A local socket gives the model control of the open Blender file
At commit c69b901, the measured 25-file checkout split the job between 2 processes. A Python MCP server talks to the chosen client over standard input and output. Inside Blender, an add-on listens on localhost:9876, receives JSON commands, and changes the active scene. The arrangement lets Claude, Codex, Cursor, or another MCP client inspect objects, alter materials, move cameras, export GLB or FBX files, and ask Blender to run Python.
That last capability defines the product more than its 11,975 measured source lines suggest. An agent can use Blender's own API instead of waiting for the project to expose a special tool for every operation. The same connection can search asset libraries, capture the viewport, or look up node details. This range is useful for exploratory work, but a polished result still depends on the model's code and the artist checking what changed.
The 15-second install hides a four-part desktop setup
Our sandbox installed the Python side in 15 seconds; a working desktop setup still requires uv, an MCP client entry, the Blender add-on, and a running socket inside Blender. New installations use uvx mcp-for-blender; the old uvx blender-mcp command remains a compatibility wrapper after the September 2026 rename. GUI clients may fail with spawn uvx ENOENT because they do not inherit the terminal path, so the README explains how to use the executable's full path.
Our measured Python environment occupied 67 MB, which is modest beside Blender itself. The core connection needs no project API key, although the AI client may have its own account requirements. Poly Haven works without a key. Poly Pizza, Sketchfab, Hyper3D Rodin, and Hunyuan3D add credentials or endpoint settings. Each optional provider gives the agent another external system to call and another failure path to diagnose.
What happened when we ran it
Our sandbox installed 60 packages in 15 seconds, built the project in 5 seconds, and completed pytest in 15 seconds with 20 passed and 0 failed. Pip-audit found 0 known vulnerabilities. Our measurement setup was an unprivileged Debian container with 3 CPUs and 8 GB of RAM, and we ran commit c69b901, so these results describe the Python package rather than a full Blender session.
We measured a 1.1 MB checkout with 25 files, about 11,975 source lines, and a tests directory. It had 0 CI workflow files and no Dockerfile. Current main has since added a Dockerfile, but it runs the MCP server only; Blender remains on the host. The 20 tests support a clean trial of the server code. They do not show whether a chosen model can build a correct scene or reconnect after a desktop client stalls.
Safe mode is optional, and the socket has no login
In package version 2.0.3, execute_blender_code can run arbitrary Python in Blender by default. The README tells users to save their work, and the server offers BLENDER_MCP_SAFE_MODE=1 to reject code that reads or writes files directly, launches programs, accesses the network, or installs persistent code. That filter narrows obvious hazards. It does not turn model-generated changes into reviewed, deterministic Blender operations.
The 0 known vulnerabilities from our audit cover installed Python dependencies at commit c69b901; they say nothing about commands an agent later chooses to execute. The socket itself has no authentication or encryption and defaults to localhost:9876. Open issue 369 asks for a configurable bind address for two-computer setups, while warning that a wider listener could expose Python execution. An SSH tunnel is safer than opening that port across a LAN.
Asset providers and telemetry widen the data path
The 60-package environment we measured did not include optional asset services. Poly Haven can supply CC0 models, textures, and HDRIs without an account. Poly Pizza exposes low-poly models with licence metadata, including assets that require attribution. Other toggles connect to Sketchfab, Hyper3D, or Tencent's Hunyuan3D service. Blender can store those credentials in add-on preferences, so a studio should enable only the providers it needs and use keys limited to that job.
Asset downloads can be much larger than the 67 MB environment we measured, and the README says Blender may freeze while a Poly Haven download runs on its main thread. Basic telemetry also sends a random install ID, tool name, success state, duration, versions, operating system, and timestamp by default. Prompts, code, screenshots, scene data, and trajectory steps require opt-in. DISABLE_TELEMETRY=true turns off the basic record too.
September commits show activity, while GitHub releases remain absent
GitHub recorded the last push on September 21, 2026. The repository had 29,208 stars, 20 open issues, and 12 open pull requests when fetched; those counts were separated so pull requests are not presented as bugs. No latest GitHub release was available. Main declared package version 2.0.3 after the repository and PyPI package moved to ahujasid/mcp-for-blender, and old links still redirect.
All 20 tests passed in our sandbox, which makes a supervised experiment easy to justify. Keep the agent on a copy of the file, leave the socket on localhost, switch on safe mode when its restrictions fit the work, and disable unused providers. If nobody can watch the scene and undo a bad operation, use reviewed Blender Python instead of giving a language model the live file.