protege-mcp v0.4.0

Safe, testable LLM-assisted authoring. Move the assistant from a "confident editor" to a "safe,
testable editor" by closing the propose → ground → verify → confirm loop and adding a re-runnable
requirements (competency-question) suite — all built by reusing shipping primitives (the single-undo
transactional apply, the embedded reasoner, Jena ARQ, OWLEntityFinder, the catalog sidecar pattern).
55 → 61 tools.

New tools

• add_competency_question / list_competency_questions / remove_competency_question / run_competency_questions — a re-runnable requirements suite. A competency question pairs an executable SPARQL query with an expected result — nonEmpty (default) / empty / count OP N (OP ∈ >=,<=,==,>,<) / exactRows — and run re-checks them all against one shared point-in-time snapshot, so a curation edit that quietly breaks a requirement is caught like a failing unit test. CQs are stored via a small storage SPI with three conventions: robot-sparql-dir (the default — a cqs/ folder of *.rq files with header-comment metadata, for ROBOT/CI interop), sidecar-manifest (a full-fidelity <basename>-cqs.json with a version: 1 contract, unknown-key-preserving, written atomically), and ontology-annotations (CQs stored inside the artifact — the fallback when the ontology is unsaved). list detects the convention(s), add/remove operate in a chosen one (explicit convention wins > single detected > default), and run is convention-agnostic. Malformed input is isolated (a bad .rq/manifest entry is skipped-with-reason, never fatal); mandatory caveats (open-world empty, truncated results/inferences) are surfaced, never silent.
• verify_ontology — run project-defined SPARQL invariants (like ROBOT verify): each queries[] item is a SELECT or ASK whose results are violations (a returned row / ASK true flags it, at the item's error/warn/info severity) — a graph-producing CONSTRUCT/DESCRIBE is not a detector and is rejected (use sparql_query for those). Runs over a shared off-EDT snapshot (UPDATE/SERVICE rejected); violations are reported as raw SPARQL bindings — never rendered through the UI thread. The overall gate fails when a violation reaches fail_on (default error); a check that cannot run — a query that errors, an include_inferred invariant with no classified reasoner, or a rejected non-SELECT/ASK form — fails fail-closed (it never silently degrades to the asserted triples and reports a false pass).
• run_qc_suite — one aggregate quality-control gate. Composable stages (default reasoner + profile + structural), plus opt-in invariants, cqs, and a reserved shacl — all evaluated against one shared snapshot and collapsed to a single verdict. A stage whose backing data is absent (no classified reasoner, no invariants, no CQs, no SHACL) is skipped with a reason, never an error; the gate is the worst ran stage versus fail_on.

Improved

• apply_changes gains verify=none | report | rollback — reasoner-verified apply. With report or rollback, the batch is applied as one undoable transaction, the reasoner is classified off the UI thread, and the result is checked for a regression caused by this batch — a class that became unsatisfiable (postUnsat \ preUnsat) or an ontology that became inconsistent. report keeps the batch and returns the verdict; rollback additionally reverts the whole batch in one undo when a regression is attributable. The pre-read → apply → classify → post-read → undo sequence runs under a server-level write mutex (MCP handlers are multi-threaded), and an intervening GUI edit between apply and re-classification degrades to report semantics rather than blind-undoing. Warm reasoner = 1 classification, cold = 2; a timeout_ms bounds each.
• search_entities is now grounding-aware (additive fields — note the ordering change below). Each hit carries a score and a match_kind (exact | prefix | substring | fuzzy — the exact tier considers every rdfs:label language variant and the IRI local name, case/whitespace/diacritic-folded), and the result adds best_match (the IRI the query grounds to, or null) and would_mint (true when a single-term query grounds to nothing, so using it as a create_* name would introduce a NEW entity — a full-IRI / Manchester / multi-word query is never flagged). This lets an assistant decide whether to reuse a term or mint one.

Behavior change

• search_entities results are now RANKED, not just display-sorted: the top-level items[] are ordered by score (exact → prefix → substring → fuzzy), then display, then IRI (a stable tiebreak so the finder's Set order can't leak). Clients that relied on the previous purely alphabetical order should sort explicitly. The count/items/truncated shape is otherwise unchanged, and every other tool's entityList ordering is untouched.

Notes

• New method-level tests for every core (F1 regression decision, F2 ranking + mint prediction incl. multi-language-label and diacritic cases, F3 expectation judging + exactRows set/bnode handling + each store's load/upsert/remove round-trip incl. malformed-skip + selection precedence, F4 violation detection + fail-closed gate, F5 stage aggregation + no-reasoner skip) and for the tool wrappers (verify_ontology / the four competency-question tools — schema, arg parsing, store selection/aggregation, and the run/remove branches, driven end-to-end over a headless OntologyAccess), plus a headless CQ add → run → remove pipeline. Three adversarial review rounds were folded in before release: an eight-finding first round; a second round that hardened verify_ontology — an include_inferred invariant with no reasoner now fails closed instead of silently degrading to the asserted triples, and a CONSTRUCT/DESCRIBE invariant is now rejected (SELECT/ASK only); and a third round that fixed run_qc_suite's aggregation — a warn/info-severity invariant that cannot run now surfaces as WARN (so fail_on=warn trips it) instead of being swallowed to PASS, and the cqs stage now surfaces per-CQ degradation caveats. Test count 1720 → 2036.
• The default robot-sparql-dir needs no new serialization dependency (plain .rq + header comments); sidecar-manifest uses JSON (jackson-databind, already a direct dependency). Requires a Java 17+ JVM (unchanged).

Install: download protege-mcp-0.4.0.jar below, or use Protégé ▸ File ▸ Check for plugins.

protege-mcp v0.3.3

Ontology-development hardening: project-governance validation, high-level curation macros, broader
reasoner explanations, and a headless end-to-end smoke test. 50 → 55 tools.

New tools

• validate_governance — audit the active ontology against project policy (complements validate_ontology's generic quality checks and run_reasoner's logic checks). Each rule is opt-in: OWL 2 profile conformance (owl_profile = DL (default) / EL / QL / RL — reports the axioms that leave the profile), an IRI policy (required_namespaces / iri_pattern — every owned entity's IRI must conform), a required annotation suite (required_annotations, incl. the specials label and definition — every owned class/property must carry each), and module ownership / import layering (check_ownership, default on — the active module must not assert logical axioms about imported terms — including via a property chain that re-axiomatises an imported super-property). The expensive profile computation runs off the UI thread (on a snapshot taken on it), so conformance-checking a large ontology does not block Protégé for the analysis.
• create_term — create a class with its curation suite in one undoable step: label, a definition (definition, default rdfs:comment), an arbitrary annotation suite, parent(s) (named or a Manchester restriction such as hasPart some Cell), and optional equivalent_to class expressions for a defined class.
• create_property — create an object/data property with its axioms in one step: label, definition, domain, range (a class expression for object; a datatype / Manchester data range for data), super_properties, characteristics (functional, transitive, symmetric, …), and an inverse_of.
• deprecate_entity — the standard obsolescence pattern in one step: owl:deprecated true plus an optional "term replaced by" pointer (IAO_0100001 by default) and any extra curation annotations. Idempotent (re-deprecating is a no-op).
• move_class — reparent a class (its subtree follows): replace the class's asserted named superclasses with a new parent, preserving anonymous restriction superclasses; keep_other_parents adds without removing, and omitting new_parent detaches the class to a root.

Improved

• get_explanations now handles any axiom_type: for a kind the justification generator cannot minimally explain (e.g. a property-hierarchy or property-characteristic entailment), it falls back to confirming whether the axiom is entailed and returning the asserted axioms that mention the same entities as structural context (clearly labelled not a minimal justification) instead of rejecting the request.
• validate_ontology gains a timeout_ms budget — the structural checks run on the model thread and are not interrupted mid-run, so this bounds how long the call waits before returning a timeout error, not the on-thread work itself.
• preview_changes description now points at apply_changes (apply the whole batch in one undoable call) alongside the single-axiom edit tools, matching the README workflow.

Notes

• New: a headless, CI-runnable pipeline smoke test (ToolPipelineTest) that drives the tool cores end-to-end — load → edit → validate → govern → diff → SPARQL — plus a manual live-Protégé checklist in docs/smoke-test.md for the GUI/reasoner/transport legs the unit tests cannot reach. Test count 84 → 97.
• Requires a Java 17+ JVM (unchanged). The OWL 2 profile checker is the OWL API's own (org.semanticweb.owlapi.profiles), already on the Protégé platform.

Install: download protege-mcp-0.3.3.jar below, or use Protégé ▸ File ▸ Check for plugins.

protege-mcp v0.3.2

SPARQL support for the active ontology — author, validate, and run queries. 47 → 50 tools.

New tools

• sparql_query — run a SPARQL 1.1 query (SELECT / ASK / CONSTRUCT / DESCRIBE) over the active ontology and its imports closure, using an embedded Apache Jena ARQ engine. Read-only: UPDATE and SERVICE are rejected, so a query never edits the model or reaches the network. The ontology's prefixes (plus rdf/rdfs/owl/xsd) are auto-prepended, and limit caps the rows/triples returned. By default it sees the asserted triples (like Protégé's SPARQL Query tab); set include_inferred=true to first materialise the active reasoner's inferences (run run_reasoner first).
• sparql_schema — discover the queryable vocabulary for writing a query: the prefix map (plus a ready-to-paste PREFIX block), classes, object/data properties (with their domains and ranges), individuals and datatypes — each with a CURIE and full IRI — plus example queries built from the ontology's own terms. Use keyword to focus on a sub-topic.
• sparql_validate — check a draft query before running it (parse-only, or dry_run for a small sample). Reports whether it parses, the query form and variables, whether sparql_query would accept it, and unknown_terms — IRIs used in the query (graph patterns, property paths, VALUES, the CONSTRUCT template, DESCRIBE targets) that are not declared in the ontology, i.e. likely typos or terms from another vocabulary.

New prompt

• author_sparql_query — guided workflow that chains the above: discover the vocabulary → draft → validate → run → iterate.

Notes

• Apache Jena ARQ is inlined into the bundle; sparql_query / sparql_validate snapshot the imports closure into a private throwaway ontology (never mutating the live model) and run off the EDT, so a query can neither edit the ontology nor reach the network.
• Requires a Java 17+ JVM (unchanged).

Install: download protege-mcp-0.3.2.jar below, or use Protégé ▸ File ▸ Check for plugins.

protege-mcp v0.3.1

Ontology Assistant attachments. The in-Protégé chat input now accepts attachments:

• Long pasted text is compacted in the transcript as [Pasted content #N: … chars] while the full body still reaches the assistant (large bodies are buffered to a temp file and referenced by path, so no paste can overflow the command line).
• Files & images via the Attach button, drag/drop, or clipboard paste become [Image #N] / [File #N: name] placeholders. Codex receives images via native --image; Claude is granted read access via --add-dir.

Privacy & robustness. Each attached file/image is copied into its own owner-only temp folder and only that single-file copy is exposed to the CLI — never the rest of its containing folder — and the copies are deleted when the turn finishes. The one-time egress consent is re-versioned and reworded to name attachments/pasted content (shown once more). A placeholder edited away before Send is reported and not sent; the clipboard-image encode runs off the EDT with a generation guard so a reset mid-encode can't inject a stale attachment.

Tool count unchanged (47). Requires Java 17+. Install via File ▸ Check for plugins, or drop protege-mcp-0.3.1.jar into Protégé's plugins/ folder.

protege-mcp v0.3.0

In-Protégé chat assistant (Architecture Approach B). A new Ontology Assistant tab and view let you converse with an assistant that reads and edits your live ontology — without leaving Protégé.

Rather than calling a model API directly, the chat drives a coding-agent CLI you already have installed — Claude Code (claude) or OpenAI Codex (codex) — pointed back at this plugin's own MCP server. So every edit flows through the same tool layer an external MCP client uses: it appears in the GUI, joins the undo stack, and obeys the read-only / confirm-each-write gates. No API key is stored by Protégé — each CLI uses your existing login.

Highlights

• Ontology Assistant tab + view — a streaming chat transcript with Send/Stop, a live token/cost readout, and a server/egress status line. Try a read ("What classes are in this ontology?") or an edit ("Create a class FooBar under Thing with label 'Foo Bar'."); Edit ▸ Undo reverts any edit.
• Pick your provider — Use Claude / Use Codex (only installed CLIs are shown); the model picker is populated from the active provider and is editable for any model your account supports (blank = the CLI's own default).
• No API key, no new outbound socket from the plugin — each CLI uses your existing login (Claude keychain/subscription; codex login). A one-time banner discloses that your prompts and the ontology content the assistant reads are sent to your model provider via the CLI.
• Inherited safety — edits go through the MCP server's gates, so read-only mode and the confirm-each-write modal apply unchanged and the chat cannot escalate past them; a Confirm each edit checkbox toggles confirmation live.
• New Settings ▸ Ontology Assistant — optional per-provider CLI path overrides (for when a Dock/Finder-launched Protégé lacks your shell PATH) and an egress-consent reset.

Notes

• The 47 MCP tools are unchanged; the chat reuses them over loopback HTTP. The MCP server starts automatically on the first chat message.
• Requires a Java 17+ JVM (unchanged), plus at least one installed and logged-in CLI (claude or codex) to use the chat assistant.

Install: download protege-mcp-0.3.0.jar below, or use Protégé ▸ File ▸ Check for plugins.

protege-mcp v0.2.2

Closes the multi-module reconstruction gaps found by rebuilding the IOF ontology (iofoundry/ontology) through the tools alone. 41 → 47 tools.

New tools

• Structured SWRL rule editing — list_rules / add_rule / remove_rule read, add, and remove swrl:Imp axioms as structured body/head atoms (class, object_property, data_property, same_as, different_from, builtin). A ?-prefixed argument is a rule variable (?name → variable_namespace + name, ?<IRI> → that IRI exactly), so named variable IRIs like iof-var:process1 reconstruct faithfully where a ?x text syntax would lose them; rule-level annotations (rdfs:label/comment/…) ride the existing annotations operand. OWLAPI 4.5.29 ships no standalone SWRL parser, so the structured form is the round-trippable primitive.
• create_ontology — mint a new empty module in the workspace and make it the active edit target (pairs with set_ontology_id), so a multi-module ontology can be built from nothing.
• write_catalog — generate/refresh an OASIS catalog-v001.xml mapping the active ontology's imports (ontology + version IRIs) to their local files, so a reconstructed module re-opens in Protégé with imports resolved offline. Catalog files live outside the OWL axiom model, so no other tool can produce them.
• diff_ontologies — axiom-level semantic diff / round-trip check between two loaded ontologies, or the active ontology against a freshly-loaded document (without adding it to the workspace); identical=true means the reconstruction is axiom-for-axiom faithful.

Notes

• OWLAPI stays at 4.5.29 (provided by Protégé 5.6.6 and shared with the live OWLModelManager); these tools need nothing newer.
• Requires a Java 17+ JVM (unchanged).

Install: download protege-mcp-0.2.2.jar below, or use Protégé ▸ File ▸ Check for plugins.

protege-mcp v0.2.1

protege-mcp 0.2.1 — tool-driven construction ergonomics

Driving a real BFO/IOF ontology (IOF Biopharma/Agent) entirely through the tools surfaced the friction points of natural-language-driven authoring. This release closes them. Additive and backward-compatible; 37 → 41 tools.

• set_active_ontology — switch which loaded ontology your edits target. load_ontology keep_active=true and add_import document=… now resolve imports without stealing the active ontology (the #1 wall in the reconstruction).
• apply_changes — apply a previewed operations[] batch in one call and one undo entry (a single undo_change reverts the whole batch, like create_class). Reports per-operation results, the new entities each add introduces, and a summary. strict=true skips any add that would mint a brand-new entity from an unrecognized IRI/name.
• set_label — upsert an rdfs:label (removes the same-language label, adds the new one). set_prefix — register/update a prefix in the active ontology's format.
• Silent-minting signal — every write tool (add_axiom, add_subclass_of, add_annotation, apply_changes) now reports the entities a change introduces, with an opt-in strict flag that refuses to fabricate one from a typo'd IRI/name.
• create_class / create_entity gain namespace (mint the IRI in a shared namespace distinct from the ontology IRI), plus label / label_lang / no_label for language-tagged or suppressed labels — no more stray untagged xsd:string labels.
• Manchester <IRI> operands now resolve inside compound class expressions (e.g. <…/Identifier> and (…)).
• Richer reads & checks — validate_ontology with_reasoner=true adds a consistency / unsatisfiable-class verdict; get_entity_context neighbours are structured {iri, display, type}; undo_change / redo_change report the axiom delta.

Requires Java 17. Install via Protégé ▸ File ▸ Check for plugins, or drop protege-mcp-0.2.1.jar into the Protégé plugins/ directory and restart.

protege-mcp v0.2.0

protege-mcp 0.2.0 — natural-language layer

• Structured JSON output from every tool (mirrored as text) so an LLM client gets machine-readable results instead of prose.
• Orientation & safety tools: get_ontology_context, get_entity_context, preview_changes (diff an edit before applying), and validate_ontology (modelling-quality audit).
• Guided MCP prompts: audit_ontology, explain_class, add_subclass_safely, find_and_fix_unsatisfiable, model_domain.
• Import-aware validate_ontology: the per-entity quality checks audit only the terms the active ontology is responsible for, so imported BFO/IOF terms are no longer false-flagged for label/definition/domain/range that lives upstream. Set include_imports=true to audit the whole imports closure.

Requires Java 17. Install via Protégé ▸ File ▸ Check for plugins, or drop protege-mcp-0.2.0.jar into the Protégé plugins/ directory and restart.

protege-mcp v0.1.2

33 tools (was 26 in 0.1.1).

load_ontology rewritten to fetch/parse off the UI thread and wire the result in with Protégé's own copy-ontology/activate path (no modal load dialogs; a slow remote fetch no longer freezes Protégé). Adds connection_timeout_ms; not undoable.

New tools

• rename_entity / delete_entity — rewrite or remove an entity (and its referencing axioms) across the active ontology; undoable.
• list_reasoners / set_reasoner — list installed reasoner plugins and choose the active one.
• execute_dl_query — Manchester class expression → reasoner equivalent / sub / super / instances (the DL Query workbench).
• get_explanations — real justifications (minimal axiom sets) behind an entailment, computed in isolation from the live model.

Install via File ▸ Check for plugins (the registry advertises 0.1.2), or download the jar below into ~/.Protege/plugins and restart Protégé on a Java 17+ JVM.

protege-mcp v0.1.1

Complete the granular (incremental) authoring surface so a rich document like IOF Core.rdf can be reconstructed by hand, plus merge/read robustness fixes. 26 tools total.

Authoring surface (add_axiom: 22 → 38 axiom types)

• declaration, annotation_assertion, sub_annotation_property_of, annotation_property_domain/range, same_individual/different_individuals, negative_object/data_property_assertion, equivalent/disjoint object & data properties, disjoint_union, has_key, datatype_definition
• Optional annotations operand on every axiom (reified owl:Axiom)
• add_annotation: typed and IRI-valued annotation values
• New ontology-header tools: set_ontology_id, add_import/remove_import, add_ontology_annotation/remove_ontology_annotation
• Data ranges accept Manchester syntax, e.g. xsd:integer[>= 0], {1, 2, 3}

Fixes

• merge_ontology_document: ontology-id collision guard, longer apply timeout, Windows path routing, unresolved-import warning, clearer destructive replace_active confirmation
• Read tools: clamp negative limit and report the true remainder

Install / update

Drop protege-mcp-0.1.1.jar into Protégé's plugins directory, or use File ▸ Check for plugins (requires Java 17+).