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

32/32 tools missing one or more hints — get_document_info (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_model_info (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_model_tree (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +29 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

README present

No README found

Add a README.md describing the server and its tools.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 4 high severity in production deps — @modelcontextprotocol/sdk@1.0.4 (high), ws@8.18.0 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/shuotao/naviswork_mcp?variant=verified)](https://m8ven.ai/mcp/shuotao/naviswork_mcp)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: b7056b6d8116149b07ac83c07871167e216ccdd1
code hash: 96de43d63053956bcdf09446fc5124fe0ad1ba4efc00ef78d2aa56839990c154
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client