DWSIM MCP security and limitations
Understand the upstream server's authentication, network, solver, and qualification boundaries.
HTTP authentication
Start the server with --token <secret> to require a token. Clients can send X-MCP-Token or Authorization: Bearer <token>.
Warning
Token authentication does not encrypt the connection. Use HTTPS termination, a VPN, or a secure tunnel for remote traffic.
Network binding
Direct execution defaults to localhost. Container images bind inside the container; control host exposure through Docker port publishing and network policy.
Solver and engineering boundaries
Flowsheet checks and solver diagnostics help identify model setup problems, but they do not prove that a thermodynamic method, unit model, topology, operating condition, or solved state is physically appropriate.
Dynamic simulation
The upstream server exposes dynamic-simulation tools. SDAI has qualified a Water valve–tank transient and a timed inlet-flow step event, including schedule setup, monitored variables, stored initial state, readiness check, run/status, series preview, and transient analysis. PID tuning and the broader dynamic unit-operation surface remain outside the current qualification.
Local SDAI research patches are separate
The local SDAI research branch contains async steady-state solve and stream-composition changes that are not part of the reviewed upstream v10.2.9 release. Public upstream documentation does not claim those capabilities.