Schedules an LLM can reason about
P6 MCP & CLI is a local-first Model Context Protocol server and command-line tool that gives an agent harness — Claude Code, Codex, etc. — safe read and edit access to Primavera P6 construction schedules in their native XER export format. P6 is the dominant scheduling system on large capital projects, and its schedules routinely run to thousands of interlinked activities with critical-path logic, resource loading, calendars, and a work-breakdown structure.
It turns that dense, proprietary file into something an analyst can interrogate conversationally — what slipped since last month, whether the schedule passes DCMA quality, the likely impact of a delay — without ever leaving the chat client or letting the file reach the cloud.
The reliability contract
The whole design turns on a single hard promise: it reports the values P6 already computed and stored at export time, and never recomputes the schedule itself. Critical path, float, and forecast dates are the output of P6's scheduling engine — its F9 recalculation — and any tool that re-derives them will quietly disagree with what the analyst sees in P6, an unacceptable failure mode in a domain where schedules are contractual and end up in litigation.
It reports what P6 computed — it never recomputes the schedule itself.
So every number is a stored field or a pure subtraction of stored fields, every dated payload is stamped with the schedule's own data date and a "P6-computed at export" label, and durations are reported in hours exactly as P6 stored them. Any edit produces a file byte-identical to the source except the changed cells, carrying a "dirty — re-run F9" warning. F9 in the analyst's own P6 stays the trust boundary.
A self-reliant, security-first build
File access is gated by a path allowlist and URL fetching is off by default, so there is no server-side request-forgery surface — it reads local files only, and a safe writer is constructed so the original file is never touched, a guarantee enforced by tests rather than convention.
Rather than lean on an existing XER parser, it ships its own dependency-free typed read model over a byte-faithful raw-table layer. The one capable third-party parser is GPL-licensed, so it was relegated to a dev-only test oracle that cross-checks the home-grown model field by field — leaving the runtime free of any copyleft dependency and the whole tool cleanly MIT-licensable as original IP.
Read, assess, edit, render
An analyst loads a file once, then queries activities, logic ties, resources, calendars, and the WBS through bounded, reliability-labeled envelopes that paginate without ever silently dropping a row. A progress summary tallies counts, milestones, and critical and longest-path totals — but pointedly refuses to produce percent-complete or earned-value figures, because those would be recomputes.
Two analyses give it day-to-day value. A DCMA 14-point assessment implements the Defense Contract Management Agency's schedule-quality checklist — logic gaps, leads and lags, hard constraints, high float and duration, negative float, CPLI and BEI — entirely as reads of stored fields. A snapshot diff compares a baseline against this month's update and reports exactly what changed, matching activities and relationships by stable business keys rather than the surrogate IDs P6 re-issues on every export.
Edits run through one sanctioned, fail-closed path: it previews by default, validates every change before applying any, restricts itself to a tight allowlist of identity and constraint fields, and writes a new timestamped file rather than touching the original. And a render tool draws the loaded schedule as a completely offline, self-contained HTML Gantt — hand-rolled SVG, no chart library, no CDN, no network call — that refreshes as edits land, with the critical path in red against its WBS in cerulean, a today marker, float tails, and a diff-overlay mode for comparing two exports.
Forensic time-impact analysis
The newest layer is modeled delay analysis — the kind used to substantiate or rebut a schedule-delay claim. Here the no-recompute contract collides head-on with the method, whose core step is itself a reschedule, and the resolution is the whole point of the design: it does only the parts it can do honestly. It authors a delay fragnet and splices it into the contemporaneous update, then later measures the project-finish movement as a pure subtraction of two stored finish dates — while P6 itself remains the rescheduling oracle, the analyst importing the impacted file, running F9, and re-exporting.
Multi-window analyses are run one model per update window and reported separately, never summed, because adding concurrent delays double-counts them. Every result self-discloses an input-quality gate, an AACE and SCL Protocol conformance checklist, and an honest non-conclusion guard — it flags concurrency, pacing, and mitigation but resolves none of them, because causation, excusability, and liability are the analyst's and the tribunal's judgments, not the tool's. The single remaining acceptance step is by deliberate design not something software can self-certify: an operator runs the P6-as-oracle round-trip on a real schedule and confirms the reported slip equals P6's own finish movement to the day.