archimate-mcp

A self-contained ArchiMate model engine exposed as a Model Context authoring capabilities — create/load/save models, full CRUD on elements, relationships, folders, and views (diagrams), query/traverse the model, and import/export the Open Group Model Exchange File Format so the models open directly in Archi.

Archi has no native server API, so archimate-mcp ships its own dependency-light engine built on the Python standard library (xml.etree.ElementTree).

Documentation — Installation, deployment, usage across the API, CLI, and MCP official documentation.

Table of Contents

• Overview
• Installation
• Usage
• Architecture
• Deployment
• Environment Variables
• MCP Tools

Overview

archimate-mcp exposes a standardized interface for authoring ArchiMate models via the Model Context Protocol. The full ArchiMate vocabulary (Strategy, Business, Application, Technology, Physical, Motivation, Implementation layers) and all relationship types are supported, with structural validation and round-trip Open Exchange Format serialization.

Installation

Pick the extra that matches what the operator want to run:

Extra	Installs	Use when
archimate-mcp[mcp]	Connector-focused MCP server (scion-sdk — FastMCP/FastAPI + epistemic-graph[full])	The operator only run the MCP server (smallest install / image)
archimate-mcp[all]	Everything (mcp + agent + logfire)	Development / both surfaces

# Connector-focused MCP server (includes the shared graph engine)
uv pip install "archimate-mcp[mcp]"

# Agent runtime (adds model orchestration to the shared graph engine)

# Everything (development)
uv pip install "archimate-mcp[all]"      # or: python -m pip install "archimate-mcp[all]"

Container images (:mcp)

One multi-stage docker/Dockerfile builds the MCP-only image (--target mcp):

Image tag	Build target	Contents	Entrypoint
example/archimate-mcp:mcp	--target mcp	archimate-mcp[mcp] — connector-focused, includes epistemic-graph[full]; no model-orchestration stack	archimate-mcp

docker build --target mcp   -t example/archimate-mcp:mcp    docker/   # connector-focused MCP server

agent (immutable agent digest) with a co-located :mcp sidecar.

Knowledge-graph database (epistemic-graph)

Scion SDK core dependency (epistemic-graph[full]). The [mcp] extra keeps deployments can use the bundled engine. For production or shared state, run epistemic-graph as a dedicated database service and configure the runtime to use it. Deployment recipes (single-node + Raft HA), connection configuration, and architecture diagrams are documented in the epistemic-graph deployment guide.

Usage

Run the MCP server directly:

archimate-mcp

archimate-agent

MCP Configuration Examples

Install the connector-focused [mcp] extra. Examples use archimate-mcp[mcp] to add FastMCP / FastAPI through scion-sdk; the required Scion SDK core still carries epistemic-graph[full]. The [agent-runtime] extra additionally enables model orchestration.

stdio Transport (local IDEs — Cursor, Claude Desktop, VS Code)

{
  "mcpServers": {
    "archimate-mcp": {
      "command": "uvx",
      "args": [
        "--from",
        "archimate-mcp[mcp]",
        "archimate-mcp"
      ],
      "env": {
        "ARCHITOOL": "True",
        "ARCHI_KG_INGEST": "1",
        "ARCHI_MODEL_PATH": "./model.archimate"
      }
    }
  }
}

Runtime references require an alias-aware launcher such as Arbora. Other launchers must omit those entries and inject the resolved values through their own runtime secret boundary.

Streamable-HTTP Transport (networked / production)

{
  "mcpServers": {
    "archimate-mcp": {
      "command": "uvx",
      "args": [
        "--from",
        "archimate-mcp[mcp]",
        "archimate-mcp",
        "--transport",
        "streamable-http",
        "--port",
        "8000"
      ],
      "env": {
        "TRANSPORT": "streamable-http",
        "HOST": "127.0.0.1",
        "PORT": "8000",
        "ARCHITOOL": "True",
        "ARCHI_KG_INGEST": "1",
        "ARCHI_MODEL_PATH": "./model.archimate"
      }
    }
  }
}

Alternatively, connect to a pre-deployed Streamable-HTTP instance by url:

{
  "mcpServers": {
    "archimate-mcp": {
      "url": "http://localhost:8000/archimate-mcp/mcp"
    }
  }
}

Run a reviewed container image as a least-privilege stdio child (no listener or published port):

docker run -i --rm \
  --read-only \
  --cap-drop=ALL \
  --security-opt=no-new-privileges \
  --pids-limit=256 \
  --tmpfs /tmp:rw,noexec,nosuid,nodev,size=64m \
  -e TRANSPORT=stdio \
  -e ARCHITOOL=True \
  -e ARCHI_KG_INGEST=1 \
  -e ARCHI_MODEL_PATH=./model.archimate \
  registry.example.invalid/archimate-mcp@sha256:<digest> archimate-mcp

For containerized network HTTP, supply an authenticated TLS ingress (or direct server TLS), exact MCP_ALLOWED_HOSTS, and an exact trusted-proxy CIDR policy through the operator-owned deployment profile. The generator does not emit an unauthenticated non-loopback listener.

Auto-generated from the code-read env surface (package vars) — do not edit.

Architecture

See /docs for architectural diagrams and further documentation. The model engine lives in archimate_mcp/api/ (archimate_model.py, api_client_archi.py), the MCP tools in archimate_mcp/mcp/mcp_archi.py.

Deployment

Bare-metal

archimate-agent

Docker

docker build -f docker/Dockerfile -t archimate-mcp .

Additional Deployment Options

archimate-mcp can run as a local stdio process or container, or behind a remote network boundary. The Deployment guide carries the detailed transport contract.

• Local container — launch a reviewed immutable image as a least-privilege stdio child with no listener or published port.
• Remote URL — connect through an operator-supplied authenticated HTTPS ingress. Keep its URL, outbound identity references, trust profile, and exact MCP_ALLOWED_HOSTS in AgentConfig.

Environment Variables

Package environment variables

Variable	Example	Description
ARCHI_MODEL_PATH	./model.archimate
ARCHI_KG_INGEST	1
ARCHITOOL	True

Inherited scion-sdk variables (apply to every connector)

Variable	Example	Description
TRANSPORT	stdio	MCP transport: stdio | streamable-http | sse
HOST	127.0.0.1	Loopback bind host (set an authenticated ingress explicitly)
PORT	8000	Bind port (HTTP transports)
MCP_ENABLED_TOOLS	—	Comma-separated tool allow-list
MCP_DISABLED_TOOLS	—	Comma-separated tool deny-list
MCP_ENABLED_TAGS	—	Comma-separated tag allow-list
MCP_DISABLED_TAGS	—	Comma-separated tag deny-list
EUNOMIA_TYPE	none	Authorization mode: none | embedded | remote
EUNOMIA_POLICY_FILE	mcp_policies.json	Embedded Eunomia policy file
EUNOMIA_REMOTE_URL	—	Remote Eunomia authorization server URL
ENABLE_OTEL	False	Enable OpenTelemetry export
OTEL_EXPORTER_OTLP_ENDPOINT	—	OTLP collector endpoint
MCP_CLIENT_AUTH	—	Outbound MCP child auth: oidc-client-credentials | basic | none
OIDC_CLIENT_ID	—	OIDC client id (service-account auth)
OIDC_CLIENT_SECRET_REF	secret://identity/oidc-client-secret	Runtime secret reference for the OIDC service account
MCP_BASIC_AUTH_USERNAME	—	HTTP Basic username (MCP_CLIENT_AUTH=basic)
MCP_BASIC_AUTH_PASSWORD_REF

3 package + 23 inherited variable(s). Auto-generated from .env.example + the shared scion-sdk set — do not edit.

Every variable the server reads, grouped by concern.

Model & engine

Variable	Description	Default
ARCHI_MODEL_PATH	Path to the working model file (Open Exchange Format)	./model.archimate
ARCHI_KG_INGEST	Ingest loaded/imported models through the governed ChangeEnvelope path	1

MCP server / transport

Variable	Description	Default
TRANSPORT	stdio, streamable-http, or sse	stdio
HOST	Bind host (HTTP transports)	127.0.0.1
PORT	Bind port (HTTP transports)	8000
MCP_TOOL_MODE	Tool surface: intent, condensed, verbose, or both	intent
MCP_ENABLED_TOOLS / MCP_DISABLED_TOOLS	Comma-separated tool allow/deny list	—
MCP_ENABLED_TAGS / MCP_DISABLED_TAGS	Comma-separated tag allow/deny list	—
DEBUG	Verbose logging	False
PYTHONUNBUFFERED	Unbuffered stdout (recommended in containers)	1

Tool toggles

The single action-routed tool family can be disabled via its toggle env var (set to false). The toggle is in the MCP Tools table below (ARCHITOOL).

Telemetry & governance

Variable	Description	Default
ENABLE_OTEL	Enable OpenTelemetry export	False
OTEL_EXPORTER_OTLP_ENDPOINT	OTLP collector endpoint	—
OTEL_EXPORTER_OTLP_PUBLIC_KEY / OTEL_EXPORTER_OTLP_SECRET_KEY	OTLP auth keys	—
OTEL_EXPORTER_OTLP_PROTOCOL	OTLP protocol (e.g. http/protobuf)	—
EUNOMIA_TYPE	Authorization mode: none, embedded, remote	none
EUNOMIA_POLICY_FILE	Embedded policy file	mcp_policies.json
EUNOMIA_REMOTE_URL	Remote Eunomia server URL	—

MCP Tools

The table below is auto-generated from the live server — do not edit by hand.

Intent tools

MCP Tool	Kind	Description
archi_element	intent	Create, read, update, delete, list, or search elements.
archi_folder	intent	Manage organizations (folders) and place items in them.
archi_model	intent	Manage the model lifecycle and Open Exchange import/export.
archi_query	intent	Traverse and introspect the model and its vocabulary.
archi_relationship	intent	Create, read, update, delete, list, or validate relationships.
archi_view	intent	Create views (diagrams) and place elements/connections on them.
archimate_ingest_model	intent	Natively ingest the ArchiMate model into epistemic-graph as typed nodes.

7 intent tool(s) · 0 operation(s). Call an operation as act(action='<operation>', params={...}) (ask for reads); find(action='describe', params={'action': '<operation>'}) returns its arguments. An operation is enabled unless its <DOMAIN>TOOL toggle is set false. Auto-generated — do not edit.

Documentation

The complete documentation is published as the official documentation site and is the recommended reference for installation, deployment, and day-to-day operation.

Page	Contents
Installation	pip, source, extras, prebuilt Docker image
Usage	the MCP tools, the ArchiApi client, the CLI
Concepts	concept registry (CONCEPT:ARCHI-*)

AGENTS.md is the canonical contributor/agent guidance.

Deploy with scion-sdk-deployment

Provision this package with the consolidated scion-sdk-deployment workflow. It selects an installed-package, editable-source, or immutable-container path; records only runtime secret and TLS-profile references in AgentConfig; and runs doctor, registration, policy, observability, and rollback gates. Ask your agent to "deploy archimate-mcp with scion-sdk-deployment".

Install mode	Command
Installed package	uv tool install "archimate-mcp[mcp]", then run archimate-mcp
Immutable container	deploy registry.example.invalid/archimate-mcp@sha256:<digest> through the operator-selected orchestrator

The repository embeds no deployment profile, credential value, certificate path, or environment-specific endpoint. Supply those at runtime through AgentConfig and the configured secret provider.

Governed capability contract

This package ships a compact canonical skill surface with specialist procedures kept as referenced workflows. The current MCP tools, skill metadata, connector_manifest.yml, ontology, mappings, shapes, fixtures, migrations, tool-schema fingerprints, and certification metadata form one versioned capability contract. Validate them together; do not rely on stale tool names or historical per-task skill wrappers.

Runtime endpoints, credentials, certificate trust, tenant identity, retention, and observability policy are deployment inputs and are never packaged values. See Configuration, trust, and privacy before enabling a network transport, connector ingestion, Arbora delegation, or trace export.