Claude Code DTS MCP Plugin

Private Claude Code plugin for the DTS Engine gateway at https://192.168.50.170:8770/mcp.

It lets Claude Code on macOS or Windows upload source data, queue Windows DTS Engine 6.1 publishing jobs, monitor them, and download hash-verified 3DT results. The plugin contains no DTS Engine binaries and no server secrets.

This is the Claude Code counterpart to codex-dts-mcp-plugin, which serves the same gateway to Codex on macOS. Both plugins can share the same stored bearer token because they target the same gateway and the same DTS_MCP_TOKEN environment variable.

Prerequisites

• The client machine can route to 192.168.50.170:8770 through the private LAN or VPN.
• GitHub access can clone zhouning/claudecode-dts-mcp-plugin.
• Claude Code CLI is installed (claude plugin --help succeeds).
• The Windows DTS MCP gateway is healthy and DTS Engine is installed, licensed, and running in a logged-in interactive Windows session.
• You have the gateway Bearer Token through a secure channel.

Do not paste the token into a shell command. Both installers prompt without terminal echo: configure-macos.sh stores it in the macOS login Keychain, configure-windows.ps1 stores it in Windows Credential Manager.

Install On macOS

git clone git@github.com:zhouning/claudecode-dts-mcp-plugin.git
./claudecode-dts-mcp-plugin/plugins/dts-mcp/scripts/configure-macos.sh

The script imports only the public DTS MCP CA into the login Keychain, stores the Bearer Token under service dts-mcp, installs a user LaunchAgent that restores DTS_MCP_TOKEN, adds the zhouning-dts marketplace, installs dts-mcp@zhouning-dts, and verifies the fixed health endpoint.

Verify with:

./claudecode-dts-mcp-plugin/plugins/dts-mcp/scripts/verify-connection-macos.sh

Install On Windows

git clone https://github.com/zhouning/claudecode-dts-mcp-plugin.git
.\claudecode-dts-mcp-plugin\plugins\dts-mcp\scripts\configure-windows.ps1

The script stores the Bearer Token as a Generic Credential in Windows Credential Manager under target dts-mcp, persists DTS_MCP_TOKEN as a user environment variable and broadcasts the change so new processes see it, trusts the bundled CA in Cert:\CurrentUser\Root, adds the zhouning-dts marketplace, installs dts-mcp@zhouning-dts, and verifies the fixed health endpoint.

Verify with:

.\claudecode-dts-mcp-plugin\plugins\dts-mcp\scripts\verify-connection-windows.ps1

Restart Claude Code and open a new session after installation on either platform.

Update

git -C claudecode-dts-mcp-plugin pull --ff-only
claude plugin marketplace update zhouning-dts
claude plugin install dts-mcp@zhouning-dts

Restart Claude Code and use a new session after an update.

Rotate The Bearer Token

Rotate the token on the Windows gateway first, then run:

./claudecode-dts-mcp-plugin/plugins/dts-mcp/scripts/configure-macos.sh --rotate-token

.\claudecode-dts-mcp-plugin\plugins\dts-mcp\scripts\configure-windows.ps1 --rotate-token

Refresh The CA

After the Windows host address or DTS MCP CA changes, update the checkout and run:

git -C claudecode-dts-mcp-plugin pull --ff-only
./claudecode-dts-mcp-plugin/plugins/dts-mcp/scripts/configure-macos.sh --refresh-ca
./claudecode-dts-mcp-plugin/plugins/dts-mcp/scripts/verify-connection-macos.sh

git -C claudecode-dts-mcp-plugin pull --ff-only
.\claudecode-dts-mcp-plugin\plugins\dts-mcp\scripts\configure-windows.ps1 --refresh-ca
.\claudecode-dts-mcp-plugin\plugins\dts-mcp\scripts\verify-connection-windows.ps1

The refresh does not read or rewrite the Bearer Token. Discard signed URLs issued before an endpoint or signing-key change.

Remove

macOS:

claude plugin uninstall dts-mcp
claude plugin marketplace remove zhouning-dts
launchctl bootout "gui/$UID/com.dts.mcp.token" 2>/dev/null || true
rm -f "$HOME/Library/LaunchAgents/com.dts.mcp.token.plist"
rm -rf "$HOME/Library/Application Support/dts-mcp"
security delete-generic-password -a "$USER" -s dts-mcp
launchctl unsetenv DTS_MCP_TOKEN

Windows:

claude plugin uninstall dts-mcp
claude plugin marketplace remove zhouning-dts
[Environment]::SetEnvironmentVariable('DTS_MCP_TOKEN', $null, 'User')
cmdkey /delete:dts-mcp 2>$null

Remove the DTS MCP Local CA certificate from the login Keychain (security delete-certificate) or Cert:\CurrentUser\Root (Remove-Item) only after confirming its fingerprint.

Publishing Constraints

• Only road is verified end to end.
• Road inputs require a projected CRS and domPath; a matching DEM is strongly recommended.
• OSGB publishing requires both stages and must use dts_publish_osgb.
• Remote path flags use artifact IDs and artifact-relative paths, never Windows paths.
• Upload and download bytes use signed HTTPS URLs without the Bearer Token.
• The remote gateway registers 14 tools; dts_validate remains local-only.
• A successful result ZIP must retain both its .3dt data and DataInfor.txt.

Troubleshooting Order

1. Confirm private routing to 192.168.50.170:8770.
2. Confirm the Windows host is logged in and the DTS MCP gateway is healthy.
3. Run the platform's verify-connection-* script and fix the first failed layer.
4. Use --rotate-token for authentication failures.
5. Use --refresh-ca after an address or certificate change.
6. Confirm dts-mcp appears in claude plugin list.
7. Confirm dts appears in claude mcp list.
8. Start a new Claude Code session and call dts_ping.

Verification Status

• DTS server remote gateway implementation and its own remote smoke test: not re-verified from this repository; see zhouning/dts-mcp-server.
• Plugin manifests, Skill, certificate, script syntax, and secret checks: covered by this repository's tests.
• Windows Credential Manager and macOS Keychain acceptance is pending on target machines.
• Do not report end-to-end plugin success until a target machine completes a real road upload, publish, download, and SHA-256 verification.