arcgis-mcp-bridge
100 declarative geoprocessing tools. Two isolated processes. One security floor.
Untrusted arguments, licensed runtime
An MCP tool call arrives as JSON from a language model. Handing that straight to ArcPy means letting generated text address the filesystem of a machine with a licensed ArcGIS Pro install on it. The interesting problem is not exposing geoprocessing; it is exposing it without turning the model into an unsandboxed local shell.
The answer here is two processes that do not trust each other, with the same path validation implemented independently on both sides of the boundary.
Two processes, one security floor
Layer A never imports ArcPy, so a crash or a hostile path never reaches the licensed runtime through the server process. PathGuard runs before dispatch and again inside the worker: a bypass requires defeating both.
100 tools across ten verticals
Every tool is declarative: a typed Pydantic v2 contract in, a structured NDJSON result frame out. Failures are values, not stack traces.
Overlay, buffer, dissolve, proximity, topology-aware operations.
Feature classes, fields, geodatabases, conversion, append.
Clip, mosaic, resample, project, extract by mask, zonal statistics.
Add, order, symbolise, toggle and zoom layers in a project.
Layout PDF and PNG export, legend and text element updates.
Repair geometry, eliminate parts, detect and check topology.
Hot spots, autocorrelation, mean centre, directional distribution.
Route, service area, closest facility, OD cost matrix.
Define, project, describe and validate spatial references.
Sketch-to-GIS: ORB + RANSAC registration with HSV segmentation.
The vision tool turns a photographed hand-drawn parcel boundary into geodatabase features by registering the sketch against a reference frame, then segmenting the drawn lines in HSV space.
What PathGuard actually does
Every path-bearing argument is normalised and checked against an allowed root before dispatch, then re-validated inside the worker that holds the licence. Destructive operations sit behind an explicit confirmation gate rather than a flag a model can set on its own.
The 86-test suite runs with ArcPy mocked, so contributors without a Windows licence can still verify validation, security, licence handling and geoprocessing contracts offline.