Live survey304 models · 14 providers · 22,792 auditsAudited grill-with-docs · SAFE →What changedHow we verifyllms.txt

MCP server · Audited from source

blockbench-mcp-plugin

by jasonjgardner/blockbench-mcp-pluginGPL-3.0 licenceAudited 25 Oct 2026 · source 7b761ae98242

npm blockbench-mcp 1.10.1stdiostreamable-http★ 576
✕BLOCKGrade D · 66/100 · 25 Oct 2026 · 7b761ae
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade D (66/100). It exposes 51 tools: 38 read, 12 write and 1 destructive. The audit recorded 31 findings (0 critical, 2 high, 3 medium, 22 low). Maintainer's description: Adds MCP server to Blockbench

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “blockbench-mcp-plugin (jasonjgardner/blockbench-mcp-plugin)”. Retrieved 25 Oct 2026. https://modelsatlas.com/mcp/jasonjgardner/blockbench-mcp-plugin

Why this is BLOCK. The audit found 0 critical and 2 high findings; the most severe is Code injection at server/tools/ui.ts:218. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

Trust audit

Audit 0.4.1 · full source read 25 Oct 2026

Trust score66/100✕BLOCK D
0 critical2 high3 medium22 low4 info

31 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared2 observations
  • NetworkDeclared2 observations
  • ShellDeclared2 observations
  • DependenciesNot pinnedSome ranges float
  • SecretsNone foundNo keys in source

Findings (31)

Sorted by severity · the 25 most severe of 31 are listed

HIGHCode injectioncode.eval_exec · server/tools/ui.ts:218
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
result = await eval(code.trim());
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHPrompt injectionprompt.credential_read · .agents/skills/bun-development/SKILL.md:240
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
// Access environment variables
Why
asks the agent to read credentials
Fix
—
MEDIUMInsecure cryptocrypto.weak_random · headless/mesh/draft.ts:26
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
return Array.from({ length }, () => KEY_CHARS[Math.floor(Math.random() * KEY_CHARS.length)] ?? "a").join("");
Why
No further detail recorded for this rule.
Fix
—
MEDIUMObfuscation / stealthobf.zero_width · server/tools/texture/texture-set-import.ts:32
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
const LEADING_BYTE_ORDER_MARK = /^/;
Why
No further detail recorded for this rule.
Fix
—
MEDIUMFilesystem / pathmcp.destructive_tools
F-05 Filesystem / pathCWE-22 · CWE-59Layer L3
delete_offscreen_view
Why
1 tool(s) can delete or overwrite
Fix
prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenanceinv.binary · lib/ai-disclosure.test.ts
F-13 Inventory / provenanceCWE-1104Layer L0
ai-disclosure.test.ts
Why
a compiled or binary member cannot be reviewed from source
Fix
ship source, or explain the binary in the README
LOWInventory / provenanceinv.hidden_file · .coderabbit.yaml
F-13 Inventory / provenanceCWE-1104Layer L0
.coderabbit.yaml
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWFilesystem / pathfs.traversal · benchmarks/harness.test.ts:394
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
'{"action":"read_context","path":"../../.env"}',
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · headless/render/input.test.ts:35
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
texture("embedded", { source: embedded, path: secret, relative_path: "../../secret.png" }),
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · headless/server.test.ts:212
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
const outside = await session.call("bbmodel_info", { file: "../../etc/model.bbmodel" });
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · headless/server.test.ts:382
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
const outside = await session.call("blockbench_launch", { file: "../../elsewhere/model.bbmodel" });
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · lib/particles/particles.test.ts:257
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
["../../outside/pwn", "/abs/tex", "C:/tex", "textures\\particle\\x", "textures//x"].forEach((texture) => {
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.metadata_ip · server/net-security.test.ts:127
F-04 Network egressCWE-200 · CWE-319Layer L1
"127.0.0.1", "0.0.0.0", "10.1.2.3", "100.64.0.1", "169.254.169.254", "172.16.0.1", "172.31.255.255",
Why
cloud metadata endpoint: the classic SSRF credential grab
Fix
—
LOWNetwork egressnet.metadata_ip · server/tools/import.test.ts:183
F-04 Network egressCWE-200 · CWE-319Layer L1
"http://169.254.169.254/latest/meta-data",
Why
cloud metadata endpoint: the classic SSRF credential grab
Fix
—
LOWNetwork egressnet.raw_ip · benchmarks/cli-track.test.ts:178
F-04 Network egressCWE-200 · CWE-319Layer L1
proxyUrl: "http://127.0.0.1:1234/mcp",
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · benchmarks/cli-track.test.ts:198
F-04 Network egressCWE-200 · CWE-319Layer L1
mcpServers: { bench: { type: "http", url: "http://127.0.0.1:1234/mcp" } },
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · benchmarks/cli-track.test.ts:315
F-04 Network egressCWE-200 · CWE-319Layer L1
expect(settings.mcpServers.bench.httpUrl).toBe("http://127.0.0.1:1234/mcp");
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · benchmarks/harness.test.ts:485
F-04 Network egressCWE-200 · CWE-319Layer L1
const client = await connect(`http://127.0.0.1:${http.port}/mcp`, id);
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · benchmarks/proxy.ts:85
F-04 Network egressCWE-200 · CWE-319Layer L1
return `http://127.0.0.1:${this.http.port}/mcp`;
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.decode_call · headless/particle.test.ts:18
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
const PNG_2X4 = Uint8Array.from(atob("iVBORw0KGgoAAAANSUhEUgAAAAIAAAAECAYAAACk7+45AAAAFklEQVR4nGP838Dwn4GBgYEJRGBnAABUcQKGuqbVnwAAAABJRU5ErkJggg=="), (c) => c.charCodeAt(0));
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.decode_call · server/tools/camera.test.ts:73
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
return { frame: atob(item.data), structured: result.structuredContent };
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.decode_call · server/tools/particle/host.ts:250
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
return Uint8Array.from(atob(base64), (character) => character.charCodeAt(0));
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.decode_call · tests/particle-tools.test.ts:13
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
const PNG_2X4 = Uint8Array.from(atob("iVBORw0KGgoAAAANSUhEUgAAAAIAAAAECAYAAACk7+45AAAAFklEQVR4nGP838Dwn4GBgYEJRGBnAABUcQKGuqbVnwAAAABJRU5ErkJggg=="), (c) => c.charCodeAt(0));
Why
No further detail recorded for this rule.
Fix
—
LOWObfuscation / stealthobf.decode_call · tests/texture-undo.test.ts:71
F-07 Obfuscation / stealthCWE-506 · CWE-94Layer L1
const encoded = atob(this.source.split(",")[1]);
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainsupply.unpinned · .agents/skills/mcp-builder/scripts/requirements.txt
F-08 Supply chainCWE-829 · CWE-1357Layer L1
anthropic, mcp
Why
2 requirement(s) not pinned with ==
Fix
pin exact versions

Tools it exposes

51 declared in source · 1 destructive

38 read12 write1 destructive

1 tool can delete or overwrite. An agent that can be talked into calling a tool can be talked into calling this one, so give it a token scoped to what you need.

ToolWhat it doesRisk
delete_offscreen_viewDisposes an offscreen view and releases its WebGL context. The userdestructive
add_locatorAdds a locator: a named point on a bone where particle effects (and sounds) spawn and which they follow as the bone animates. Exported as a Bedrock bone locator. Requires a format with locators (Bedrock Entity, GeckoLib, Generic Model). One undo step.write
bbmodel_createCreates a new, empty .bbmodel file (format 5.0). Build it up with bbmodel_edit. Refuses to replace an existing file unless overwrite is true.write
bbmodel_import_java_blockConverts a Minecraft Java Edition block/item model .json into a new java_block .bbmodel, porting Blockbenchwrite
bbmodel_outlineReturns the group/element tree of a .bbmodel file. Set transforms to include origins, rotations and cube from/to.write
create_brush_presetCreates a custom brush preset with specified settings. Omitted settings are stored as unset so loading the preset keeps the current value.write
create_offscreen_viewCreates a private offscreen viewport that renders the current project without moving the userwrite
create_particle_effectCreates a Bedrock particle effect (the Snowstorm format Blockbench, Minecraft Bedrock and GeckoLib use) from a preset plus design knobs, or from raw JSON. Writes <pack_root>/particles/<name>.json (and an optional custom texture to textures/particle/), validates it, and loads it into Blockbenchwrite
create_projectCreates a project with the given name and format, and returns a resource link to its live .bbmodel file.write
no_executeFine.write
set_modeSwitches Blockbenchwrite
trigger_actionTriggers an available Blockbench Action and respects its condition. The native action owns Undo; only a newly opened dialog may be auto-confirmed.write
update_particle_effectChanges an existing particle effect file with design knobs (only the components each knob owns are rewritten) or replaces it with raw JSON, validates it, saves it and refreshes the preview. Also loads an effect file from disk that Blockbench has not seen yet. Blockbench desktop only.write
DemoRuns the demo.read
TurntableReference modelread
bbmodel_convert_legacyWrites a copy of a .bbmodel in the 4.10 layout that Blockbench 4.x can open (a 5.0 file opens there as an empty scene). Mirrors Blockbenchread
bbmodel_export_bedrock_animationCompiles .bbmodel animations to Bedrock animation JSON (format_version 1.8.0), mirroring position X and rotation X/Y like Blockbenchread
bbmodel_export_bedrock_geometryCompiles a .bbmodel to Minecraft Bedrock geometry (.geo.json) using the same conventions as Blockbenchread
bbmodel_export_java_blockCompiles a .bbmodel to a Minecraft Java Edition block/item model .json the way Blockbenchread
bbmodel_export_modded_entityCompiles a .bbmodel to a Java entity model class with the same templates and code generation as Blockbenchread
bbmodel_find_elementsFinds elements in a .bbmodel file by name, type, containing group or texture. Returns world-space bounds for each match.read
bbmodel_get_nodeReturns the saved data of one group or element (by UUID or exact name), its parent, and its world-space bounds. Group results list their children.read
bbmodel_infoSummarizes a .bbmodel file: format, version, resolution, node counts, world-space bounds and the current revision. Start here before editing.read
bbmodel_list_animationsLists animation clips with length, loop mode and, per animated bone, how many keyframes each channel has.read
bbmodel_list_texturesLists the textures of a .bbmodel file with their index, size, and whether the image is embedded. Image data is not returned.read
bbmodel_particle_packDelivers the particle effects a .bbmodelread
bbmodel_renderRenders a .bbmodel file to a PNG with bb-render (headless three.js WebGPU), without Blockbench. Returns the image and its path. Optionally poses the model at a time in an animation clip. Views are relative to the modelread
bbmodel_sample_poseEvaluates an animation at a time and returns each animated boneread
bbmodel_web_urlMakes a link that opens a .bbmodel (or a Bedrock/Java .json model) in the Blockbench web app, with the file carried in the URLread
blockbench_code_eval_safetyCritical safety guide for agents using code evaluation/execution tools with Blockbench v5.0+. Contains breaking changes, quick reference, common mistakes, and safe code patterns for native module usage.read
blockbench_native_apisEssential information about Blockbench v5.0 native API security model and requireNativeModule() usage. Use this when working with Node.js modules, file system access, or native APIs in Blockbench plugins.read
export_modelCompiles the current project through a codec whose native export action is available. Returns JSON metadata and a live .bbmodel resource link; result_format=read
export_particle_packDelivers particle effects to a Bedrock resource pack: writes particles/<name>.json and copies custom textures to textures/particle/, then returns the particle_effects map to paste into the client entity so animation keyframe names resolve. Defaults to every effect the projectread
foreign_schemaUses a foreign schema.read
geckolib_list_easingsLists every easing name GeckoLib accepts on keyframes, which of them read easingArgs, and each argumentread
get_average_fpsMeasures the average frames per second of Blockbenchread
get_capabilitiesDiscover Blockbench/plugin versions, desktop or web environment, active project summary, and registered model formats. Returns detailed boolean format features (null means unknown; includes molang and java_cube_shade_direction_override) plus the formatread
get_project_infoNo description in the sourceread
hytale_animation_workflowGuide for creating animations for Hytale models. Covers 60 FPS timing, quaternion rotations, visibility keyframes, loop modes, and common animation patterns.read
hytale_attachmentsGuide for creating and managing attachments in Hytale models. Covers attachment collections, piece bones, modular equipment, and best practices.read
hytale_model_creationComprehensive guide for creating Hytale character and prop models. Covers format selection, node limits, shading modes, stretch, quads, and best practices.read
list_export_formatsLists registered export codecs, file extensions, compile/export support, and availability under the native export actionread
list_modesLists Blockbench editor tabs/modes with IDs, names, native availability, and the current mode. Includes plugin-added modes. Use before set_mode to discover whether Edit, Paint, Animate, or Display is available for the current project. Camera angles are controlled separately by set_camera_angle.read
list_particle_effectsLists particle effects loaded in Blockbench with their file, summary, texture status and validation warnings, every particle keyframe that uses them, keyframes that have no preview file or point at missing locators, and the client-entity particle_effects map a Bedrock pack needs.read
list_particle_presetsLists particle effect presets (smoke, fire, sparks, magic, glow, snow, drip, ...), built-in sprites and textures, materials and facing modes. Every preset uses a texture that ships with Minecraft and Blockbench, so it previews and runs with no image file. Read this before create_particle_effect.read
list_viewsLists render targets: the userread
manage_particle_keyframesAdds, removes or lists particle keyframes on an animationread
model_creation_strategyA strategy for creating a new 3D model in Blockbench.read
nameName to greet.read
no_descriptionNo description in the sourceread
resize_offscreen_viewChanges the pixel size of an offscreen view. The userread

Safer alternatives

We could not match this server to a job, so we cannot suggest a like-for-like alternative. Read-only servers are the least-privilege place to start.

Audit history

  1. ✕BLOCK D 66 / 100

    First audit · 7b761ae98242

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK DMODELSATLASBLOCK · D

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about blockbench-mcp-plugin

What is the blockbench-mcp-plugin MCP server?
Adds MCP server to Blockbench
What tools does blockbench-mcp-plugin expose?
51 in total: 38 read-only, 12 that write, and 1 that can delete or overwrite (delete_offscreen_view). Every one is listed on this page with its risk.
Is blockbench-mcp-plugin safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (66/100) and found 2 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does blockbench-mcp-plugin need?
No credential environment variables were found in its source, so it appears to need none.
How does blockbench-mcp-plugin run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as blockbench-mcp at 1.10.1.
How current is this page?
The grade is for one exact copy of the source (7b761ae98242), read on 2026-10-25. The repository is watched and re-audited when it changes.
I already installed blockbench-mcp-plugin. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.