blender-mcp

ahujasid/blender-mcp

This project connects AI coding agents to a live Blender session through an MCP server and a companion Blender addon, enabling prompt-driven 3D modeling, scene inspection, rendering, and asset importing. The biggest risk is that the server allows the AI agent to execute arbitrary Python code inside Blender by default, meaning a prompt injection can run arbitrary commands and access any file on the user's machine.

What it can reach

Shell commands

Executes arbitrary Python code inside the live Blender process via execute_blender_code, which has full access to spawn shell commands and subprocesses.

Files

Reads and writes scene files, screenshots, images, Blender addons, and MCP client configuration files (Claude, Cursor, VS Code, Codex, Windsurf/Devin, OpenCode, Antigravity).

Network

Listens on localhost TCP port 9876 inside Blender, and connects to Poly Haven, Sketchfab, Poly Pizza, Hyper3D Rodin, Tencent Hunyuan3D, Tripo, Meshy, GitHub, PyPI, and a Supabase backend for telemetry and Premium services.

Secrets

Reads API keys for Sketchfab, Poly Pizza, Hyper3D, Hunyuan3D, Meshy, Tripo, and MCP for Blender Premium from Blender preferences or environment variables.

Findings

1. CriticalArbitrary Python code execution in Blender by default

   addon.py:2333

   The execute_blender_code tool sends Python code from the AI agent directly to exec() inside the Blender process, and BLENDER_MCP_SAFE_MODE is disabled by default. If the agent processes untrusted text containing a prompt injection, an attacker can invoke execute_blender_code to run arbitrary system commands and read or modify any file on the user's machine.

   Fix: Enable safe mode by default or require explicit user confirmation inside Blender before running scripts received over the MCP connection.

2. HighSafe mode AST sandbox bypass via imported standard library modules

   src/blender_mcp/safe_mode.py:122

   When BLENDER_MCP_SAFE_MODE=1 is enabled, the AST validator permits importing several standard library modules (such as uuid, random, and dataclasses) and permits accessing any non-dunder attribute on them. Because these modules import os and sys in their own global scope (for example, uuid.os and random._os), a script can call uuid.os.system(...) or random._os.system(...) to bypass the AST validator completely and execute arbitrary shell commands.

   Fix: Block access to single-underscore attributes in visit_Attribute, remove modules that re-export os or sys from ALLOWED_MODULES, or wrap allowed modules in read-only proxies that expose only safe functions.

3. HighUnauthenticated TCP socket server auto-starts in Blender

   addon.py:1345

   When the addon is enabled, it automatically binds a TCP server on localhost:9876 whenever Blender starts, with no authentication or encryption. Any local process on the machine can connect to port 9876 and send an execute_code JSON message to run arbitrary Python in Blender, completely bypassing BLENDER_MCP_SAFE_MODE (which is only enforced in the MCP server process).

   Fix: Require a shared per-session secret token on the socket connection and enforce safe mode checks inside the Blender addon itself rather than only in the MCP server.

4. MediumArbitrary local file exfiltration via 3D generation image upload

   src/blender_mcp/generation.py:258

   The generate_3d tool accepts any local file path in its image argument and uploads the file contents to external 3D generation APIs. In the Hyper3D and Hunyuan3D code paths, the file is read and transmitted without checking its file extension, header bytes, or directory, allowing a prompt injection to upload arbitrary local files to a remote server.

   Fix: Validate that the path has an allowed image extension and valid image magic bytes, and restrict file reads to user-approved directories.

5. LowAddon self-updater fetches unpinned code from GitHub main branch

   addon.py:6651

   On startup, the Blender addon checks for updates by fetching addon.py from the mutable main branch on GitHub, and overwrites the installed addon if the user clicks Update Addon. Because the download is not pinned to an immutable release or verified with a cryptographic checksum, a compromised branch would deliver untrusted code directly into Blender.

   Fix: Fetch updates only from immutable release tags and verify a cryptographic checksum or signature before installing.