MCP server · Audited from source
touchdesigner-mcp
by 8beeeaaat/touchdesigner-mcpMIT licenceAudited 31 Oct 2026 · source dc809cee5f95
npm touchdesigner-mcp-server 2.2.0stdiostreamable-http★ 606
Is it safe? No — BLOCK, grade F (31/100). No tools were found in its source. The audit recorded 30 findings (2 critical, 3 high, 8 medium, 16 low). Maintainer's description: MCP server for TouchDesigner
Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
Cite
Cite this page
ModelsAtlas. “touchdesigner-mcp (8beeeaaat/touchdesigner-mcp)”. Retrieved 31 Oct 2026. https://modelsatlas.com/mcp/8beeeaaat/touchdesigner-mcp
Why this is BLOCK. The audit found 2 critical and 3 high findings; the most severe is Prompt injection at plugin/touchdesigner/skills/launch/SKILL.md:14. Each finding is listed below with its file and line.
Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.
Trust audit
Audit 0.4.1 · full source read 31 Oct 2026
Trust score31/100✕BLOCK F
2 critical3 high8 medium16 low1 info
30 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemDeclared5 observations
- NetworkDeclared3 observations
- ShellDeclared7 observations
- DependenciesNot pinnedSome ranges float
- SecretsNone foundNo keys in source
Findings (30)
Sorted by severity · the 25 most severe of 30 are listed
CRITICALPrompt injectionprompt.transfer_instruction · plugin/touchdesigner/skills/launch/SKILL.md:14
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
1. **Check whether launching is even needed.** Resolve the endpoint from the active MCP configuration or session context as in the setup skill; treat `http://127.0.0.1:9981` as an assumption when neit
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
CRITICALPrompt injectionprompt.transfer_instruction · plugins/touchdesigner/skills/launch/SKILL.md:22
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
1. **Check whether launching is even needed.** Resolve the endpoint from the active MCP configuration or session context as in the setup skill; treat `http://127.0.0.1:9981` as an assumption when neit
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
HIGHCode injectioncode.eval_exec · td/modules/mcp/services/api_service.py:515
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
result = eval(script, namespace, namespace)
- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · td/modules/mcp/services/api_service.py:538
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(script, namespace, namespace)
- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · td/modules/mcp/services/api_service.py:557
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
namespace["result"] = eval(
- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
MEDIUMInventory / provenanceinv.binary · td/mcp_webserver_base.tox
F-13 Inventory / provenanceCWE-1104Layer L0
mcp_webserver_base.tox
- Why
- a compiled or binary member cannot be reviewed from source
- Fix
- ship source, or explain the binary in the README
MEDIUMInventory / provenanceinv.symlink · .agents/skills/integration-test-guard
F-13 Inventory / provenanceCWE-1104Layer L0
.agents/skills/integration-test-guard
- Why
- link not followed
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · .agents/skills/prepare-release
F-13 Inventory / provenanceCWE-1104Layer L0
.agents/skills/prepare-release
- Why
- link not followed
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · .agents/skills/release-test-audit
F-13 Inventory / provenanceCWE-1104Layer L0
.agents/skills/release-test-audit
- Why
- link not followed
- Fix
- —
MEDIUMInventory / provenanceinv.symlink · .agents/skills/touchdesigner-self-debug
F-13 Inventory / provenanceCWE-1104Layer L0
.agents/skills/touchdesigner-self-debug
- Why
- link not followed
- Fix
- —
MEDIUMCode injectioncode.dynamic_import · td/modules/mcp/services/api_service.py:762
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return importlib.import_module(target)
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMCode injectioncode.dynamic_import · td/modules/mcp_webserver_script.py:60
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
module = __import__(module_name, fromlist=["*"])
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMNetwork egressnet.raw_ip · .claude/skills/integration-test-guard/SKILL.md:61
F-04 Network egressCWE-200 · CWE-319Layer L1
TD_WEB_SERVER_HOST=http://127.0.0.1 TD_WEB_SERVER_PORT=9981 \
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWCode injectioncode.eval_exec · tests/unit/openaiPluginBuild.test.ts:29
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
return exec(process.execPath, [
- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
LOWCode injectioncode.eval_exec · tests/unit/openaiPluginBuild.test.ts:168
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
const before = await exec(npm, ["prefix"], options);
- Why
- evaluates text as code
- Fix
- remove; use a parser or a dispatch table
LOWFilesystem / pathfs.traversal · plugin/touchdesigner/hooks/scripts/td-config-context.mjs:13
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
new URL("../../.claude-plugin/plugin.json", import.meta.url),- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · src/api/components/schemas/TdPythonClassDetails.yml:23
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
$ref: ../../index.yml#/components/schemas/TdPythonMethodInfo
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · src/api/components/schemas/TdPythonClassDetails.yml:28
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
$ref: ../../index.yml#/components/schemas/TdPythonPropertyInfo
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · src/api/paths/api/nodes/detail.yml:30
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
- $ref: ../../../index.yml#/components/schemas/TdNode
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWFilesystem / pathfs.traversal · src/api/paths/api/nodes/errors.yml:28
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
$ref: ../../../index.yml#/components/schemas/TdNodeErrorReport
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · docs/architecture.md:676
F-04 Network egressCWE-200 · CWE-319Layer L1
--host=http://127.0.0.1 \
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · docs/architecture.md:763
F-04 Network egressCWE-200 · CWE-319Layer L1
"--host=http://127.0.0.1",
- Why
- No further detail recorded for this rule.
- Fix
- —
Tools it exposes
None declared in source
No tools were found in the source, so we cannot say what this server exposes.
Safer alternatives
We could not match this server to a job, so we cannot suggest a like-for-like alternative. Read-only servers are the least-privilege place to start.
Audit history
- ✕BLOCK F 31 / 100
First audit ·
dc809cee5f95
README badge
Badges show the current verdict, BLOCK included
A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.
Questions about touchdesigner-mcp
What is the touchdesigner-mcp MCP server?
MCP server for TouchDesigner
Is touchdesigner-mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (31/100) and found 5 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does touchdesigner-mcp need?
No credential environment variables were found in its source, so it appears to need none.
How does touchdesigner-mcp run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as touchdesigner-mcp-server at 2.2.0.
How current is this page?
The grade is for one exact copy of the source (dc809cee5f95), read on 2026-10-31. The repository is watched and re-audited when it changes.
I already installed touchdesigner-mcp. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.
Sources
- 8beeeaaat/touchdesigner-mcp on GitHub — the source we read, its licence, stars and activityObserved · 31 Oct 2026
- ModelsAtlas trust audit — BLOCK verdict for commit dc809cee5f95Observed · 31 Oct 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the touchdesigner-mcp MCP server?
- Is touchdesigner-mcp safe to connect to an agent?
- What credentials does touchdesigner-mcp need?