ArcGIS Pro MCP Studio 0.3.1 — self-signed preview

Self-signed distribution of ArcGIS Pro MCP Studio 0.3.1. The add-in and gateway executable are signed; explicit certificate trust is required. This is a development preview, not a publicly trusted certificate or Esri endorsement.

Download ArcGISProMCP-0.3.1-win-x64-self-signed-preview.zip and SHA256SUMS. The public certificate is included in the ZIP and available separately. Follow the installation and trust guide.

Certificate thumbprint: 4F82B3AC72D5A9F55102CA2A7D101B77E0AC51E9. Verify publisher identity independently before trusting it. Certificate expires October 17, 2027; signatures are not timestamped.

This release reuses the verified upstream v0.3.1 binaries with signatures and updated documentation. Its tag records documentation updates, not a new binary build. The original v0.3.1 release remains available.

Validation: upstream download checksum verified, add-in cryptographic signature verified, executable signer checked, and every regenerated inner checksum verified after ZIP extraction. Live installation/approval acceptance of the signed artifact remains pending. Existing live acceptance evidence covers only the earlier build it names.

ArcGIS Pro MCP Studio v0.3.1

Patch release: installation that works for a first-time user, and documentation and landing-page accessibility fixes. Operation results now use camelCase keys consistently, which changes some result key names; the gateway tools and the approval model are unchanged.

Changed

• Breaking for clients: Operation results use camelCase keys throughout data, at every depth, on success, on failure and in dry runs. Results built from member shorthand or records were serialized with .NET default names and mixed PascalCase into otherwise camelCase payloads (previously gp.run returned IsFailed, IsCanceled, ErrorCode, ReturnValue and messages with Text/ErrorCode where gp.query returned isFailed, project.open and project.save returned Name, and project.get returned Project/Revision/CapturedAt). Also renamed: map.list, map.activate, layer.list, layer.set-appearance, layer.set-elevation, basemap.set, layout.list, layout.inspect, layout.activate, layout.set-text, symbology.set-simple and label.configure (name, plus isVisible/transparency on layers); map.ensure, layout.ensure and layout.add-map-frame (id, name, created, ...); layer.add (id, name, map, source, requestedSource, created, repaired, replaced, dataSourceStatus); feature.layer.describe (name, and name, aliasName, isNullable, isEditable, length per field); metadata.get/metadata.update (metadata.title, summary, description, tags, credits, useLimitations, and changed); layout.set-frame-extent (scale, heading, pitch, x, y, z, viewportWidth, viewportHeight); style.search (name, category, tags); arcpy.inspect-script (sha256); arcpy.run-script (exitCode); and the generic dry run (risk, executionTarget). The declared output schemas changed to match. Keys that are user data are unchanged: attribute field names in feature.query and table.query rows. Clients that read the PascalCase keys must switch.

Fixed

• Install instructions used a server path that did not exist in the bundle (C:\ArcGISProMCP\0.3.0\server\...; the zip has a single ArcGISProMCP-<version>-win-x64-development-preview root folder). README, the landing page and the deployment guide now say to extract into C:\ArcGISProMCP\ and use C:\ArcGISProMCP\ArcGISProMCP-<version>-win-x64-development-preview\server\arcgis-pro-mcp.exe.
• The runtime requirement is now exact: the ".NET Runtime 10.x (x64)" (not the SDK) from the .NET download page, checked with dotnet --list-runtimes.
• Client setup covers Claude Desktop (where the config file is, merging into an existing mcpServers block, quitting from the tray), Claude Code (claude mcp add --scope user, claude mcp list), VS Code (.vscode/mcp.json with servers) and other MCP clients, with a warning not to set ARCGIS_PRO_MCP_AUTONOMOUS_MODE in the client entry.
• New install steps: verify the downloaded zip against the release SHA256SUMS with Get-FileHash, unblock it before extracting, allow unsigned add-ins (Project > Add-In Manager > Options), and a verify step (dockpane status, 16 tools, a first question).
• Troubleshooting for arcgis_unavailable, arcgis_host_not_found, arcgis_host_ambiguous, arcgis_host_selector_invalid and bridge_disabled, a missing add-in or runtime, and a client that reports the server failed; the arcgis_host_* and bridge_disabled codes are added to the reference error table. Upgrade and uninstall steps are documented.
• docs/deployment.md is split into "Install (users)" and "Build and release (maintainers)", with a table of contents; maintainer history moved to the acceptance evidence page.
• The release bundle now contains INSTALL.txt, plain-text install steps with absolute links, so the steps work offline after extraction.
• Docs name the add-in UI as it appears: the MCP Studio button on the Add-In tab opens the ArcGIS MCP pane. The supported ArcGIS Pro version is stated as ArcGIS Pro 3.7 (tested on 3.7.1).
• Machine-specific paths in examples (docs/arcpy.md, docs/acceptance/README.md, script help) are replaced with placeholders.
• Readability and accessibility: a plain-language README introduction, a terms box in the documentation hub, text alternatives before the Mermaid diagrams, docs/security.md and docs/reference.md split into sections with a table of contents, and on the landing page a list role for the install steps, a focusable main landmark, a navigation link to "What the model gets" and a download button that names the asset.
• References to the private-history commit e7deee2 now also give the public commit c976c51.

---

Latest committed live acceptance evidence: docs/acceptance/2026-10-03-e7deee2 (commit e7deee2). It covers only the commit, ArcGIS Pro version and sections it names.

Unsigned development preview. Verify the bundle against SHA256SUMS and its inner checksums.sha256, then follow deployment.

ArcGIS Pro MCP Studio v0.3.0

Second development preview: typed MCP results with output schemas, resources and prompts; geoprocessing discovery, risk tiers and dry runs; approval for project and feature edits; deterministic agent evaluations; synthetic CC0 test data; a live operation matrix over every operation; and committed live ArcGIS Pro acceptance evidence, including the first full operation matrix run. Unsigned; not a production release.

Added

• Live acceptance tooling and committed evidence. tools/run-acceptance.ps1 (Windows PowerShell 5.1 compatible) records the commit, .NET and ArcGIS Pro facts, and the hashes of the built and loaded add-in DLLs, runs the live harnesses by section, and with -Commit writes docs/acceptance/<date>-<sha7>/ (manifest.json, summary.md, SHA256SUMS). Committed manifests list only evidence the folder contains, with paths relative to it ("evidencePathsRelative": true), and the committed stress/summary.json names each layout capture by its committed image (images/layout-<case>.png). The script rejects an explicit -PipeName that is not a live ArcGIS Pro discovery record, reports ambiguous cached add-in DLLs, and records -VisuallyInspected notes (visuallyInspected[]) and their -VisualNotesSource, and -RunNotes disclosures about how the run was carried out (runNotes[] and a "Run notes" section of summary.md). A hand-written ANNEX.md at a folder root, outside SHA256SUMS and titled as added after the run, is the only file allowed in a committed folder after the run. docs/acceptance/README.md defines the folder contract; a Core test validates every committed manifest and requires each listed evidence path to exist (folders that predate relative paths are exempt). The first two evidence runs, on 2026-09-28 and 2026-09-29, covered verify, the loaded-DLL match, host probe, the MCP smoke test and the three bundled urban workflows x 3 runs on ArcGIS Pro 3.7.1 in default mode, with layouts visually inspected. They used the earlier third-party test data, so their folders are kept in the private development archive only (see Public history). Autonomous mode and the feature/GP/ArcPy section are not covered.
• First full live operation matrix evidence: docs/acceptance/2026-10-03-e7deee2 (commit e7deee2, ArcGIS Pro 3.7.1.1904, default mode) adds the operation matrix to verify, the DLL match, smoke and 3 workflows x 3 runs: 41/41 operations covered, 90/90 cases passed, eight dockpane approval cards (7 approved, 1 denied). The cards were decided by Claude through computer use at the maintainer's direction, not by the maintainer's own clicks; the first project.open card expired and was re-queued, and ArcGIS Pro's modal "Save all edits?" prompt during the final project.open was answered by the same means, which is what saved the matrix's feature edits (annex). Autonomous mode and the separate feature/GP/ArcPy section are not covered.
• ARCGIS_PRO_MCP_REVISION_LOG=1 diagnostics: the host logs every workspace revision change with the state behind it (project URI, map and layout names), the event behind each revision advance and the outcome and timing of every post-write settle (settle-ok, settle-unsettled or settle-timeout with drain and sampling milliseconds, sample count and published revision), to one file per ArcGIS Pro process. The log stops growing at 50 MB, and log lines are not built while logging is off. tools/analyze-revision-log.py (standard library only) attributes each settle to the audited operation that wrote it and reports, per operation, the settle count, budget-cap rate, unsettled count and p50/p95 drain, sample and total times. See deployment.
• SECURITY.md with supported versions, private reporting through GitHub security advisories, and a threat model summary.
• CONTRIBUTING.md with prerequisites, build, test and packaging commands, and pull request conventions.
• This changelog and a public roadmap.
• Bundled workflows are embedded in ArcGISProMCP.Core and seeded into %LOCALAPPDATA%\ArcGISProMCP\workflows at start-up, so workflow_list is populated on a fresh install. Seeding is a no-op once a workflow is present; existing files are never overwritten.
• Workflow operation allowlists: an optional allowedOperations list on workflows, enforced on save and run and reported as the validation issue operation_not_allowed. Operation descriptors gain executesUserCode (true for gp.run and arcpy.run-script), which registry_search and registry_browse entries also report. Allowlist entries are operation ids and are not version-pinned.
• registry_search accepts capabilities and maxRisk filters.
• Approval cards show a "Runs user code" warning for arcpy.* runs and for gp.run requests that use a custom toolbox (.pyt/.atbx/.tbx) or a Python expression; matching gp.run results carry a user_code_execution notice.
• Audit records gain kind (operation, dry-run or approval), autonomousBypass, decision and actor. Unknown operation ids and every local approve/deny decision are now audited. An audit write failure for an unknown operation id adds the audit_write_failed notice like every other invocation, and a failed approval audit write in the dockpane is reported in the activity feed.
• Audit log rotation: operations.jsonl rotates once it exceeds 16 MiB and the newest five rotated files are kept. The log is appended through a handle that shares read, write and delete access with other processes; if rotation fails (for example while another ArcGIS Pro process holds the file), it is skipped and the record is still appended.
• MCP resources: arcgis://project/state plus templates for operations, workflows (id@version), skills and observation handles.
• MCP prompts: one per bundled skill (skill.<id>) and, while ArcGIS Pro is running, one per saved workflow (run.<id>) with arguments from the workflow parameters.
• Typed tool results: every tool returns { ok, result, error } as structuredContent (and the same JSON as its text block) with an outputSchema, and sets isError on failure with error = code, message, retryable, revision. registry_invoke and workflow_run results with success: false are errors that keep result. Bridge results are typed records shared by the add-in and the gateway (ArcGISProMCP.Bridge.Protocol.BridgeContracts).
• Every tool declares readOnlyHint, destructiveHint, idempotentHint and openWorldHint (always false). Only registry_invoke and workflow_run are destructive.
• registry_describe returns resultSchema, the JSON schema of the operation's registry_invoke result envelope. Its data member is the operation's outputSchema, now declared by 15 stable-shape operations (project.get, map.list, layer.list, feature.*, table.query, table.statistics, metadata.get, layout.list, layout.inspect, view.capture); data stays unconstrained for the rest, including gp.*.
• registry_invoke accepts dryRun: the operation is validated statically and never executed, needs no revision or approval token, and neither queues a review nor consumes a token. A completed dry run is not isError even when it reports valid: false. Combining dryRun with idempotencyKey fails with dry_run_idempotency_conflict.
• approval_status accepts waitSeconds (0-120) to wait for the dockpane decision instead of polling. Each wait holds a pipe slot, so the host allows at most two concurrent waits; further calls return the current status immediately with a waitNotice asking the client to poll.
• tests/ArcGISProMCP.Server.Tests: in-process MCP client/server harness with a scriptable fake bridge and tools/list, resources/list and prompts/list snapshots (UPDATE_SNAPSHOTS=1 regenerates them).
• Geoprocessing operations gp.search and gp.describe (ReadOnly) over the installed system toolbox metadata, returning execution names, risk tiers and the positional parameter signature gp.run expects.
• gp.query (ReadOnly, no review) runs only the allowlisted read-only system tools management.GetCount, management.GetRasterProperties and management.GetCellValue, resolved against the system toolboxes, with no map outputs, no overwrite and no history.
• Geoprocessing risk tiers (UserCode, Destructive, ConsumesCredits, ReadOnlyQuery, Standard). Approval cards for gp.run say "Modifies/deletes input data in place" or "Consumes ArcGIS Online credits"; results carry gp_mutates_input, gp_consumes_credits or gp_tool_not_indexed notices.
• Static gp.run dry runs: operations can implement IDryRunnableOperation; gp.run dry runs validate parameters against the catalog and report the tier, confirmation, user-code and autonomous-refusal flags without executing. ArcGIS Pro has no validate-only geoprocessing API, so this is static validation, not the tool's own validation.
• The registry now has 41 operations (39 without the opt-in ArcPy pair); the MCP tool count stays 16.
• Draft MCP registry packaging: dotnet pack on ArcGISProMCP.Server now produces the ArcGISProMCP.Gateway NuGet dotnet tool (package type McpServer, command arcgis-pro-mcp) with .mcp/server.json for io.github.nicoazel/arcgis-pro-mcp and the bundled skills. tools/pack-gateway.ps1 packs into artifacts/packages and verifies the package; nothing is published. The single-file release bundle is unchanged. See deployment.
• Agent evalu...