⚠️ This snapshot is over 30 days old — treat the grade as stale until the next refresh. Re-scan locally to verify.
Trust Card · Static snapshot
ahujasid__blender-mcp U
Ungraded — insufficient static coverage · 9 findings (3 critical) · scope excessive · Not ranked: insufficient static coverage.
Scanned 2026-10-19 · engine v0.1.3 (8 regex rules, OWASP-mapped) · upstream ahujasid/blender-mcp @ 25e1fe0 (2026-10-18)
Score breakdown
No numeric score or breakdown: insufficient static coverage. Findings remain actionable; absence of findings is not evidence of safety.
Insufficient static coverage: Unsupported source present. Findings remain actionable; absence of findings is not evidence of safety.
Coverage: limited
Static-heuristic scope: 50 analyzed / 74 discovered files; 4 unsupported source files; 25 excluded; 0 read errors; 0 truncations. This is not a semantic coverage percentage or proof of safety.
- Unsupported source present
- Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.
- Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.
- Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.
- Ignored directories, declarations, and non-implementation assets are outside rule scope.
File coverage, applied rules and scan limits
{
"mode": "static-heuristic",
"status": "limited",
"reasons": [
"Unsupported source present"
],
"limitations": [
"Coverage describes the files read and regex rules applied, not semantic, runtime, or dependency coverage.",
"Supported code is JavaScript, TypeScript, and Python; JSON/YAML receive only the credential rule.",
"Skill instructions and other prose are not code-analyzed; declared controls are not verified enforcement.",
"Ignored directories, declarations, and non-implementation assets are outside rule scope."
],
"discoveredFiles": 74,
"analyzedFiles": [
{
"path": "addon.py",
"scope": "code",
"bytes": 284811,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "integrations/codex/.agents/plugins/marketplace.json",
"scope": "data",
"bytes": 384,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "integrations/codex/plugins/mcp-for-blender/.codex-plugin/plugin.json",
"scope": "data",
"bytes": 1334,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "integrations/codex/plugins/mcp-for-blender/.mcp.json",
"scope": "data",
"bytes": 422,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-002"
]
},
{
"path": "main.py",
"scope": "code",
"bytes": 175,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/__init__.py",
"scope": "code",
"bytes": 632,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/addon_manager.py",
"scope": "code",
"bytes": 22113,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/blender_scripts.py",
"scope": "code",
"bytes": 21521,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/bundled/__init__.py",
"scope": "code",
"bytes": 0,
"nonEmpty": false,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/bundled/addon.py",
"scope": "code",
"bytes": 284811,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/consent_prompt.py",
"scope": "code",
"bytes": 8051,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/context_log.py",
"scope": "code",
"bytes": 5865,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/generation.py",
"scope": "code",
"bytes": 20732,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/guides.py",
"scope": "code",
"bytes": 1640,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/openai_apps.py",
"scope": "code",
"bytes": 12793,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/premium_hint.py",
"scope": "code",
"bytes": 2200,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/safe_mode.py",
"scope": "code",
"bytes": 45052,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/server.py",
"scope": "code",
"bytes": 98004,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/setup_cli.py",
"scope": "code",
"bytes": 31913,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/telemetry.py",
"scope": "code",
"bytes": 12992,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/telemetry_decorator.py",
"scope": "code",
"bytes": 17565,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/trajectory.py",
"scope": "code",
"bytes": 57877,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "src/blender_mcp/update_cli.py",
"scope": "code",
"bytes": 7449,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/conftest.py",
"scope": "code",
"bytes": 339,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_addon_autostart.py",
"scope": "code",
"bytes": 6813,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_addon_compat.py",
"scope": "code",
"bytes": 2655,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_addon_manager.py",
"scope": "code",
"bytes": 8336,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_addon_updater.py",
"scope": "code",
"bytes": 4922,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_compat_matrix.py",
"scope": "code",
"bytes": 12971,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_connection_args.py",
"scope": "code",
"bytes": 3604,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_consolidated_tools.py",
"scope": "code",
"bytes": 8410,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_context_log.py",
"scope": "code",
"bytes": 3396,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_export_scene.py",
"scope": "code",
"bytes": 6492,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_generation.py",
"scope": "code",
"bytes": 27286,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_hunyuan_api_profile.py",
"scope": "code",
"bytes": 6793,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_hunyuan_import_security.py",
"scope": "code",
"bytes": 4831,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_meshy.py",
"scope": "code",
"bytes": 15329,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_openai_apps.py",
"scope": "code",
"bytes": 25708,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_polyhaven.py",
"scope": "code",
"bytes": 92723,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_polypizza.py",
"scope": "code",
"bytes": 18184,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_premium_guidance.py",
"scope": "code",
"bytes": 2460,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_process_bbox_validation.py",
"scope": "code",
"bytes": 457,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_safe_mode.py",
"scope": "code",
"bytes": 12226,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_server_instructions.py",
"scope": "code",
"bytes": 1659,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_server_threading.py",
"scope": "code",
"bytes": 7791,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_setup_cli.py",
"scope": "code",
"bytes": 12738,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_sketchfab_status.py",
"scope": "code",
"bytes": 3717,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_socket_unicode.py",
"scope": "code",
"bytes": 4166,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_tool_schemas.py",
"scope": "code",
"bytes": 902,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
},
{
"path": "tests/test_update_cli.py",
"scope": "code",
"bytes": 6597,
"nonEmpty": true,
"ruleIds": [
"AT-SEC-001",
"AT-SEC-002",
"AT-SEC-003",
"AT-SEC-004",
"AT-SEC-005",
"AT-SEC-006",
"AT-SEC-007",
"AT-COMP-001"
]
}
],
"unsupportedSourceFiles": [
"Dockerfile",
"install.ps1",
"install.sh",
"src/blender_mcp/apps/viewport.html"
],
"excludedFiles": [
{
"path": ".git",
"reason": "ignored-directory"
},
{
"path": ".dockerignore",
"reason": "outside-rule-scope"
},
{
"path": ".gitignore",
"reason": "outside-rule-scope"
},
{
"path": ".python-version",
"reason": "outside-rule-scope"
},
{
"path": "Dockerfile",
"reason": "unsupported-implementation"
},
{
"path": "LICENSE",
"reason": "outside-rule-scope"
},
{
"path": "README.md",
"reason": "outside-rule-scope"
},
{
"path": "TERMS_AND_CONDITIONS.md",
"reason": "outside-rule-scope"
},
{
"path": "assets/addon-instructions.png",
"reason": "outside-rule-scope"
},
{
"path": "assets/codex-screenshot.png",
"reason": "outside-rule-scope"
},
{
"path": "assets/hammer-icon.png",
"reason": "outside-rule-scope"
},
{
"path": "install.ps1",
"reason": "unsupported-implementation"
},
{
"path": "install.sh",
"reason": "unsupported-implementation"
},
{
"path": "integrations/codex/plugins/mcp-for-blender/assets/icon.svg",
"reason": "outside-rule-scope"
},
{
"path": "integrations/codex/plugins/mcp-for-blender/assets/logo.png",
"reason": "outside-rule-scope"
},
{
"path": "pyproject.toml",
"reason": "outside-rule-scope"
},
{
"path": "src/blender_mcp/apps/viewport.html",
"reason": "unsupported-implementation"
},
{
"path": "src/blender_mcp/guides/animation.md",
"reason": "outside-rule-scope"
},
{
"path": "src/blender_mcp/guides/bpy.md",
"reason": "outside-rule-scope"
},
{
"path": "src/blender_mcp/guides/level-design.md",
"reason": "outside-rule-scope"
},
{
"path": "src/blender_mcp/guides/materials.md",
"reason": "outside-rule-scope"
},
{
"path": "src/blender_mcp/guides/retopology.md",
"reason": "outside-rule-scope"
},
{
"path": "src/blender_mcp/guides/rigging.md",
"reason": "outside-rule-scope"
},
{
"path": "src/blender_mcp/guides/scene.md",
"reason": "outside-rule-scope"
},
{
"path": "uv.lock",
"reason": "outside-rule-scope"
}
],
"readErrors": [],
"truncation": [],
"limits": {
"maxFiles": 4000,
"maxDepth": 12,
"maxFileBytes": 1048576
}
}Fix first (9 critical/high)
| Severity | Rule | Finding | Remediation |
|---|---|---|---|
| CRITICAL | AT-SEC-004 (ASI05) | eval() / Function Constructor Invocationsrc/blender_mcp/safe_mode.py:199Evidence: "eval": "eval() executes arbitrary expressions", | Eliminate eval(). Use safe AST parsers or isolated sandboxes (e.g. E2B Firecracker microVMs). |
| CRITICAL | AT-SEC-002 (LLM02) | Hardcoded Credential or API Secrettests/test_polypizza.py:17Evidence: API_KEY = "test-key-not-a-real-one" | Move credentials to secure environment variables or a key vault. Never commit API keys. |
| CRITICAL | AT-SEC-004 (ASI05) | eval() / Function Constructor Invocationtests/test_safe_mode.py:155Evidence: "eval": "eval('1+1')", | Eliminate eval(). Use safe AST parsers or isolated sandboxes (e.g. E2B Firecracker microVMs). |
| HIGH | AT-SEC-005 (ASI02) | Unrestricted Recursive File Deletion / Modificationaddon.py:515Evidence: os.unlink(dest_path) | Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions. |
| HIGH | AT-SEC-006 (LLM06) | Unfiltered SSRF / Arbitrary Network Egressaddon.py:4378Evidence: response = requests.get(url, headers=headers, params=params, timeout=30) | Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254). |
| HIGH | AT-SEC-006 (LLM06) | Unfiltered SSRF / Arbitrary Network Egressaddon.py:5335Evidence: response = requests.get(url, stream=True, timeout=MODEL_DOWNLOAD_TIMEOUT) | Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254). |
| HIGH | AT-SEC-005 (ASI02) | Unrestricted Recursive File Deletion / Modificationsrc/blender_mcp/bundled/addon.py:515Evidence: os.unlink(dest_path) | Enforce strict jail/root directories and require explicit human-in-the-loop confirmation before file deletions. |
| HIGH | AT-SEC-006 (LLM06) | Unfiltered SSRF / Arbitrary Network Egresssrc/blender_mcp/bundled/addon.py:4378Evidence: response = requests.get(url, headers=headers, params=params, timeout=30) | Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254). |
| HIGH | AT-SEC-006 (LLM06) | Unfiltered SSRF / Arbitrary Network Egresssrc/blender_mcp/bundled/addon.py:5335Evidence: response = requests.get(url, stream=True, timeout=MODEL_DOWNLOAD_TIMEOUT) | Define an explicit egress domain allowlist and block private IP ranges (127.0.0.1, 10.0.0.0/8, 169.254.169.254). |
Permissions
Scope: excessive · Shell: enabled · Network egress: yes · File deletion: enabled · Human approval: none
Provenance
License: none detected · Lockfile: no · Security policy: no · Signals: unverified origin
Independently scanned by the OpenTrustBench registry (not self-reported by the project). Static analysis only — no code executed, findings need human triage, counts may include test/example code. Static snapshot; re-scan before relying on it: npx @opentrustbench/cli scan https://github.com/ahujasid/blender-mcp. Scores move with every upstream commit; pages refresh weekly. How scoring works.