Where an ODA MCP Server's file access starts, and where it stops.
Your engineers want to point an AI assistant at your models. Normally that means sending the files somewhere, and for a drive full of client work the answer is no.
It doesn't have to be. An ODA MCP Server lets an assistant read your DWG, STEP and IFC files and answer questions about them, without the files leaving your network. It can measure a part, pull quantities off a drawing, or check a model against a spec, on infrastructure you control.
The question a CIO has next is what else on that machine the assistant can reach.
Access is defined in a config file: you name the folders the server can reach. Two lines, one for the server's own scripts and one for the models to read. The boundary is the server's: nothing outside those folders can be read or returned through it, and a path that climbs out of a named folder is rejected before it opens. The assistant is a separate question — whatever access you have granted it elsewhere on that machine it keeps; what it can obtain through the server is only what you named. In network mode an uploaded file is scoped to a single client's session and is not reachable from any other.
The server carries no AI of its own. You connect your own, hosted or a local model on your own hardware, so where your data goes is your call, not ours.
Run it locally and it is a process your assistant launches, speaking over standard input and output. It opens no port and nothing listens on the network, so an air-gapped review has nothing to firewall.
Embedded in an application the boundary tightens further. The plugin inside Open STEP Viewer has no file access at all: the viewer holds the open document and passes it in.
So the capability your engineers want stops being a risk your security team has to refuse. The named folders are the whole surface the server exposes, checkable line by line, and the data stays inside your own perimeter, not in a dependency you take on trust.
Two things to get right when you set it up. The boundary is only as tight as you draw it: point a server at a whole drive and it reads a whole drive, so scope the folders deliberately. The optional DWG LISP extension is looser by design, reaching the drawing API and file system directly; it ships disabled, and belongs only in a controlled environment.
