ModelsAtlas
Explore
Atlas / MCP servers / sandraschi / Blender

BlenderBLOCK

mcp/sandraschi/blender-20
MCP server by sandraschi · 3d modeling · animation · blender · Audited 2026-10-08
⚑ Report / re-scanSource ↗

Headless Blender automation via FastMCP — 41 portmanteau tools (150+ ops). Batch mesh/VSE/Grease Pencil, VRM, Gaussian splats; optional live bridge. For Cursor / Claude Desktop. React dashboard + Tauri app.

Verdict
BLOCK
Grade
F
Trust score
38 /100
Exposed tools
66 56r · 9w · 1d
Transport
sse · stdio
License
MIT
Stars
55
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Control Blender with natural language through MCP. Tell Claude to create a steampunk robot with glowing eyes and watch it build in Blender.

Get started in 2 minutes

Steps

  1. Download the .mcpb from Releases
  2. Drag it into Claude Desktop (Settings → MCP Servers → Install from file)
  3. Install Blender if you have not already
  4. Restart Claude Desktop and try: Create a red cube on a gray floor with a sun lamp.

That is enough for most tools — the server runs Blender headless in the background.

Optional — live viewport: install the bridge addon in Blender to watch the scene update while you chat. See INSTALL.md.

Other install meth

Read from source at commit b5c071fe9c60OBSERVED · 2026-10-08
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code
claude mcp add blender-mcp-webapp --env SKETCHFAB_API_TOKEN=${SKETCHFAB_API_TOKEN} -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "blender-mcp-webapp": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ],
      "env": {
        "SKETCHFAB_API_TOKEN": "${SKETCHFAB_API_TOKEN}"
      }
    }
  }
}
03

Exposed tools (66)

56 read · 9 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
OpenFangreadFleet supervisor and modular agentic node controller.
add_to_collectionwriteAdd an object to a collection.
agentic_blender_workflowwriteExecute autonomous multi-step Blender workflows via FastMCP 3.1 SEP-1577 sampling.
ai_chatreadChat with the Blender AI assistant. Provides natural-language help with Blender operations.
blender_addonsread
blender_ai_generateread
blender_api_docsread
blender_atlasingread
blender_batchread
blender_compositorread
blender_downloadread
blender_exportread
blender_export_presetsread
blender_geonodesread
blender_grease_pencilread
blender_helpread
blender_importwrite
blender_jobsread
blender_logsread
blender_materialsread
blender_materials_bakingread
blender_modifiersread
blender_particlesread
blender_physicsread
blender_renderread
blender_sceneread
blender_sculptread
blender_selectionread
blender_sessionread
blender_shadersread
blender_shapekeysread
blender_shutdownreadShut down the blender-mcp server process.
blender_splattingread
blender_statusread
blender_texturesread
blender_transformread
blender_uvread
blender_validationread
blender_vision_refineread
blender_vrm_metadataread
blender_vseread
blender_workflowread
clear_scenedestructiveRemove all objects from the current scene.
config_getreadReturn current webapp config (LLM provider, URLs, selected model, etc.).
config_setwriteUpdate webapp config. Pass keys: server_host, server_port, theme, auto_sync, notifications, llm.
construct_objectread
conversational_blender_assistantreadConversational Blender assistant with SEP-1577 multi-step sampling.
create_collectionwriteCreate a new collection.
create_scenewriteCreate a new Blender scene with the specified name.
export_for_mcp_handoffread
generate_blender_scriptreadGenerate a Blender Python script from a natural language prompt using a local LLM (Ollama).
import_cad_filewrite
intelligent_3d_processingreadIntelligent batch 3D scene processing via FastMCP 3.1 SEP-1577 multi-step sampling.
list_local_modelsreadDiscover local LLM models from Ollama and LM Studio.
list_scenesreadList all scenes in the current Blender file.
llm_modelsread
manage_asset_libraryread
manage_blender_addonsread
manage_object_constructionread
scene_get_hierarchyreadGet the full scene hierarchy as a JSON-formatted string.
script_executewrite
server_inforeadReturn Blender MCP server information, version, and status.
set_active_scenewriteSet the active scene by name.
show_blender_status_appreadShow Blender MCP server status as a rich dashboard card.
show_logs_appreadShow recent log entries as a scrollable Prefab card.
show_tools_appreadList all tools organized by category as a Prefab card.
04

Trust audit

BLOCKgrade F · trust 38/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)FAIL
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (8 observation(s))
Network
declared (11 observation(s))
Shell
declared (8 observation(s))
Dependencies
not all pinned
Secrets in source
none-found

Findings (25)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
addon/blender_bridge_addon.py:318
exec(compile(code, "<mcp_bridge>", "exec"), {"bpy": bpy})
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
mcpb/assets/addon/blender_bridge_addon.py:318
exec(compile(code, "<mcp_bridge>", "exec"), {"bpy": bpy})
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/blender_mcp/handlers/atlasing_handler.py:484
atlas_found = eval(line.split(": ")[1])
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
src/blender_mcp/handlers/rigging_handler.py:799
unmapped = eval(line.split(": ")[1])
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
HIGHNetwork egress · net.env_exfil · CWE-200, CWE-319
scripts/cua-smoke.py:325
os.environ.copy() ... urllib.request
Why it matters. reads secrets in the same file that sends data out
HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427
docs/installation.md:1
# Installation
Why it matters. invisible characters in instruction text
Fix. strip non-printing characters
MEDIUMInventory / provenance · inv.binary · CWE-1104
extension.wasm
extension.wasm
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.symlink · CWE-1104
scripts/backup-repo.ps1
scripts/backup-repo.ps1
Why it matters. link not followed
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
mcpb/verify_pack.py:28
mod = importlib.import_module(entry_module)
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
src/blender_mcp/tools/__init__.py:219
package_mod = importlib.import_module(package)
MEDIUMCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95
src/blender_mcp/tools/__init__.py:237
importlib.import_module(full_module_name)
MEDIUMNetwork egress · net.raw_ip · CWE-200, CWE-319
Dockerfile:60
CMD python -c "import urllib.request; urllib.request.urlopen('http://127.0.0.1:10849/api/v1/health', timeout=5)"
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
fleet-start.config.ps1:1
# Per-repo fleet start config for blender-mcp
MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94
webapp/start.ps1:1
# Fleet unified launcher - do not edit logic here.
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
clear_scene
Why it matters. 1 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.hidden_file · CWE-1104
.assess-fix-timestamp
.assess-fix-timestamp
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.depot.json
.depot.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.mcpbignore
.mcpbignore
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.pre-commit-config.yaml
.pre-commit-config.yaml
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
.windsurfrules
.windsurfrules
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
docs/blender_bridge_addon.py:318
exec(compile(code, "<mcp_bridge>", "exec"), {"bpy": bpy})
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
scripts/cua-webapp-test.py:383
digest = hashlib.md5(img.tobytes(), usedforsecurity=False).hexdigest()
LOWInsecure crypto · crypto.weak_hash · CWE-327, CWE-338
src/blender_mcp/tools/repository_tools.py:121
return hashlib.md5(content.encode()).hexdigest()[:16]
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
.cursor/skills/mcp-server-developer/modules/minimal-mcp-server.md:93
2. In Claude Desktop: `/mcp servers add hello-mcp --url http://127.0.0.1:8000`.
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
.cursor/skills/mcp-server-developer/modules/minimal-mcp-server.md:230
By default, FastMCP binds to `localhost:3333`. Configure your client (e.g., Claude Desktop, Cursor, Windsurf) to use `http://127.0.0.1:3333`.

Gates applied: no_behavioural_pass.

Audited 2026-10-08 · audit v0.4.1 · source sha b5c071fe9c60full audit observations/trust-audit/mcp-server/sandraschi__blender-20.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-08b5c071fe9c60BLOCKF38first audit
06

Questions

What is the Blender MCP server?

Headless Blender automation via FastMCP — 41 portmanteau tools (150+ ops). Batch mesh/VSE/Grease Pencil, VRM, Gaussian splats; optional live bridge. For Cursor / Claude Desktop. React dashboard + Tauri app.

What tools does Blender expose?

66 in total: 56 read-only, 9 that write, and 1 that can delete or overwrite (clear_scene). Every one is listed on this page with its risk.

Is Blender safe to connect to an agent?

No — not without reading the findings first. The audit graded it F (38/100) and found 6 critical or high issues in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does Blender need?

It reads SKETCHFAB_API_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.

How does Blender run?

It speaks sse and stdio, so it runs as a local process your client starts. It is published on npm as blender-mcp-webapp at 1.0.0.

How current is this page?

The grade is for one exact copy of the source (b5c071fe9c60), read on 2026-10-08. The repository is watched and re-audited when it changes.

Advertisement