Connecting a Coding Agent to Revit: The Good, the Bad and the Ugly

Wiring a coding agent such as Claude Code, Codex or Cursor into Revit via MCP is cool, and it’s worth doing,¹ but it’s worth understanding what you’re actually buying into. This post walks through what works, what needs managing, and what’s easy to overlook.

First, how MCP connects an agent to Revit

MCP, the Model Context Protocol, is an open standard for connecting AI agents to other software.² A Revit MCP server is a small program, usually paired with an add-in inside Revit, that offers the agent a set of tools. The agent never touches Revit directly: it asks the server to run a tool by name, with some arguments, and the server makes the Revit API calls.

What those tools are makes all the difference. Some servers offer a fixed menu: get these elements, rename those sheets, set this parameter. The agent can only do what the menu allows, and each tool can be written to follow Revit’s rules properly. That’s safer, but limited: a job the menu doesn’t cover needs a new tool. Other servers add a tool that accepts free-form code: the agent writes C#, and the server compiles it and runs it inside Revit. That’s what makes them so flexible, and it’s where most of the risks in this post come from.

doc.Delete(ids);
File.Delete(path);
new HttpClient().PostAsync(url, data);

The Good

• Democratisation. Revit users with a Claude, ChatGPT or similar subscription can automate tedious work, build custom add-ins and query their model in plain English, without traditional add-in development. Less dependence on specialist development resources, and often no separate automation platform to buy.³
• Economics. For heavy regular users, the flat-rate subscription typically delivers far more inference per dollar than paying per token through the API. Independent tests in 2026 put it anywhere from several times to more than ten times the API-equivalent value, depending on the plan, the model and how fully you use it.⁴ Past the included allowance you pay roughly API rates, so the saving is the allowance itself.⁵ Limits change often, so check before you rely on them.
• Rapid prototyping. Validate an automation idea in minutes before investing in a proper add-in.
• Learning, if you engage. People can pick up the Revit API by watching the agent work, but only if they ask it why. In a 2026 randomised trial, developers who handed a new library over to an AI assistant learned it markedly worse than those who coded by hand; the ones who used it to ask conceptual questions kept up.⁶
• One-off tasks. Bulk renames, quick audits, things that never justified building a tool.

The Bad

Governance risk. An individual can wire this up on their own laptop with no IT sign-off. The MCP server runs with that person’s full rights to project files, shared drives and BIM 360 / ACC, with no guaranteed firm-wide record of what the agent changed in the model. Shadow IT, data exfiltration and model integrity, all at once.⁷ Some community Revit integrations also expose command endpoints that don’t check who is sending them. If such an endpoint listens on a network-accessible interface, another machine that can reach it may be able to submit operations without going through the agent at all. The actual exposure depends on the implementation, its configuration and the firewall.⁸ Security researchers have already shown agents being steered through MCP tools into running malicious code and leaking credentials.⁹

You’ve bypassed the agent’s guardrails. Leading coding agents, Claude Code and Codex among them, can sandbox the shell commands they run, and ask before risky actions. Neither sandbox extends to MCP servers: Claude Code’s documentation says local MCP servers run with your full access, and Codex scopes its sandbox to the commands it runs.¹⁰ A Revit MCP server hands each request to an add-in inside Revit’s process, and the most popular open-source ones include a tool that compiles C# written by the agent and runs it there.¹¹ If an integration allows arbitrary code like this, that code runs with the permissions of the Revit process, outside the agent’s shell restrictions. The agent sends a request, Revit executes with full user rights, on your machine, on your network. Revit add-ins were never sandboxed: beyond a prompt when an unsigned add-in first loads, there is no permission model.¹² What’s new is that an AI is now driving them.

Knowledge doesn’t automatically become a shared asset. Out of the box, what carries over between sessions is a few text files: instructions someone wrote by hand, and notes the agent keeps on one machine, which it treats as hints, not rules.¹³ There’s no shared, reviewed record of the firm’s standards, naming conventions, families or last month’s fixes. Each person rebuilds the same scripts, and valuable knowledge stays isolated in individual sessions. We wrote about why that matters in Where will your firm’s knowledge live in an AI-native future?

The Ugly

The agent doesn’t know what it doesn’t know about Revit. The Revit API has constraints that are easy to miss when generating code. Looking up a parameter by a name that isn’t there, working outside a transaction, touching a workshared element without ownership, loading worksets, calling anything off the main thread.¹⁴ The agent writes plausible-looking code that fails at runtime, makes changes nobody intended or, at worst, crashes Revit, often with no useful error. Research on AI coding assistants points the same way: their code is often wrong in ways that look right, and the people using them are more confident it’s correct.¹⁵

// "Set every door to a 60-minute fire rating"
var doors = new FilteredElementCollector(doc)
    .OfCategory(BuiltInCategory.OST_Doors)
    .WhereElementIsNotElementType();
Task.Run(() =>                1
{
    foreach (Element door in doors)
    {
        var p = door.LookupParameter("Fire Rating"); 2
        p.Set("60 min");               34
    }
});

The orphaned add-in problem. Unmanaged agent-generated add-ins can become one-off scripts with no owner, no versioning, no deployment pipeline and no permission model. When Revit updates, they stop loading or start throwing errors, and if the author has left, no one knows how to fix them.¹⁶ Distribution, maintenance and access control then remain significant responsibilities for any firm adopting unmanaged tools.

What to look for in a Revit AI platform

Whether a firm builds or buys, six things separate a managed setup from unrestricted code execution:

• Guardrails. Checks on every request: what the agent may change, in which models, and when it must stop and ask a person.
• An agent that knows Revit. An agent, and ideally an AI model, built around the Revit API’s rules on transactions, threading and worksharing, and around the firm’s own standards.
• Constrained operations. Defined, tested tools for routine work, so generated code is the exception rather than the default, and never runs unchecked with someone’s full rights.
• Isolated execution. When arbitrary code is necessary, it runs behind enforceable boundaries, with explicit limits on filesystem, network and model access. That takes deliberate architecture: code running inside Revit inherits Revit’s permissions, and wrapping the tool call in checks doesn’t sandbox the code itself.
• Visibility of model changes. A firm-wide record of what changed, in which model, and at whose request.
• Maintainable automation. An owner, version control, testing on each Revit release, and a way to deploy each automation to the people who need it.

Riding off into the sunset

This isn’t an argument against connecting an agent to Revit; it’s a great thing to try. It’s an argument that the raw model connection is the cheap part. The value, and the safety, sit in the layer on top: accumulated Revit knowledge, firm standards, governance, versioning and an agent that knows the API’s traps. That’s the layer BIMLOGIQ is building with Argus. Argus already shows the commands it generates before they run, and asks for approval before it runs generated code or reads or writes files on your computer. Users can approve each call or allow it for the rest of a chat.¹⁷

Talk to us about bringing AI agents into Revit safely with Argus →