AI diagnostic gateway for Teamcenter
Every AI gateway sells reach. This one sells refusal.
PLMTrace connects the AI client your company already chose to a Teamcenter environment through named, bounded diagnostics.
| Host | Connection | Coverage | Last contact |
|---|---|---|---|
| tc-prd-app01 | Online | Partial | 2 min ago |
| tc-prd-app02 | Online | Complete | 1 min ago |
| tc-prd-db01 | Stale | Unknown | 41 min ago |
On the record
An Edge Agent runs next to the PLM stack, on Windows or Linux, and answers with redacted evidence. The boundary is not a sentence in a prompt: it is the catalog.
Read-only, outbound-only, no shell, no free SQL.
- 25 registered MCP tools · 22 PLM, 2 host/database, 1 private learning
- 0 occurrences of process-execution tokens in the Edge Agent's production code
- 7 named SQL packs · 0 arbitrary query parameters
- MCP integration prepared for Codex, Claude Desktop and OpenCode
Current stage
Technical prototype in private pilot. Any Teamcenter release, on Windows or Linux, with SQL Server or Oracle. Validated first in a non-production environment.
The boundary is the product
A general-purpose agent with a shell can reach anything, so every promise ends up living in the prompt. PLMTrace removes the executor instead. What the catalog cannot do is designed with security boundaries. It is not requested by instruction.
DENY · SHELL
No shell, no PowerShell, no batch
The Agent has no process executor: these tokens have zero occurrences in its production code. Generated artifacts stay inert text, and the test suite fails if artifact content suggests process execution.
Absent from the Edge Agent's production code
os/execexec.Commandcmd.exeStart-ProcessSystem.Diagnostics.Process
DENY · FREE SQL
No free SQL, seven named packs
The database tool takes an engine and a pack name from a closed list, plus bounded row count and timeout. There is no parameter that carries SQL, so a prompt cannot supply a statement. The pack set is the same for SQL Server and Oracle; only the queries behind each pack differ.
Accepted pack values
inventorycapacityconnectivitysessions_and_blockingwait_indicatorsquery_indicatorsconfiguration_checks
Parameters the schema does not define
querystatementsqlbatch
DENY · WRITES
No writes to Teamcenter or the database
Every operation in the catalog reads. Nothing restarts a service, edits configuration, applies a patch or runs an upgrade. Diagnosis and change stay separated, and the change stays with the administrator.
Tool names that do not exist in the registered catalog
service_restartapply_upgradewrite_configurationdeploy_packageexecute_script
What crosses the boundary
Four nodes, two directions. Outward goes one signed and bounded task; back comes evidence that was already sanitized inside the environment.
What travels inward
An MCP request becomes a capability signed for one agent, one environment, one tool, one parameter hash and one deadline. The Agent polls outward and leases the task; the environment opens no inbound port for PLMTrace.
What comes back
Evidence, redacted at the source and bounded in size before it leaves. The diagnostic result body is transient in the Control Plane: the central database does not persist the diagnostic result payload.
What never crosses
Agent credentials and the SQL Server secret stay on the host. No inbound connection opens. No shell, no free SQL, no write operation and no generated script belongs to the contract.
The specialist describes the problem in the AI client already in use. The client picks the tool and fills parameters from its schema.
Organization, environment, role, tool, parameter hash, output limit and deadline are bound into a signed capability.
The Agent runs the tool next to Teamcenter: authorized roots, path containment, depth and size limits, binary rejection and local redaction.
The client explains the evidence and names the next safe read-only checks. The administrator confirms the hypothesis and owns the decision.
MCP integration prepared for Codex, Claude Desktop and OpenCode. The client does not have to be ours. It is the one the company already chose.
A versioned catalog, not loose scripts
Every capability is a named tool with a typed schema, a timeout and an output bound. The groups below are the runtime registration, not a marketing list.
Teamcenter and PLM
22registerPLMTools: installation, configuration, FMS, log correlation, AWC and T4EA gateway log access, upgrade baselines, BMIDE, customization source, packages and artifacts.
inventory_environmentinspect_teamcenter_installationinspect_configurationcheck_installation_prerequisitesvalidate_fms_configurationsearch_log_eventsquery_teamcenter_logsdiagnose_awc_unavailablediagnose_t4ea_log_accesscorrelate_service_timelinecapture_upgrade_baselinecompare_upgrade_baselinesinspect_bmide_modelcompare_bmide_modelsreview_customization_sourcevalidate_deployment_packagediscover_diagnostic_filesread_text_excerptcreate_artifactlist_artifactsread_artifactguide_environment_clone
Host and database
2Registered in main.go. Host service inspection is platform-aware: the Windows Service Control Manager on Windows, systemd unit and cgroup state on Linux, both read-only and with no process executor. The database tool takes an engine plus one of seven named packs; SQL Server is validated, Oracle packs are implemented and await validation on a live instance.
inspect_windows_servicesanalyze_database_health
Private learning
1One tool for structured private retrieval in shadow mode, scoped to the authenticated organization and confirmed cases.
search_diagnostic_knowledge
Loose scripts
They live in someone's folder, change without review and cannot tell you what they touched. Governance becomes reconstruction after the fact.
Catalog entry
Versioned name, typed input, bounded output, signed per call, with audit metadata. You can enumerate exactly what the AI is able to ask for.
Against the alternatives you already run
These are the real alternatives, not a strawman. Each one leaves a gap that the boundary closes.
| Alternative | Limitation | PLMTrace |
|---|---|---|
| Manual collection by an administrator | Slow, variable and hard to reproduce; it depends on who is on shift. | Packs and schemas standardize the investigation, and the same request returns the same shape of evidence. |
| VPN, RDP or broad remote access for support | Expands the access surface and depends on human privilege. | Edge Agent on Windows or Linux initiating outbound connections, with operations delimited by the catalog. |
| Loose scripts | Hard to govern, version and audit. | A versioned catalog with execution restricted to the installed collectors. |
| AI with shell access | The prompt becomes part of the security boundary. | Structural absence of a generic executor. |
| Manual upload of logs into a chat | Exposes content and loses operational context. | Redaction and bounding in the Agent before the evidence is delivered. |
| Generic observability tools | They see infrastructure, not necessarily the PLM model. | Diagnostics specific to Teamcenter, BMIDE, upgrade and customization source. |
Read the boundary in the code
For the security reader: each statement below names the file that implements it. PLMTrace is designed with security boundaries; independent review and external testing are pilot gates, not finished facts.
Agent authentication with replay rejection
The Agent presents a DPoP proof bound to its token, method and path. A replayed proof is rejected in memory and again in the database, so a captured request cannot be reused inside its window.
apps/control-plane/internal/auth/agent.goOne signed capability per call
A single signature covers agent, environment, tool, parameter hash, validity window, duration and output bound. The Agent verifies all of it before executing, and a mismatch stops the task.
packages/agent-runtime/capability/capability.goAuthorized roots with path containment
Every read resolves the real path, symlinks included, and must stay inside the authorized root. A candidate that escapes returns a permission error instead of content.
apps/edge-agent/internal/fs/safe.goDepth, size and binary limits
Directory walks cap depth, result count and file size, skip symlinks and reject binary content, so a collection cannot become an unbounded read of the host.
apps/edge-agent/internal/fs/walker.goSecret redaction at the source
Password, connection string, API key, bearer token, private key, certificate, FMS signed path and private IPv4 patterns are replaced inside the Agent, before the evidence travels.
apps/edge-agent/internal/redact/engine.goTransient result payload
The diagnostic result body is relayed in memory with a TTL, byte cap and item cap, and is consumed once. The migration drops the result_body column: the central database does not persist the diagnostic result payload.
apps/control-plane/internal/store/store.godeployments/railway/migrations/000006_transient_results.up.sqlLocal credential protection
The Agent identity never travels as a tool parameter. On Windows it is protected with DPAPI LocalMachine scope; on Linux it is encrypted with a machine-bound key. The database secret is resolved on the host either way.
apps/edge-agent/internal/credentials/store_windows.goArtifacts are text, never execution
Generated artifacts are limited to text extensions, written without execute permission, hashed into a manifest and never launched by the Agent.
apps/edge-agent/internal/artifact/manager.goGovernable metadata
Tasks, policy decisions and events land in audit tables: actor, organization, environment, tool, outcome and timestamp. The product registers audit metadata; it does not claim regulatory immutability.
deployments/railway/migrations/000001_initial.up.sql
Bring a real diagnostic scenario
The pilot sells joint learning, not a self-service subscription. We are selecting design partners to validate read-only diagnostics in a non-production environment, with the administrator in the loop.
- 01Teamcenter on Windows or Linux, with SQL Server or Oracle.
- 02A non-production environment that represents production.
- 03A Teamcenter administrator available to validate the findings.
What to send
Send the scenario, not an email address: the symptom, the component and what you already ruled out. AWC unavailable, an upgrade baseline or a BMIDE model review are the strongest starting points.
Technical prototype. Not certified by Siemens. Teamcenter is a trademark of Siemens.
No production use in the first cycle. No automatic remediation. Findings are hypotheses for a human to confirm.