I have played around with developing a few different MCP servers for Windchill and tested everything from a STDIO MCP server with Cursor running locally to an HTTP/SSE MCP server with ChatGPT. I also developed utilities to read the Windchill configuration from the WRS OData domain documentation and the $metadata so the MCP has a cached definition of any custom types/attributes, etc.
One problem I kept running into was how to rein in the chatbots. They regularly offered to do things they were in no way capable of doing: “If you like I can x, y, z - just say the word…”. When I asked them for some very obviously wrong things, they just went along with it and even congratulated me on how insightful my request was. If I asked them for something there’s no way they could find out, they couldn’t just say, “No, I don’t know.” They were also tripped up by language; for example, my prompt was “create a list of all the manufactured parts in the Golf Cart,” but it just couldn’t figure out that it needed to query ‘$filter=Source/Value eq make’ and, after dozens of queries, claimed there were none. So I wrote utilities to preload and cache the $metadata and included natural language descriptions of what those data represent to humans.
For runtime I chose Node.js with npm after experimenting with Python for a while and had the most success when I split the MCP servers into a core package plus individual MCPs for the different endpoints like ProdMgmt and DocMgmt, or for a specific role I wanted from it. This was due more to my impatience to get it working than anything else.
One concern, I guess, is how to manage the risks of exposing Windchill to a chatbot. In the development environment I used, Windchill is not exposed to the internet. The MCP servers run privately inside an LXC container and are not exposed to the internet. Instead, a Cloudflare Tunnel makes an outbound, encrypted connection from the LXC container to Cloudflare, which then maps public DNS names to that tunnel. When someone accesses the MCP URL, the request hits Cloudflare DNS, then securely travels down the existing tunnel to my private network to the reverse proxy (and directly to the MCP service), without having to open any inbound ports. I didn’t get around to implementing OAuth yet, I’m just using basic auth. Obviously, it wouldn’t be workable this way for enterprise, this is just how I worked during development.
AI is moving fast, and there are already new protocols in the works to address security concerns properly. Even OpenAI’s app connector still only allows MCPs in development mode for this reason.
