IQMS / DELMIA Apriso

io.github.wyre-technologyPublished by GitHub account wyre-technologyv1.2.12Updated Oct 26, 2026

MCP server for IQMS (DELMIAworks) ERP — manufacturing, inventory, production, and quality.

VerifiedSTDIODesktop onlyDatabasesData & AnalyticsBusiness & Commerce

Overview

AI-generated overview

MCP server for IQMS / DELMIAworks (EnterpriseIQ) ERP, letting an assistant query manufacturing, inventory, BOM, order, schedule and quality data.

What you can do
  • Discover and check the server: list tools by domain and verify credentials and connection.
  • Read work orders: list open or in-progress orders and fetch full detail including routings.
  • Read inventory and BOMs: on-hand by item, location or lot, lot genealogy, BOM explosion and where-used.
  • Read orders and planning: open sales orders with ship status, open purchase orders with expected receipts, machine schedule and capacity load.
  • Read quality records: non-conformances, CARs and CAPAs.
  • Write, only when the licensed WebAPI module is configured: create work orders, post production quantities, adjust inventory and open non-conformance records.
When to use it
Useful when an assistant needs to answer questions about a company's IQMS / DELMIAworks ERP data — production status, stock levels, lot traceability, order backlogs, capacity or quality issues — without a public REST API. Write tools only make sense for sites that have licensed the DELMIAworks WebAPI add-on.
Requirements
Runs as a local stdio process (npx or the container image). Needs an Oracle connection to the IQMS database: IQMS_ORACLE_USER, IQMS_ORACLE_PASSWORD and IQMS_ORACLE_CONNECT_STRING. Write tools additionally need the licensed WebAPI module and its base URL and credentials. HTTP/gateway mode requires CONDUIT_S2S_SECRET and per-request Oracle headers.
Before you install
Requires database credentials for the ERP system; the Oracle password is a secret and should be supplied via environment variable or request header, not committed. Write tools create work orders, post production quantities, adjust inventory and open non-conformance records, changing live ERP data. Gateway mode passes vendor credentials in headers such as X-IQMS-Oracle-Password. MCP_ALLOW_INSECURE_DEV=1 disables the shared-secret check and is for local development only.

Installation

In SourceWeft

  1. Open IQMS / DELMIA Apriso in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

iqms-mcp

MCP server for IQMS / DELMIAworks (EnterpriseIQ), the manufacturing ERP from Dassault Systèmes.

Status: Read tools issue queries through @wyre-technology/node-iqms against the Direct Oracle path (always available). Write tools route through the licensed DELMIAworks WebAPI module — an optional add-on — and throw DriverNotConfiguredError until X-IQMS-WebAPI-Base-URL credentials are supplied.

Why this exists

EnterpriseIQ doesn't have a public REST API. The realistic integration paths are:

  1. Direct Oracle (universal at every install) — read-only queries
  2. WebAPI module (paid licensed add-on) — transactional writes

This MCP server exposes both behind a single decision-tree-navigated tool surface.

Tools

Initial discovery surface (always available):

  • iqms_navigate — list tools in a domain
  • iqms_status — credential / connection check

Domains: workorders, inventory, boms, sales_orders, purchase_orders, schedule, quality.

Read tools (Oracle, available always):

ToolPurpose
iqms_workorders_listOpen / in-progress work orders
iqms_workorders_getFull work order detail incl. routings
iqms_inventory_onhandOn-hand by item / location / lot
iqms_inventory_lot_traceLot genealogy walk
iqms_boms_explodeBOM explosion
iqms_boms_where_usedWhere-used reverse lookup
iqms_sales_orders_listOpen SOs / ship status
iqms_purchase_orders_listOpen POs / expected receipts
iqms_schedule_capacityMachine schedule + capacity load
iqms_quality_ncrsNon-conformances / CARs / CAPAs

Write tools (WebAPI, gated):

ToolPurpose
iqms_workorders_createCreate a new work order
iqms_workorders_post_productionPost qty made / scrapped
iqms_inventory_adjustInventory transaction
iqms_quality_create_ncrOpen a non-conformance record

Run modes

Local (stdio)

bash
IQMS_ORACLE_USER=eiq_ro \IQMS_ORACLE_PASSWORD=… \IQMS_ORACLE_CONNECT_STRING=eiq-db.example.com:1521/EIQ \npx -y github:WYRE-AI/iqms-mcp

Gateway (HTTP, stateless)

CONDUIT_S2S_SECRET is required. If it is empty or a known placeholder (changeme, placeholder, your-s2s-secret, and the other example values rejected at startup), the HTTP server logs an error and exits non-zero. It never prints the secret. Set MCP_ALLOW_INSECURE_DEV=1 only for local development to start without the secret; the process logs a warning, does not check X-Gateway-S2S, and binds 127.0.0.1 only. A non-loopback MCP_HTTP_HOST (including 0.0.0.0) is ignored in that mode and the override is logged. A placeholder secret still refuses to start.

MCP_HTTP_HOST is honored when CONDUIT_S2S_SECRET is set, and defaults to 0.0.0.0 when unset. With no secret, the listener is 127.0.0.1. The container image sets MCP_HTTP_HOST=0.0.0.0 and AUTH_MODE=gateway.

bash
CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" \MCP_TRANSPORT=http \MCP_HTTP_PORT=8080 \AUTH_MODE=gateway \node dist/http.js

Local HTTP without a secret is development-only and always binds 127.0.0.1:

bash
MCP_ALLOW_INSECURE_DEV=1 npm run start:http
X-Gateway-S2S

With MCP_TRANSPORT=http and a real CONDUIT_S2S_SECRET, every /mcp request must include X-Gateway-S2S:

text
t=<unix seconds>,v1=<hex hmac-sha256>

The signature is HMAC-SHA256 of the literal message t=<unix seconds> (the same t= prefix that appears in the header), keyed with CONDUIT_S2S_SECRET, and hex-encoded. A missing or invalid header returns 401. /health stays unauthenticated and does not read vendor credentials. The stdio transport does not use CONDUIT_S2S_SECRET.

In AUTH_MODE=gateway, /mcp also requires the Oracle headers below. Those headers are the only credential source for that request. A request missing any of them returns 401 and does not fall back to IQMS_* in the process environment.

HeaderRequiredNotes
X-Gateway-S2Syes, when CONDUIT_S2S_SECRET is sett=<unix seconds>,v1=<hmac-sha256 hex of t=...>
X-IQMS-Oracle-UseryesOracle DB user
X-IQMS-Oracle-PasswordyesOracle DB password
X-IQMS-Oracle-Connect-StringyesEasy Connect or TNS
X-IQMS-WebAPI-Base-URLnoEnables write tools when all three WebAPI headers are present
X-IQMS-WebAPI-Userno
X-IQMS-WebAPI-Passwordno
Single-tenant HTTP (AUTH_MODE=env)

/mcp still requires a valid X-Gateway-S2S header. Vendor credentials come from IQMS_ORACLE_USER, IQMS_ORACLE_PASSWORD, and IQMS_ORACLE_CONNECT_STRING. Optional IQMS_WEBAPI_* variables enable write tools. This mode is separate from the gateway Compose service, which does not inject those variables.

Docker

The image listens on 0.0.0.0 inside the container and defaults to AUTH_MODE=gateway. Publish the port on loopback and pass the S2S secret. In gateway mode, IQMS credentials arrive on each request as headers; they are not read from the environment.

bash
docker build -t iqms-mcp .docker run \  -e CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" \  -p 127.0.0.1:8080:8080 \  iqms-mcp

Compose refuses to start when CONDUIT_S2S_SECRET is unset, sets AUTH_MODE=gateway, publishes 127.0.0.1:8080:8080, and does not inject static IQMS_* credentials:

bash
CONDUIT_S2S_SECRET="$CONDUIT_S2S_SECRET" docker compose up

License

Apache-2.0

Source: README.md at commit f041571

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v1.2.12LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.