One configuration in. Six smarter tools out.
The input is a single settings window, filled once. The output is AI features lighting up across the suite — with a disciplined middle: schema-validated replies, privacy enforced at resolve time, and a write bridge where nothing lands without your approval.
Tap Input or Output to isolate a half — the other collapses.
One window. No chat.
The Setup panel's Synapse button opens the only surface there is: provider, key, model, privacy. The window itself says the contract.
One window. No chat.
Pick a provider from five — Anthropic (Claude), OpenAI (ChatGPT), Google (Gemini), Azure OpenAI, or a self-hosted private model — paste the key once, set the model and the privacy mode. After the first save the key field reads “API key (saved — leave blank to keep)” and never echoes what it stored: keys are sealed with Windows DPAPI on this machine, and are never written to the model, a settings file or a log.
Local only means locally enforced.
Two modes are offered, in the app's own words: “Allow the selected provider” and “Local only — nothing leaves this PC”. Local-only is not a preference label — the provider factory refuses to build a remote adapter at all, and checks that the actual endpoint is local before a single byte moves. A third mode, ask-each-time, is deliberately not offered until its consent gate is real.
Test connection is a live call, not a ping.
Test saves the settings first, then runs the real pipeline end to end — the reply has to come back as valid, schema-checked JSON before the window prints the green line: “Connected. Anthropic (Claude) · claude-opus-4-8 · 840 ms.” A failure names itself instead of shrugging: “Test failed — …”. What you proved is exactly what every tool will use.
Each provider keeps its own drawer, and a half-configured save is refused.
Switch from Claude to Azure and Claude's model and sealed key stay exactly where they were; switch back and nothing is retyped. Azure OpenAI is the only provider that asks for a Deployment and an API version (the endpoint a self-hosted model wants too), and the window checks the endpoint, the deployment and the key before it commits anything, so a rejected save leaves neither a key nor half a configuration behind: “Azure OpenAI needs a deployment name.” A save that passes names what it armed: “Saved. Every BIMIO tool can now use Azure OpenAI.”
The rules live in the model. Change them without shipping a build.
A standard baked into an add-in is a standard only its author can change, and every project that needs a different one waits for a release. Synapse keeps the rule set inside the model, so it travels with the file and a BIM manager edits it on the spot. One rule per line; a tag says whether a program can check it or whether it needs judgement, and another says how loudly to complain. And the same window will read a BEP or standards document and extract the rules from it, so the first version does not have to be typed at all.
The pipeline runs off the Revit thread and never touches the model. Only an approved change reaches the write bridge — “BIMIO Synapse — <action>” — and if the active document changed since you approved, nothing is written.
Six tools, one connection — and a bridge that asks first.
No tool talks to a provider directly. Everything goes through the same orchestrator, the same schemas, the same privacy answer — and the same write bridge.
Nothing writes without you — and never to the wrong model.
The pipeline runs entirely off the Revit thread and never touches the model; upstream response bodies are never logged. Only a change you approved reaches the write bridge, which opens one named transaction — “BIMIO Synapse — <action>” — and refuses a model swap mid-flight. The refusal comes back to the tool that asked, in the bridge's own words: “The active document changed since this change was approved — nothing was written.”
Six tools, one connection.
Lens classifies changes and writes element briefs and report copy; Canon drafts rules from your standards documents; Assay triages warnings; Clash triages interferences and writes briefs; Graft explains diffs; Quire drafts sheet plans — each through the same service, the same key, the same privacy answer. Connect once, and the buttons that were waiting light up everywhere.
Before it is connected, a tool says so in its own words.
Nothing greys out unexplained. Ask Lens to explain an element with no provider set and the panel answers: “Connect an AI provider in BIMIO Synapse (Setup panel) to use Explain.” Clash meets a triage click with “No AI provider is connected. Set one up in BIMIO Synapse (connect your AI once, every tool benefits), then try again.” Canon points at the Setup panel and adds that the key stays on this machine. Every one of those tools does the rest of its job untouched.
Connect an AI provider in BIMIO Synapse (Setup panel) to use Explain.
No AI provider is connected. Set one up in BIMIO Synapse (connect your AI once, every tool benefits), then try again.
No AI provider is configured. Open BIMIO Synapse in the Setup panel, connect your AI (Claude, OpenAI, a local model…), then come back — your key stays on this machine and the whole suite can use it.
A wrong key is named as a wrong key, and it is not retried.
Failures come back typed. A 429 or a 503 is retried up to four attempts with exponential backoff, honouring the provider's own Retry-After header; a 401 is not, because waiting will not mend a rejected credential — so the window reports “Test failed — The AI provider rejected the credential (HTTP 401).” Tools also cap the AI themselves: Assay gives warning triage sixty seconds, then records “The AI provider did not answer within 60 s — warnings are in Revit's own order”. No failure writes anything.
A firm can lock it.
Drop a firm lock and the window goes read-only with a banner in its own words: “Your organisation has locked the AI configuration. These settings are read-only.” Answers that matter travel with the model in Extensible Storage, with large payloads mirrored to a per-project store and hash-verified on load — so what the AI once said about a model stays with that model.
Every draft names the AI that wrote it, and whether your text left the building.
The tools do not just consume the connection, they display it. On a seat running a private model, Canon's Draft with AI window carries “AI: Self-hosted (private model) (llama-3.3-70b) · local — nothing leaves this PC”, and Quire's draft header “AI: Self-hosted (private model) · local · Local-only”. Point the same seat at Claude and both chips say that instead. The privacy answer does not stop at the settings window — it rides along to the moment somebody has to sign off the result.