muend/arcgis-mcp-bridge

Quick Start
arcgis-mcp-bridge requires Windows, a licensed ArcGIS Pro installation, and
Python 3.11 or newer for the bridge package.
Install the bootstrap package using **one** package manager:
Then clone ArcGIS Pro's Python environment:
If the installed console command is available on PATH,
arcgis-mcp-setup is equivalent to py -m arcgis_mcp.setup_env.
> **Important for Windows systems with multiple Python installations:** the
> setup is not complete until arcgis-mcp-bridge is installed into the
> reported arcgis-mcp-env\python.exe. Use that same interpreter for both the
> MCP server command and ARCPY_PYTHON_PATH. This prevents worker failures
> caused by packages or native extensions being loaded from another Python
> environment.
See **05 — Installation** for the complete setup and configuration.
**100 declarative geoprocessing tools. Two isolated processes. One security floor.**
A secure, local-first, asynchronous MCP server exposing ArcGIS Pro's ArcPy
engine to Claude Desktop and other MCP hosts over stdio JSON-RPC.
Technical write-up: Building a Secure MCP Bridge for ArcGIS Pro and ArcPy
| | |
|---|---|
| Catalog | 100 tools · 10 verticals |
| Tests | 86 unit tests · 86/86 passing · arcpy mocked |
| Real runtime evidence | Reproducible ArcGIS Pro MCP smoke benchmark |
| Static analysis | Ruff clean · Mypy strict clean |
| Transport | JSON-RPC 2.0 over stdio |
| License | Apache-2.0 |
---
Why arcgis-mcp-bridge?
| Feature | arcgis-mcp-bridge | geo2004/MCP-ArcGISPro | nicogis (C#/.NET) |
|---|---|---|---|
| Tools | **100** | ~15 | ~10 |
| **Dependency Sync** | **Deterministic (uv.lock)** | Imperative (requirements.txt) | Native NuGet |
| Transport | stdio JSON-RPC | file-based IPC | Named Pipes |
| Security Architecture | Documented PathGuard sandbox | None specified / default host access | None specified / default host access |
| arcpy Isolation | **Two-process architecture** | Single process execution | Add-In in-process execution |
| CI (Offline Verification) | ✅ Supported | ❌ Not available | ❌ Not available |
| License | Apache-2.0 | MIT | MIT |
---
Highlight: Sketch → GIS Pipeline
Hand-drawn parcel boundary → photo → geodatabase feature class.
ORB+RANSAC image registration, HSV ink segmentation, direct GDB commit.
No manual digitizing required.
> **Demo coming soon.** To preview the sketch-to-GIS pipeline:
> 1. Draw a polygon on paper and photograph it.
> 2. Ask Claude: *"Use extract_sketch_to_gis to register this photo
> against my basemap and commit the result to my GDB."*
> 3. The feature class appears in ArcGIS Pro — no manual digitizing.
---
00 — Example Prompts
After health_check succeeds, talk to Claude naturally:
01 — Core Architecture & Philosophy
**Layer A — Async Event-Driven Server** (arcgis_mcp/server.py).
FastMCP on the bridge interpreter. Owns the stdio channel, validates every
request against frozen Pydantic v2 contracts, dispatches work via
asyncio.create_subprocess_exec — the event loop never blocks on a
geoprocessing call and never holds a thread lock. Layer A contains **zero
module-level arcpy or cv2 imports** (verified by grep in the audit
gate); it cannot crash on Esri's native code because it never touches it.
**Layer B — Subprocess ArcPy Isolation Worker** (arcgis_mcp/worker.py).
Spawned per job on the licensed ArcGIS Pro interpreter
(ARCPY_PYTHON_PATH). The only place import arcpy is legal; cv2 loads
lazily inside the one vision tool that needs it. Worker stdout is rebound
to stderr at startup — the single sanctioned stdout write is the final
NDJSON result frame, so native ArcObjects chatter can never corrupt the
JSON-RPC channel. A native crash terminates the worker, not the server:
the parent converts a non-zero exit into a structured error frame.
**Declarative registry** (arcgis_mcp/registry.py).
Each tool is one ToolSpec(name, category, description, input_model,
worker_fn, destructive). One generic proxy factory materializes all 100
catalog MCP endpoints in Layer A; one generic run_tool dispatcher serves
them in Layer B. The catalog is exposed alongside three core endpoints:
health_check, list_layers, and execute_spatial_tool. Adding catalog
tool #101 touches two files — never the runtime loops.
Every failure crossing the process boundary is classified:
validation · security · not_found (an input path does not exist; the