Atlas / MCP servers / veoery / GH

GHBLOCK

Name: GH
Author: veoery

mcp/veoery/gh

MCP server by veoery · Audited 2026-10-08

⚑ Report / re-scan Source ↗

This is a MCP Server that allows LLM to interact with Rhino and Grasshopper directly.

Verdict

BLOCK

Grade

Trust score

58 /100

Exposed tools

12 6r · 6w · 0d

Transport

—

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

GHmcpserver provides an approach that allows designer to interact with Rhino and Grasshopper directly via LLMs, including to analyse .3dm file, do 3D modeling and generate GHPython automatically in Grasshopper based on user’s guidance.

This project is still under construction — and we’d love your help! - Feel free to open an issue if you encounter bugs or have ideas. - Pull requests are always welcome. - If you're interested in collaborating long-term, feel free to reach out to [email protected] — we’d love to have you on the team!

Requirements

Rhino 7 or 8

Install RhinoPython: https://github.com/jingcheng-chen/RhinoPythonForVscode/tree/master?tab=readme-ov-file

uv

For MacOS and Linux

curl -LsSf https://astral.sh/uv/install.sh | sh


- ``````
# For Windows
powershell -ExecutionPolicy ByPass -c "irm https://astral.sh/uv/install.ps1 | iex"

Claude Desktop

Installation

1. Clone the repository

git clone [email protected]:veoery/GH_mcp_server.git
cd GH_mcp_server

2. Set up the environment

We recommend using uv:

macOS/Linux

uv venv
source .venv/bin/activate
uv pip install -e .

Windows

uv venv
.venv\Scripts\activate
uv pip install -e .

Make sure the virtual environment is activated before running or developing the project.

3. Configuration

In the Claude Desktop, Navigate to Settings->Developer. You will see ``Edit Config``.

Click the ``Edit Config` and open the file `claude_desktop_config.json``

Place the following code to the json file:

{
"mcpServers": {
"grasshopper": {
"command": "path_to_GH_mcp_server/.venv/bin/python",
"args": [
"path_to_GH_mcp_server/run_server.py"
]
}
}
}

Restart the Claude Desktop. If you are able to see a hammer icon, the co

Read from source at commit b7d61d6cc471OBSERVED · 2026-10-08

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control. Replace the environment placeholders with a token scoped to the least it needs.

claude-code

claude mcp add grasshopper-mcp --env COMPUTE_API_KEY=${COMPUTE_API_KEY} -- uvx grasshopper-mcp

claude-desktop

{
  "mcpServers": {
    "grasshopper-mcp": {
      "command": "uvx",
      "args": [
        "grasshopper-mcp"
      ],
      "env": {
        "COMPUTE_API_KEY": "${COMPUTE_API_KEY}"
      }
    }
  }
}

Exposed tools (12)

6 read · 6 write · 0 destructive.

Tool	Risk	Description
`add_grasshopper_component`	write	Add a component from an existing Grasshopper plugin.
`analyze_rhino_file`	read	Analyze a Rhino (.3dm) file.
`call_grasshopper_plugin`	read	Call a specific component from a Grasshopper plugin.
`connect_grasshopper_components`	read	Connect parameters between Grasshopper components.
`create_parametric_definition`	write	Create a complete parametric definition in Grasshopper based on a description.
`edit_gh_script_component`	write	Edit the code in an existing Python script component.
`execute_grasshopper_code`	write	Execute given Python code.
`extract_geometry`	read	Extract geometric data from an existing object.
`generate_rhino_code`	write	Generate and execute Rhino Python code based on a description.
`list_objects`	read	List all objects in a Rhino file.
`measure_distance`	read	Measure the distance between two objects in a Rhino file.
`run_grasshopper_definition`	write	Run a Grasshopper definition.

Trust audit

BLOCKgrade F · trust 58/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	FAIL
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	FAIL
L3	Class-specific surface	PASS
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: none-observed
Network: declared (5 observation(s))
Shell: declared (2 observation(s))
Dependencies: pinned
Secrets in source: found

Findings (13)

HIGHHard-coded secrets · inv.env_committed · CWE-798, CWE-321

.env

.env

Why it matters. a real .env in the package

Fix. ship .env.example with placeholders only

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

grasshopper_mcp/rhino/connection.py:400

exec(code, globals_dict, locals_dict)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

grasshopper_mcp/rhino/connection.py:424

exec(code, globals_dict, locals_dict)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

HIGHPrompt injection · prompt.zero_width · CWE-94, CWE-1427

README.md:104

Why it matters. invisible characters in instruction text

Fix. strip non-printing characters

MEDIUMInventory / provenance · inv.binary · CWE-1104

.DS_Store

.DS_Store

Why it matters. a compiled or binary member cannot be reviewed from source