Meshy MCP ServerSAFE
MCP server for Meshy AI 3D generation platform
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
Model Context Protocol (MCP) server for the Meshy AI 3D generation platform. Enables AI agents to create, manage, and download 3D models, textures, images, rigged characters, and animations through natural conversation.
Features
24 tools covering the full Meshy API:
Key Capabilities
- Text to 3D: Generate 3D models from text descriptions (preview + refine pipeline)
- Image to 3D: Convert single or multiple images into 3D models
- Meshy 7.1 (v0.6.0):
ai_model: "meshy-7.1"(andlatest) on text-to-3d, image-to-3d and multi-image-to-3d.geometry_resolution: "standard" | "2k" | "4k"picks the geometry pass (+5 credits for 2k/4k; multi-image supports standard/2k).ultra_modeis deprecated - Meshy 6 Lite (v0.6.0):
ai_model: "meshy-6-lite"— fast, 5-credit mesh (15 textured, 2K textures only) on every generation endpoint - Smart Topology:
model_type: "smart-topology"withai_model: "meshy-t2"on text-to-3d (new in v0.6.0) and image-to-3d. Clean, part-separated triangle mesh generated directly at 100–15,000 faces (default 4,000) for 5 credits of mesh - **Multi-view texture on multi-image
6c53d74dce11OBSERVED · 2026-10-11Connect
Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.
claude mcp add meshy-mcp-server --env MESHY_API_KEY=${MESHY_API_KEY} -- npx -y @meshy-ai/[email protected]{
"mcpServers": {
"meshy-mcp-server": {
"command": "npx",
"args": [
"-y",
"@meshy-ai/[email protected]"
],
"env": {
"MESHY_API_KEY": "${MESHY_API_KEY}"
}
}
}
}Exposed tools (24)
23 read · 1 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
meshy_analyze_printability | read | |
meshy_animate | read | |
meshy_cancel_task | read | |
meshy_check_balance | read | |
meshy_convert | read | |
meshy_creative_lab | read | |
meshy_download_model | read | |
meshy_get_task_status | read | |
meshy_image_to_3d | read | |
meshy_image_to_image | read | |
meshy_list_models | read | |
meshy_list_tasks | read | |
meshy_multi_image_to_3d | read | |
meshy_process_multicolor | read | |
meshy_remesh | read | |
meshy_repair_printability | read | |
meshy_resize | read | |
meshy_retexture | read | |
meshy_rig | read | |
meshy_send_to_slicer | write | |
meshy_text_to_3d | read | |
meshy_text_to_3d_refine | read | |
meshy_text_to_image | read | |
meshy_uv_unwrap | read |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- none-observed
- Network
- declared (3 observation(s))
- Shell
- declared (1 observation(s))
- Dependencies
- not all pinned
- Secrets in source
- none-found
Findings (2)
return { requests, url: `http://127.0.0.1:${api.address().port}`, close: () => api.close() };@modelcontextprotocol/sdk, axios, dotenv, express, zod, @types/express, @types/node, tsx
Gates applied: no_behavioural_pass.
6c53d74dce11full audit observations/trust-audit/mcp-server/meshy-dev__meshy-mcp-server.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | 6c53d74dce11 | SAFE | B | 89 | first audit |
Questions
What is the @meshy-ai/meshy-mcp-server MCP server?
MCP server for Meshy AI 3D generation platform
What tools does @meshy-ai/meshy-mcp-server expose?
24 in total: 23 read-only, 1 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is @meshy-ai/meshy-mcp-server safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does @meshy-ai/meshy-mcp-server need?
It reads MESHY_API_KEY from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does @meshy-ai/meshy-mcp-server run?
It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as @meshy-ai/meshy-mcp-server at 0.6.2.
How current is this page?
The grade is for one exact copy of the source (6c53d74dce11), read on 2026-10-11. The repository is watched and re-audited when it changes.