Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Audited from source

Blender Model Context Protocol MCP server

by ahujasid/blender-mcpMIT licenceAudited 20 Sep 2026 · source 49eb1d78c324

PyPI mcp-for-blender★ 29,036
✕BLOCKGrade D · 61/100 · 20 Sep 2026 · 49eb1d7
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade D (61/100). It exposes 6 tools: 5 read, 1 write and 0 destructive. The audit recorded 14 findings (0 critical, 4 high, 6 medium, 4 low). Maintainer's description: Community plugin to control Blender 3D with any LLM of your choice

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “Blender Model Context Protocol MCP server (ahujasid/blender-mcp)”. Retrieved 20 Sep 2026. https://modelsatlas.com/mcp/ahujasid/blender-model-context-protocol

Why this is BLOCK. The audit found 0 critical and 4 high findings; the most severe is Code injection at addon.py:1500. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 20 Sep 2026

Trust score61/100✕BLOCK D
0 critical4 high6 medium4 low0 info

14 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemUndeclared5 observations not in its description
  • NetworkDeclared5 observations
  • ShellDeclared4 observations
  • DependenciesPinnedNothing floats
  • SecretsFoundSee the findings

Findings (14)

Sorted by severity

HIGHCode injectioncode.eval_exec · addon.py:1500
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(code, namespace)
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · src/blender_mcp/bundled/addon.py:1500
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(code, namespace)
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · src/blender_mcp/safe_mode.py:196
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
"eval": "eval() executes arbitrary expressions",
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · src/blender_mcp/safe_mode.py:197
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
"exec": "exec() executes arbitrary code",
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
MEDIUMFilesystem / pathfs.destructive · addon.py:2261
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
shutil.rmtree(temp_dir)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMFilesystem / pathfs.destructive · addon.py:3284
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
shutil.rmtree(temp_dir)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMFilesystem / pathfs.destructive · addon.py:3290
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
shutil.rmtree(temp_dir)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMFilesystem / pathfs.destructive · addon.py:3301
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
shutil.rmtree(temp_dir)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMFilesystem / pathfs.destructive · addon.py:3315
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
shutil.rmtree(temp_dir)
Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · tests/test_polypizza.py:17
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
LOWCode injectioncode.eval_exec · tests/test_addon_autostart.py:92
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
exec(  # noqa: S102 - execute only the selected functions from our own source.
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWObfuscation / stealthobf.decode_call · src/blender_mcp/server.py:1101
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
image_data = base64.b64decode(result["image_data"])
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainprompt.pipe_to_shell · README.md:53
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -LsSf https://astral.sh/uv/install.sh | sh
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainprompt.pipe_to_shell · README.md:205
F-08 Supply chainCWE-829 · CWE-1357Layer L2
curl -LsSf https://astral.sh/uv/install.sh | sh
Why
No further detail recorded for this rule.
Fix
—

Tools it exposes

6 declared in source · 0 destructive

5 read1 write0 destructive
ToolWhat it doesRisk
disable_telemetryNo description in the sourcewrite
get_addon_statusNo description in the sourceread
get_hunyuan3d_statusNo description in the sourceread
get_viewport_screenshotNo description in the sourceread
poll_hunyuan_job_statusNo description in the sourceread
record_trajectory_feedbackNo description in the sourceread

Safer alternatives

All design tools servers →
Magic✓SAFE

21st-dev/magic-mcp

It's like v0, but in your Cursor / Claude Code / Windsurf: search 10,000+ React/Tailwind components, generate new UI with AI, and publish your own — right from your editor. Magic MCP is now the 21st MCP; this package keeps old configs working. Setup: 21st.dev/mcp

Grade B
Figma MCP Bridge✓SAFE

gethopp/figma-mcp-bridge

Figma Plugin & MCP server to bypass API limits

3 destructiveGrade B
Figma Pilot✓SAFE

youware-labs/figma-pilot

MCP that let AI agents control Figma through code execution

1 destructiveGrade B

Audit history

  1. ✕BLOCK D 61 / 100

    Source changed, verdict held · 49eb1d78c324

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK DMODELSATLASBLOCK · D

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Blender Model Context Protocol MCP server

What is the Blender Model Context Protocol MCP server?
Community plugin to control Blender 3D with any LLM of your choice
What tools does Blender Model Context Protocol expose?
6 in total: 5 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Blender Model Context Protocol safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (61/100) and found 4 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Blender Model Context Protocol need?
No credential environment variables were found in its source, so it appears to need none.
How current is this page?
The grade is for one exact copy of the source (49eb1d78c324), read on 2026-09-20. The repository is watched and re-audited when it changes.
I already installed Blender Model Context Protocol. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

  • ahujasid/blender-mcp on GitHub — the source we read, its licence, stars and activityObserved · 20 Sep 2026
  • ModelsAtlas trust audit — BLOCK verdict for commit 49eb1d78c324Observed · 20 Sep 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.