Blender Open MCP is an MCP server that open Models MCP for Blender Using Ollama. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 87/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients - only the file and path differ.
{
"mcpServers": {
"blender-open-mcp": {
"args": [
"--transport",
"stdio"
],
"command": "blender-mcp"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Control Blender 3D with natural language prompts via local AI models. Built on the Model Context Protocol (MCP), connecting Claude, Cursor, or any MCP client to Blender through a local Ollama LLM.
Run this in your terminal to verify the server starts. Then let us know if it worked - your result helps other developers.
uvx 'uv' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories - click any category to see the underlying evidence.
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
By default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.4 include the `emSign ECC Root CA - G3` root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them. An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks. uv 0.13.4 removes the root from its vendo
uv's bundled CA store trusts an emSign root whose intermediate CA keys are compromised
By default, uv verifies TLS connections against a vendored copy of the `webpki-root-certs` bundle. Versions before 0.13.4 include the `emSign ECC Root CA - G3` root. Eight eMudhra intermediate CA certificates that chain to that root have compromised private keys, and the CA has revoked them. An attacker with one of the compromised keys can issue certificates that uv accepts for any hostname, and can be used to issue certificates to enable MITM attacks. uv 0.13.4 removes the root from its vendo
uv: Path traversal on Windows through wheel extraction
### Impact In versions of uv from 0.12.7 to 0.12.18 on Windows, uv could be induced into writing a file outside of the installation prefix during wheel installation. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's PATH. This vulnerability only affects Windows hosts; no other platforms are affected. ### Patches uv 0.12.18 and newer address this vulnerability. Users are encouraged to upgrade t
uv allows ZIP payload obfuscation through parsing differentials
## Impact In versions 0.8.5 and earlier of uv, remote ZIP archives were handled in a streamwise fashion, and file entries were not reconciled against the archive's central directory. This enabled two parser differentials against other Python package installers: 1. An attacker could contrive a ZIP archive that would extract with legitimate contents on some package installers, and malicious contents on others due to multiple local file entries. The attacker could choose which installer to target
uv is vulnerable to arbitrary file write through entry point names
### Impact In versions of uv prior to 0.11.15, when installing a distribution containing an entry point specification (under `console_scripts` or `gui_scripts`), uv would place the generated entry point according to the given name even if doing so resulted in a path outside of the environment's scripts directory. A malicious wheel could use this to place an executable outside of the intended environment, including in a directory already present on the user's `PATH`. This could shadow or overwr
Click any tool to inspect its schema.
Be the first to review
Have you used this server?
Share your experience - it helps other developers decide.
Sign in to write a review.
Others in design
Design tokens from any live site: colours, type, spacing, components, drift against a baseline.
Draw and visually collaborate with your agents on tldraw's canvas.
MeiGen-AI-Design-MCP — Turn Claude Code / OpenClaw into your local Lovart. Local ComfyUI, 1,400+ prompt library, multi-direction parallel generation.
Inspect and edit Three.js scenes, materials, shaders, lights in real time from any AI agent
MCP Security Weekly
Get CVE alerts and security updates for Blender Open Mcp and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
Local-first Model Context Protocol (MCP) server for controlling a live Blender session from AI agents, with a provider-agnostic LLM backend:
POST /chat/completions with an optional base URL
and API keyProviders are configured at startup (CLI flags or environment variables) and can be switched at runtime through MCP tools, so an agent can hop between backends without restarting the server.
MCP Client ──▶ FastMCP Server ──▶ (TCP 9876) ──▶ Blender add-on (addon.py) ──▶ bpy
│
└──────────────▶ (HTTP) ──▶ LLM provider (Ollama / LM Studio /
llama.cpp / OpenAI-compatible / Azure)
| Path | Purpose |
|---|---|
addon.py | Single-file Blender add-on: TCP server + scene/render/PolyHaven handlers + sidebar panel |
src/blender_open_mcp/server.py | MCP server: Blender tools, PolyHaven tools, LLM prompt + provider tools |
src/blender_open_mcp/llm.py | Provider-agnostic LLM layer (registry, adapters, model listing) |
src/blender_open_mcp/client/ | Canonical async MCP client + CLI |
client/ | Thin compat wrapper so from client import … keeps working from source |
tests/ | pytest suites (server, client, addon) |
Requires Python ≥ 3.10.
python -m venv .venv
.venv/Scripts/pip install -e ".[dev]" # Windows (bash/PowerShell)
# or: source .venv/bin/activate && pip install -e ".[dev]" # macOS/Linux
Edit → Preferences → Add-ons → Install…, choose addon.py.N, open the Blender MCP tab and click
Start MCP Server (listens on localhost:9876 by default).Default LLM backend is Ollama:
blender-mcp # Ollama at http://localhost:11434, model llama3.2
Or pick a different backend at startup:
# LM Studio (OpenAI-compatible, default localhost:1234/v1)
blender-mcp --llm-provider lmstudio --llm-model "local-model"
# llama.cpp server (default localhost:8080/v1)
blender-mcp --llm-provider llamacpp --llm-model qwen2.5-coder
# OpenAI-compatible generic endpoint
blender-mcp --llm-provider openai_compat --llm-base-url http://my-server:8000/v1 \
--llm-api-key sk-... --llm-model my-model
# OpenAI
blender-mcp --llm-provider openai --llm-api-key "$OPENAI_API_KEY" --llm-model gpt-4o-mini
# Azure AI Foundry / Azure OpenAI
blender-mcp --llm-provider azure --llm-api-key "$AZURE_API_KEY" \
--llm-base-url https://my-resource.openai.azure.com \
--llm-model my-deployment \
--llm-extra '{"resource":"my-resource","deployment":"my-deployment","api_version":"2024-06-01"}'
Environment variables are honored: BLENDER_OPEN_MCP_PROVIDER,
BLENDER_OPEN_MCP_BASE_URL, BLENDER_OPEN_MCP_MODEL,
BLENDER_OPEN_MCP_API_KEY.
Other useful flags: --host, --port (MCP endpoint, default 0.0.0.0:8000),
--blender-host, --blender-port, --transport streamable_http|http|stdio.
Point your MCP client at http://localhost:8000/mcp (streamable HTTP) or run
blender-mcp --transport stdio.
Example Claude/Cursor-style config:
{
"mcpServers": {
"blender": {
"url": "http://localhost:8000/mcp"
}
}
}
Scene / object control (forwarded to the Blender add-on over TCP):
blender_get_scene_info, blender_get_object_info, blender_create_object,
blender_modify_object, blender_delete_object, blender_set_material,
blender_render_image, blender_execute_code.
PolyHaven assets: