Skip to content

feat(mcp): add Blender to the MCP catalog with a curated 4-tool default - #64463

Merged
teknium1 merged 3 commits into
mainfrom
hermes/hermes-a4592603
Jul 15, 2026
Merged

feat(mcp): add Blender to the MCP catalog with a curated 4-tool default#64463
teknium1 merged 3 commits into
mainfrom
hermes/hermes-a4592603

Conversation

@teknium1

Copy link
Copy Markdown
Contributor

Summary

Adds Blender to the MCP catalog (hermes mcp install blender) with a 4-tool default surface, and teaches catalog manifests to declare static subprocess env vars (transport.env) — needed here to ship upstream telemetry disabled by default.

Changes

  • optional-mcps/blender/manifest.yaml: new catalog entry for ahujasid/blender-mcp (stdio, uvx blender-mcp, auth: none). tools.default_enabled restricts the default install to the core surface — get_scene_info, get_object_info, get_viewport_screenshot, execute_blender_code. The other 18 tools front optional third-party asset services (PolyHaven/Sketchfab/Hyper3D/Hunyuan3D) with no upstream trim mechanism; they stay unregistered unless opted into via hermes mcp configure blender. post_install covers the in-Blender addon setup, the no-blender -b limitation (Xvfb recipe included), and the code-execution security posture.
  • hermes_cli/mcp_catalog.py: manifest transport.env (string→string map) is now parsed, validated, and written into the mcp_servers.<name> block by _build_server_config(). The runtime already honors per-server env (tools/mcp_tool.py); manifests just had no way to declare it. Used to set DISABLE_TELEMETRY=true per the no-telemetry-without-opt-in policy.
  • tests/hermes_cli/test_mcp_catalog.py: 3 new tests — env parsed + written, absent env leaves no env key (existing entries unaffected), malformed env rejected.

Validation

Check Result
tests/hermes_cli/test_mcp_catalog.py (incl. shipped-catalog parse of new entry) pass
tests/tools/test_mcp_tool.py pass
E2E: parse → catalog list → official/ prefix → _build_server_config pass (env block present; n8n/linear/unreal-engine configs byte-identical)
Dogfood vs live server: config written → discover_mcp_tools() → registered = exactly core 4 + 4 MCP protocol tools, none of the 18 service tools leaked → get_scene_info + execute_blender_code executed against a live Blender 4.5.3 through Hermes dispatch pass
ruff + windows-footguns on touched files clean

Validated against a live Blender 4.5.3 + blender-mcp session end-to-end (modeled, rendered, and exported a full asset through the server before writing the manifest).

Infographic

blender-mcp-catalog

@github-actions

Copy link
Copy Markdown
Contributor

⚠️ MCP catalog security review required

This PR changes the bundled MCP catalog or MCP catalog installer code. MCP entries can define local commands that users later install into mcp_servers, so this needs explicit maintainer review before merge.

A maintainer should verify:

  • any new/changed optional-mcps/**/manifest.yaml command and args are expected,
  • stdio transports do not use shell+egress/exfiltration payloads,
  • git install refs are pinned and bootstrap commands are minimal,
  • requested env vars/secrets match the upstream MCP's documented needs.

After review, add the mcp-catalog-reviewed label and re-run this check.

@alt-glitch alt-glitch added type/feature New feature or request comp/cli CLI entry point, hermes_cli/, setup wizard tool/mcp MCP client and OAuth P3 Low — cosmetic, nice to have labels Jul 14, 2026

@tonydwb tonydwb left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review Summary

Verdict: Approved

Feature adding Blender to the MCP catalog with curated 4-tool configuration. 123 additions, 0 deletions. Clean feature addition.


Reviewed by Hermes Agent

austinpickett
austinpickett previously approved these changes Jul 15, 2026
@jquesnelle
jquesnelle enabled auto-merge July 15, 2026 04:50
@jquesnelle
jquesnelle disabled auto-merge July 15, 2026 04:50
@teknium1
teknium1 enabled auto-merge (rebase) July 15, 2026 04:52
@teknium1
teknium1 disabled auto-merge July 15, 2026 04:52
Comment thread optional-mcps/blender/manifest.yaml Outdated
type: stdio
command: "uvx"
args:
- "blender-mcp"

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

should pin a specific version to avoid compromise

teknium1 added 2 commits July 14, 2026 21:56
Adds optional-mcps/blender (ahujasid/blender-mcp, stdio via uvx). The
server advertises 22 tools; 18 front optional asset services with no
upstream trim mechanism, so tools.default_enabled pins the install to
the core surface (scene/object info, viewport screenshot, code exec)
and the rest stay opt-in through 'hermes mcp configure blender'.

Manifests can now declare transport.env (static, non-secret subprocess
env vars), parsed/validated in _parse_manifest and written by
_build_server_config — used here to ship DISABLE_TELEMETRY=true per
the no-telemetry-without-opt-in policy. Runtime already honored
per-server env; manifests just couldn't declare it.
MCP catalog entries follow the same supply-chain rules as pyproject
dependencies: exact version pin, and the pinned release must be at
least 2 weeks old. blender-mcp 1.6.4 released 2026-06-11 (~5 weeks
old, also the latest release). uvx now resolves the exact version
instead of latest-at-launch.
@github-actions

Copy link
Copy Markdown
Contributor

⚠️ MCP catalog security review required

This PR changes the bundled MCP catalog or MCP catalog installer code. MCP entries can define local commands that users later install into mcp_servers, so this needs explicit maintainer review before merge.

A maintainer should verify:

  • any new/changed optional-mcps/**/manifest.yaml command and args are expected,
  • stdio transports do not use shell+egress/exfiltration payloads,
  • git install refs are pinned and bootstrap commands are minimal,
  • requested env vars/secrets match the upstream MCP's documented needs.

After review, add the mcp-catalog-reviewed label and re-run this check.

Catalog entries now follow the same supply-chain rules as pyproject
dependencies:

- n8n: install.ref main -> full commit SHA 7a9ae007 (2026-05-23,
  branches/tags can be moved by the upstream owner; SHAs cannot)
- new contract test: every shipped manifest must pin exactly —
  git installs need a 40-char SHA, uvx/npx-style launchers need
  pkg==X / pkg@X with a digit-leading version (rejects bare names,
  ranges, and npm dist-tags like @latest)
- module docstring documents the pin policy (exact version, 2-week
  cooldown)

unreal-engine and linear are http transports (server runs elsewhere)
so there is nothing to pin at the transport layer.

Verified: unpinning blender-mcp in the manifest makes the contract
test fail with a named diagnostic; restoring the pin passes.
@github-actions

Copy link
Copy Markdown
Contributor

⚠️ MCP catalog security review required

This PR changes the bundled MCP catalog or MCP catalog installer code. MCP entries can define local commands that users later install into mcp_servers, so this needs explicit maintainer review before merge.

A maintainer should verify:

  • any new/changed optional-mcps/**/manifest.yaml command and args are expected,
  • stdio transports do not use shell+egress/exfiltration payloads,
  • git install refs are pinned and bootstrap commands are minimal,
  • requested env vars/secrets match the upstream MCP's documented needs.

After review, add the mcp-catalog-reviewed label and re-run this check.

@teknium1
teknium1 merged commit 9df5f87 into main Jul 15, 2026
29 of 31 checks passed
@teknium1
teknium1 deleted the hermes/hermes-a4592603 branch July 15, 2026 11:56
teknium1 added a commit that referenced this pull request Jul 15, 2026
The optional blender-mcp skill predates the blender MCP catalog entry
(#64463) and taught the agent to hand-roll raw TCP JSON to the addon's
socket on port 9876 from execute_code — bypassing the catalog's version
pinning and install-time tool curation.

Reworked to v2.0.0 as the companion skill for the catalog entry:
- prerequisites now go through 'hermes mcp install blender'
- interaction surface is the four curated MCP tools, not a raw socket
- keeps the valuable content: addon setup, bpy recipes (materials,
  keyframes, render-to-file), pitfalls (timeouts, absolute paths,
  object mode), plus new pitfalls (xvfb headless, no-sandbox warning,
  remote-host path resolution)
- explicit anti-pattern note: do not hand-roll TCP to 9876
- description shortened to <=60 chars per skill authoring standards

alireza78a's original bpy patterns and pitfalls are preserved and
credited. Docs page regenerated via generate-skill-docs.py (scoped to
this skill only; unrelated generator drift left untouched).
teknium1 added a commit that referenced this pull request Jul 15, 2026
…ry (#65066)

The optional blender-mcp skill predates the blender MCP catalog entry
(#64463) and taught the agent to hand-roll raw TCP JSON to the addon's
socket on port 9876 from execute_code — bypassing the catalog's version
pinning and install-time tool curation.

Reworked to v2.0.0 as the companion skill for the catalog entry:
- prerequisites now go through 'hermes mcp install blender'
- interaction surface is the four curated MCP tools, not a raw socket
- keeps the valuable content: addon setup, bpy recipes (materials,
  keyframes, render-to-file), pitfalls (timeouts, absolute paths,
  object mode), plus new pitfalls (xvfb headless, no-sandbox warning,
  remote-host path resolution)
- explicit anti-pattern note: do not hand-roll TCP to 9876
- description shortened to <=60 chars per skill authoring standards

alireza78a's original bpy patterns and pitfalls are preserved and
credited. Docs page regenerated via generate-skill-docs.py (scoped to
this skill only; unrelated generator drift left untouched).
Gravezzz pushed a commit to Gravezzz/hermes-agent that referenced this pull request Jul 21, 2026
…ry (NousResearch#65066)

The optional blender-mcp skill predates the blender MCP catalog entry
(NousResearch#64463) and taught the agent to hand-roll raw TCP JSON to the addon's
socket on port 9876 from execute_code — bypassing the catalog's version
pinning and install-time tool curation.

Reworked to v2.0.0 as the companion skill for the catalog entry:
- prerequisites now go through 'hermes mcp install blender'
- interaction surface is the four curated MCP tools, not a raw socket
- keeps the valuable content: addon setup, bpy recipes (materials,
  keyframes, render-to-file), pitfalls (timeouts, absolute paths,
  object mode), plus new pitfalls (xvfb headless, no-sandbox warning,
  remote-host path resolution)
- explicit anti-pattern note: do not hand-roll TCP to 9876
- description shortened to <=60 chars per skill authoring standards

alireza78a's original bpy patterns and pitfalls are preserved and
credited. Docs page regenerated via generate-skill-docs.py (scoped to
this skill only; unrelated generator drift left untouched).
randlee pushed a commit to randlee/hermes-agent that referenced this pull request Aug 11, 2026
…ry (NousResearch#65066)

The optional blender-mcp skill predates the blender MCP catalog entry
(NousResearch#64463) and taught the agent to hand-roll raw TCP JSON to the addon's
socket on port 9876 from execute_code — bypassing the catalog's version
pinning and install-time tool curation.

Reworked to v2.0.0 as the companion skill for the catalog entry:
- prerequisites now go through 'hermes mcp install blender'
- interaction surface is the four curated MCP tools, not a raw socket
- keeps the valuable content: addon setup, bpy recipes (materials,
  keyframes, render-to-file), pitfalls (timeouts, absolute paths,
  object mode), plus new pitfalls (xvfb headless, no-sandbox warning,
  remote-host path resolution)
- explicit anti-pattern note: do not hand-roll TCP to 9876
- description shortened to <=60 chars per skill authoring standards

alireza78a's original bpy patterns and pitfalls are preserved and
credited. Docs page regenerated via generate-skill-docs.py (scoped to
this skill only; unrelated generator drift left untouched).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

comp/cli CLI entry point, hermes_cli/, setup wizard mcp-catalog-reviewed P3 Low — cosmetic, nice to have tool/mcp MCP client and OAuth type/feature New feature or request

Projects

None yet

Development

Successfully merging this pull request may close these issues.

5 participants