powershell.exe -NoProfile -ExecutionPolicy Bypass -Command 'iwr -useb https://bimcli.com/install.ps1 -OutFile $env:TEMP\bim-install.ps1; powershell -NoProfile -ExecutionPolicy Bypass -File $env:TEMP\bim-install.ps1'
If you need sign-off before bim goes on firm PCs, send this page to IT. It lists what bim installs, what it talks to on the network, what an agent can change, and how to check and remove it. Everything here is taken from the shipped code and the current release.
bim-cli is made by Small Tiger Group (smalltigergroup.com). It is free: no account, no license key, no seat fee. The license is in the terms of use, and what it collects is in the privacy policy.
The installer is per-user. It needs no admin rights and adds no service, no scheduled task and no machine-wide setting.
| What | Where |
|---|---|
bim.exe, the drivers\ folder, manifest.json, version.txt |
%LOCALAPPDATA%\bim-cli\ |
| Local operation log (never uploaded) | %LOCALAPPDATA%\bim-cli\logs\bim.jsonl |
| PATH entry for that folder | your user Path (HKCU\Environment) |
Created later, only when bim is used:
| What | Where | When |
|---|---|---|
| Anonymous install ID, telemetry opt-out marker, update-check cache | %APPDATA%\bim-cli\ (did, telemetry.off, update-check.json) |
first run or install (the ID is not created when telemetry is off) |
| Google sign-in token | %APPDATA%\bim-google\ |
only after bim google login |
Revit add-in: RevitCli.addin manifest and a RevitCli\ folder with the add-in DLL |
%APPDATA%\Autodesk\Revit\Addins\<year>\ for each Revit year used, plus a log at %APPDATA%\Autodesk\Revit\Addins\RevitCli.log |
the first Revit command (exec, launch, open) or bim revit install |
| Revit and Blender session files, launch lock, change snapshots, saved scripts | inside %LOCALAPPDATA%\bim-cli\ (instances\, locks\, changes\, scripts\) |
when those drivers run |
Browser profiles for bim bro |
%LOCALAPPDATA%\bro\ |
only if the bro driver is used |
| Output files when no path is given | %TEMP%\bim-cli\out\ |
when a verb writes a file |
A few drivers install third-party software, and only when someone runs that verb: bim blender install (Blender, and Bonsai if asked, into %LOCALAPPDATA%\bim-cli\blender\), bim energy install (NREL OpenStudio), bim image setup (exiftool and ImageMagick), bim sketchup setup (SketchUp itself, silently), bim sketchup install (an extension in SketchUp's Plugins folder) and bim rhino install (an add-in under %APPDATA%\McNeel\Rhinoceros plus per-user registry keys).
About the Revit add-in: bim needs Revit 2024–2027 installed and licensed. It starts Revit or attaches to an open Revit, and Revit runs in its own window. An already-open Revit has to be restarted once to load the add-in. Because the add-in is not signed, Revit shows its "Security - Unsigned Add-In" dialog; when bim starts Revit itself it answers "Always Load", and a person who restarts Revit themselves should pick "Always Load" too. bim talks to the add-in over 127.0.0.1 only.
| Host | What it is for | When | How to turn it off |
|---|---|---|---|
bimcli.com, dl.bimcli.com |
the install script, the release zip and its .sha256 |
install and upgrade | use the manual install |
dl.bimcli.com/latest.txt |
update check (reads one version number) | at most once a day | BIM_NO_UPDATE_CHECK=1 |
t.bimcli.com |
anonymous usage telemetry: command name, exit code, version; no file paths or argument values | on by default, per command | bim telemetry off, DO_NOT_TRACK=1 or BIM_TELEMETRY=0 |
bim-cli-telemetry.smalltigergroup.workers.dev |
one install ping from install.ps1 (version, install ID, channel) |
once per new install or upgrade | DO_NOT_TRACK=1 or BIM_TELEMETRY=0 before installing |
| FEMA, the US Census geocoder, OpenStreetMap (Nominatim, Overpass), USGS, USDA, Esri-hosted public layers, city and county open-data portals | flood, zoning, parcel, soil and map lookups | only when a bim site verb runs |
don't use the site driver |
Google APIs (googleapis.com, accounts.google.com) |
Sheets, Docs, Drive, Calendar, Gmail, Apps Script | only when a bim google verb runs, with your own sign-in |
don't sign in |
| the sites you open | browser automation | only when a bim bro verb runs |
don't use the bro driver |
| GitHub, the Blender and SketchUp download hosts | downloading the third-party programs listed above | only during those install or setup verbs | don't run them |
Work on local files (PDF, Excel, images, IFC) and Revit itself stays on the machine. Full telemetry fields, retention and erasure (bim telemetry forget) are in the privacy policy.
Every verb can declare an effect in its description:
29 verbs declare mutate today. 8 of them have a way to preview or undo: --dry-run reports what would change and changes nothing, and --rollback runs the change inside Revit and then rolls it back. The rest have no preview, so an agent should copy the file first or ask before running them. This table is built from the release's driver descriptions.
| Command | Preview or undo |
|---|---|
bim pdf annot remove | none |
bim pdf form fill | none |
bim pdf form flatten | none |
bim pdf page rotate | none |
bim pdf page crop | none |
bim pdf stamp add | none |
bim pdf stamp remove | none |
bim pdf annot bake | none |
bim pdf annot review | none |
bim pdf document upsert | --dry-run |
bim pdf document migrate | --dry-run |
bim pdfv open | --dry-run |
bim pdfv exec | --dry-run |
bim pdfv quit | --dry-run |
bim revit exec | --rollback |
bim revit quit | none |
bim revit kill | none |
bim revit open | none |
bim revit launch | none |
bim revit install | none |
bim revit family place | --rollback |
bim revit param set | --dry-run |
bim revit restart | none |
bim revit workshare enable | none |
bim revit workshare local | none |
bim revit workshare sync | none |
bim revit rotate | none |
bim revit move | none |
bim revit view-activate | none |
276 of 370 verbs don't declare an effect yet, mostly in the Google, PDF and site drivers. Some of those also change things (appending to a Google Sheet, removing a PDF attachment, sending Gmail), so treat an undeclared verb as one that can change things.
Set BIM_READ_ONLY=1 (or pass --read-only) and bim runs only verbs that declare read. Everything else is refused before the driver starts, with exit code 5 and an error of kind read-only, including verify, render, mutate and undeclared verbs, bim uninstall and the MCP tools for those verbs. describe, doctor and version still work.
A firm can set BIM_READ_ONLY=1 as a user or machine environment variable (for example by Group Policy) on PCs where agents should only look. It is a guard rail against mistakes, not a security boundary: anyone running as that user, including an agent, can unset it in their own shell.
Each bim call adds one line to %LOCALAPPDATA%\bim-cli\logs\bim.jsonl: time, verb, arguments, success or error, run time, driver and version. Failures are also kept in bim-failures.jsonl next to it. The log stays on the machine and keeps three rotated backups; BIM_OPLOG=0 or DO_NOT_TRACK=1 turns it off.
bim.exe, the drivers and the Revit add-in are not code-signed today. Windows reports them as NotSigned, and Revit shows its unsigned add-in dialog. What you can check is the SHA256 of the release zip, which is published next to it. The installer does this check itself and stops on a mismatch; to check by hand in PowerShell:
$v = (curl.exe -s https://dl.bimcli.com/latest.txt).Trim()
curl.exe -LO "https://dl.bimcli.com/$v/bim-cli-windows-amd64.zip"
curl.exe -LO "https://dl.bimcli.com/$v/bim-cli-windows-amd64.zip.sha256"
Get-Content .\bim-cli-windows-amd64.zip.sha256
(Get-FileHash -Algorithm SHA256 .\bim-cli-windows-amd64.zip).Hash
The two hashes must match (case aside). The checksum sits on the same server as the zip, so it catches a broken or altered download in transit, not a compromised server. The manual install steps unzip and add the PATH entry by hand, without running the install script. You can read the install script before running it; -ExecutionPolicy Bypass in the install line applies to that one PowerShell process only.
uninstall.ps1 and the built-in bim uninstall --yes remove %LOCALAPPDATA%\bim-cli\ (the program, drivers, logs and session files) and the PATH entry. They leave:
%APPDATA%\Autodesk\Revit\Addins\<year>\,%APPDATA%\bim-cli\ (install ID and settings) and %APPDATA%\bim-google\ (Google sign-in),%LOCALAPPDATA%\bro\, %TEMP%\bim-cli\out\, and any third-party program a setup verb installed.For a full removal, close Revit, then in PowerShell:
bim telemetry forget
iwr -useb https://bimcli.com/uninstall.ps1 -OutFile $env:TEMP\bim-uninstall.ps1
powershell -NoProfile -ExecutionPolicy Bypass -File $env:TEMP\bim-uninstall.ps1
Get-ChildItem "$env:APPDATA\Autodesk\Revit\Addins\*\RevitCli.addin" | Remove-Item
Get-ChildItem "$env:APPDATA\Autodesk\Revit\Addins\*\RevitCli" -Directory | Remove-Item -Recurse
Remove-Item "$env:APPDATA\Autodesk\Revit\Addins\RevitCli.log" -ErrorAction SilentlyContinue
Remove-Item -Recurse "$env:APPDATA\bim-cli", "$env:APPDATA\bim-google" -ErrorAction SilentlyContinue
bim telemetry forget asks the server to erase this machine's telemetry; skip it if telemetry was never on. The revit driver has no uninstall verb yet, which is why the add-in files are removed by hand. Open a new terminal afterwards for the PATH change to take effect.
powershell.exe -NoProfile -ExecutionPolicy Bypass -Command 'iwr -useb https://bimcli.com/install.ps1 -OutFile $env:TEMP\bim-install.ps1; powershell -NoProfile -ExecutionPolicy Bypass -File $env:TEMP\bim-install.ps1'
Then ask your assistant to run bim describe --json. See what the installer does.