Plug-in (Function & Smart Service)Free

Appian Dev MCP (read-only)

by Appian Corporation

Description

Appian Dev MCP (read-only) gives AI coding assistants structured, read-only access to an Appian environment — with no ability to create, modify, or delete anything. It's designed for production sites where you need to inspect applications, trace how objects are configured, or investigate incidents alongside an AI assistant, but must guarantee that nothing changes. Mutating tools aren't just disabled — they don't exist: the MCP server structurally cannot issue a create, update, or delete operation. Because it runs in your environment and acts as the signed-in user, all queries stay within your site and your existing permission boundaries.

Features

  1. Structurally read-only — 56+ inspection tools (list, get, read). No create, update, delete, or test-execution tools are registered. This isn't a configuration toggle — the APIs are absent from the plug-in, giving production teams confidence that the assistant cannot make changes even if asked to.
  1. Embedded, ready-to-run MCP server — install the plug-in, download the bundled server from it, and point any MCP-compatible AI client (e.g., Claude) at it. No separate infrastructure to stand up.
  1. Production use cases — investigate how an application is built, trace record type relationships and security rules, review process model flows, audit group memberships, inspect integration configurations, or explore an unfamiliar environment during an incident — all through natural language.
  1. SAIL CLI — a new command line tool that allows agents to click around sites, process forms, and record actions just like an end user. They can verify the functionality they've built faster and much more token-efficiently than they can with equivalent browser-based tools like Playwright.
  1. Flexible authentication — browser-based single sign-on (SSO) by default, capturing your session through a browser login without the need to store credentials in plain text. HTTP basic auth is also supported.
  1. Security-first by design — access is limited to Designer and administrator roles, and every operation executes under the authenticated user's own permissions, scoped to the objects they're allowed to see.

After installing the plugin, please use https://docs.appian.com/suite/help/latest/devmcp.html (https://docs.appian.com/suite/help/latest/devmcp.html) for instructions on installation and use.

Release notes

New Features:

  • Task Report support: new MCP tools to read Task Report design objects.

Quality and guidance:

  • validateDesignObjects adds six process-model checks: no terminating end event, a gateway with multiple incoming flows, use of an OR gateway, an unlabeled gateway flow, multiple node instances without a null guard, and multiple node instances on a subprocess node.
  • When the rule-recursion check cannot read a rule's dependencies, it now reports an error instead of a misleading quality finding on the rule.

Bug Fixes:

  • listRecordTypes no longer drops record types that non-admin users can see. It could return an empty or truncated list.
  • listAiSkills, listAgents and listRoboticTasks return items in a stable order, so paging no longer repeats or skips rows. A failed read now returns an error instead of an empty list that looked like the application had none.
  • getRecordEventsConfig and configureRecordEvents report eventTypes as null when the event types cannot be read, instead of an empty list, and now read event type names from the lookup's configured column.

Skills:

  • Further corrections to the bundled Appian skills.

SAIL CLI:

  • A label shared by a button and the page or section heading around it now always resolves to the button
  • sail login accepts a site address with https:// or http://, as a browser shows it
  • With no username and password set, sail login signs in through the browser, and says that a person has to finish the sign-in
  • Naming a navigation item without its marker in sail interact now points you to sail navigate
  • A record URL built from a record type and an id is now refused with an explanation, instead of being misread
  • More fixes from agent testing
Version history (12)

26.9.5

Bundled skills have been broadly overhauled, removing many instances of guidance that foundation models already know, as well as incorrect guidance.

New Features:

  • Tempo Report support: new MCP tools to retrieve Tempo Reports.
  • Support for reading deadlines and exception flows on process model nodes.
  • Input descriptions: read rule input descriptions on expression rules, interfaces, and integrations.

Quality and guidance:

  • versionId and identifier/enum tool parameters are now described, and several wrong tool-name references in descriptions were corrected.

Bug Fixes:

  • Process Modeler no longer shows a broken icon for AI Agent / AI Skill smart-service nodes.
  • listCustomDataTypes no longer returns duplicate rows for CDT versions and should be much faster on large sites.

SAIL CLI:

  • Better support for tasks and task lists.

26.9.0

New Features:

  • Translation Set support: new MCP tools for Translation Set design objects.
  • More process model fields: GET on a process model now returns display name, cleanup/auto-archive/auto-delete settings, and alert configuration. Per-node descriptions can now be read and set as well as all locales of PM name/description.
  • Broader security & dependency reads: getObjectSecurity / getObjectDependents now support process model folders and Knowledge Centers. getObjectSecurity now supports data stores and can report the default (All Other Users) role for objects.

Bug Fixes:

  • A JSON 403 (permission denied) is no longer misread as an expired browser session, so you no longer get spurious re-authentication prompts when you lack access to an object.

SAIL CLI:

  • File upload and report links supported
  • Improved link labeling

26.6.110

Skills bundling: Appian skills are now bundled with the Dev MCP plugin. If you already have 26.6.105, this is the first release that will automatically check whether you have updated the skills yourself.

Bug Fixes:

  • Process models with a start form no longer crash getProcessModel. Previously, this failed with "Unexpected error: 'interfaceUuid'".
  • Faster listGroups on sites with many groups (now uses paged group lookup).
  • listObjects now caps page size at 50 and defaults to 25, preventing oversized responses.
  • Version-mismatch messages now point at the correct dev-mcp-bundle URL.

SAIL CLI:

  • Windows setup now working again, fixed setup-windows.bat.
  • Set Date and Time values, read link-field cells, and pass negative numbers as values.
  • Name grid rows past an action column; a value on a handle-driven reference is now correctly refused.
  • A picker search that suggests nothing now fails clearly instead of silently; plus more agent-testing fixes.

26.6.105

Skills bundling: Appian skills are now bundled with the Dev MCP plugin, eliminating the need for a separate skills repo clone. Run uv sync --force if you're not customizing your skills.

Plugin/MCP server version sync check: The MCP server now fails loudly on first tool use if it detects a version mismatch with the installed plugin, preventing confusing tool errors.

New Features:

  • New tools to support AI-assisted migrations from CDT to record types: CDTs, data stores, and data store entities can now be read through Dev MCP. All XsdAnnotations can be viewed.
  • List Objects tool: gets all object types without referencing an app; optionally filter by application, object type, last modified date, and/or last modified by.
  • Package management tools: list packages as well as their details and the objects they contain.
  • Release management tools: Read releases and their packages

Bug Fixes:

  • validateExpression now rejects references to non-existent record types instead of silently accepting them.
  • SAIL CLI: Record actions without a start form now chain to the task form automatically.
  • listAgents, listAiSkills, listRoboticTasks no longer crash with "Unexpected error: 'type'"; they now also require appUuid.

26.6.100

New Features:

  • Process history tools: View process execution history, events, and audit trail

Bug Fixes:

  • Added annotations to every tool per MCP schema to give IDEs better intuition about which tools are read-only, potentially destructive, and/or idempotent.
  • SAIL CLI: support for all record filter types (including date range filters)
  • SAIL CLI: support sites with page groups

26.6.95

Bug Fixes:

  • SAIL CLI now correctly uses Remember Me
  • All group tools now use UUIDs instead of names to identify groups

26.6.90

New testing tool! SAIL CLI is a new command line tool that allows agents to click around sites, process forms, and record actions just like an end user. They can verify the functionality they've built faster and much more token-efficiently than they can with equivalent browser-based tools like Playwright.

Auth update: Browser authentication is now the default auth method for Dev MCP. Check the docs for details

Bug Fixes:

  • Group tools now access groups by UUID instead of name
  • Process model tools now return the correct URLs
  • Expression errors now preserve function name and line location

26.6.85

New tools: view object version history and past versions New diagnostics tool for troubleshooting and getting version info for bug reports

Tool Fixes

  • Document and folder descriptions are viewable
  • Adding a new site page no longer causes existing site pages to be recreated and lose configurations
  • Date, datetime, and time types now function reliably for constant values

Auth and Ops

  • MCP server now auto-trusts corporate certs (users no longer get SSL errors on corporate networks)
  • Users no longer need to set LCP_API_PATH in their config
  • Multi-user auth improvements (users prompted less frequently)

26.6.80

  1. listIntegrations accuracy: listIntegrations now returns only actual integrations. Previously it returned a superset including folders, constants, interfaces, and other objects mislabeled as integrations.
  2. listApplicationObjects completeness: listApplicationObjects no longer silently truncates results at 200 per object type. Applications with more than 200 objects of a given type now return the full count.
  3. Folder operations: Folder tools now work with all container types — Knowledge Centers, Knowledge Folders, and Process Model Folders are all supported by listFolderContents and searchFolders. searchFolders now also searches the Knowledge Center tree, not just Rules folders.

26.6.75

Improved security so that manipulating the MCP server cannot allow tool update or delete access.

26.6.70

Improved security so that manipulating the MCP server cannot allow tool update or delete access.

26.6.65

  1. SSO site auth fixed — Browser-based auth flow was broken on SSO-only Appian sites. Fix incorporated into the plugin.
  2. Impact analysis tool — New tool that uses impact analysis to find all dependents of a given object UUID, returning UUID, object type, name, and IA breadcrumb.