feat(mcp): add Blender to the MCP catalog with a curated 4-tool default - #64463
Conversation
|
tonydwb
left a comment
There was a problem hiding this comment.
Code Review Summary
Verdict: Approved
Feature adding Blender to the MCP catalog with curated 4-tool configuration. 123 additions, 0 deletions. Clean feature addition.
Reviewed by Hermes Agent
| type: stdio | ||
| command: "uvx" | ||
| args: | ||
| - "blender-mcp" |
There was a problem hiding this comment.
should pin a specific version to avoid compromise
Adds optional-mcps/blender (ahujasid/blender-mcp, stdio via uvx). The server advertises 22 tools; 18 front optional asset services with no upstream trim mechanism, so tools.default_enabled pins the install to the core surface (scene/object info, viewport screenshot, code exec) and the rest stay opt-in through 'hermes mcp configure blender'. Manifests can now declare transport.env (static, non-secret subprocess env vars), parsed/validated in _parse_manifest and written by _build_server_config — used here to ship DISABLE_TELEMETRY=true per the no-telemetry-without-opt-in policy. Runtime already honored per-server env; manifests just couldn't declare it.
MCP catalog entries follow the same supply-chain rules as pyproject dependencies: exact version pin, and the pinned release must be at least 2 weeks old. blender-mcp 1.6.4 released 2026-06-11 (~5 weeks old, also the latest release). uvx now resolves the exact version instead of latest-at-launch.
65b1f66 to
e63cce6
Compare
|
Catalog entries now follow the same supply-chain rules as pyproject dependencies: - n8n: install.ref main -> full commit SHA 7a9ae007 (2026-05-23, branches/tags can be moved by the upstream owner; SHAs cannot) - new contract test: every shipped manifest must pin exactly — git installs need a 40-char SHA, uvx/npx-style launchers need pkg==X / pkg@X with a digit-leading version (rejects bare names, ranges, and npm dist-tags like @latest) - module docstring documents the pin policy (exact version, 2-week cooldown) unreal-engine and linear are http transports (server runs elsewhere) so there is nothing to pin at the transport layer. Verified: unpinning blender-mcp in the manifest makes the contract test fail with a named diagnostic; restoring the pin passes.
|
The optional blender-mcp skill predates the blender MCP catalog entry (#64463) and taught the agent to hand-roll raw TCP JSON to the addon's socket on port 9876 from execute_code — bypassing the catalog's version pinning and install-time tool curation. Reworked to v2.0.0 as the companion skill for the catalog entry: - prerequisites now go through 'hermes mcp install blender' - interaction surface is the four curated MCP tools, not a raw socket - keeps the valuable content: addon setup, bpy recipes (materials, keyframes, render-to-file), pitfalls (timeouts, absolute paths, object mode), plus new pitfalls (xvfb headless, no-sandbox warning, remote-host path resolution) - explicit anti-pattern note: do not hand-roll TCP to 9876 - description shortened to <=60 chars per skill authoring standards alireza78a's original bpy patterns and pitfalls are preserved and credited. Docs page regenerated via generate-skill-docs.py (scoped to this skill only; unrelated generator drift left untouched).
…ry (#65066) The optional blender-mcp skill predates the blender MCP catalog entry (#64463) and taught the agent to hand-roll raw TCP JSON to the addon's socket on port 9876 from execute_code — bypassing the catalog's version pinning and install-time tool curation. Reworked to v2.0.0 as the companion skill for the catalog entry: - prerequisites now go through 'hermes mcp install blender' - interaction surface is the four curated MCP tools, not a raw socket - keeps the valuable content: addon setup, bpy recipes (materials, keyframes, render-to-file), pitfalls (timeouts, absolute paths, object mode), plus new pitfalls (xvfb headless, no-sandbox warning, remote-host path resolution) - explicit anti-pattern note: do not hand-roll TCP to 9876 - description shortened to <=60 chars per skill authoring standards alireza78a's original bpy patterns and pitfalls are preserved and credited. Docs page regenerated via generate-skill-docs.py (scoped to this skill only; unrelated generator drift left untouched).
…ry (NousResearch#65066) The optional blender-mcp skill predates the blender MCP catalog entry (NousResearch#64463) and taught the agent to hand-roll raw TCP JSON to the addon's socket on port 9876 from execute_code — bypassing the catalog's version pinning and install-time tool curation. Reworked to v2.0.0 as the companion skill for the catalog entry: - prerequisites now go through 'hermes mcp install blender' - interaction surface is the four curated MCP tools, not a raw socket - keeps the valuable content: addon setup, bpy recipes (materials, keyframes, render-to-file), pitfalls (timeouts, absolute paths, object mode), plus new pitfalls (xvfb headless, no-sandbox warning, remote-host path resolution) - explicit anti-pattern note: do not hand-roll TCP to 9876 - description shortened to <=60 chars per skill authoring standards alireza78a's original bpy patterns and pitfalls are preserved and credited. Docs page regenerated via generate-skill-docs.py (scoped to this skill only; unrelated generator drift left untouched).
…ry (NousResearch#65066) The optional blender-mcp skill predates the blender MCP catalog entry (NousResearch#64463) and taught the agent to hand-roll raw TCP JSON to the addon's socket on port 9876 from execute_code — bypassing the catalog's version pinning and install-time tool curation. Reworked to v2.0.0 as the companion skill for the catalog entry: - prerequisites now go through 'hermes mcp install blender' - interaction surface is the four curated MCP tools, not a raw socket - keeps the valuable content: addon setup, bpy recipes (materials, keyframes, render-to-file), pitfalls (timeouts, absolute paths, object mode), plus new pitfalls (xvfb headless, no-sandbox warning, remote-host path resolution) - explicit anti-pattern note: do not hand-roll TCP to 9876 - description shortened to <=60 chars per skill authoring standards alireza78a's original bpy patterns and pitfalls are preserved and credited. Docs page regenerated via generate-skill-docs.py (scoped to this skill only; unrelated generator drift left untouched).
Summary
Adds Blender to the MCP catalog (
hermes mcp install blender) with a 4-tool default surface, and teaches catalog manifests to declare static subprocess env vars (transport.env) — needed here to ship upstream telemetry disabled by default.Changes
optional-mcps/blender/manifest.yaml: new catalog entry for ahujasid/blender-mcp (stdio,uvx blender-mcp,auth: none).tools.default_enabledrestricts the default install to the core surface —get_scene_info,get_object_info,get_viewport_screenshot,execute_blender_code. The other 18 tools front optional third-party asset services (PolyHaven/Sketchfab/Hyper3D/Hunyuan3D) with no upstream trim mechanism; they stay unregistered unless opted into viahermes mcp configure blender. post_install covers the in-Blender addon setup, the no-blender -blimitation (Xvfb recipe included), and the code-execution security posture.hermes_cli/mcp_catalog.py: manifesttransport.env(string→string map) is now parsed, validated, and written into themcp_servers.<name>block by_build_server_config(). The runtime already honors per-serverenv(tools/mcp_tool.py); manifests just had no way to declare it. Used to setDISABLE_TELEMETRY=trueper the no-telemetry-without-opt-in policy.tests/hermes_cli/test_mcp_catalog.py: 3 new tests — env parsed + written, absent env leaves noenvkey (existing entries unaffected), malformed env rejected.Validation
tests/hermes_cli/test_mcp_catalog.py(incl. shipped-catalog parse of new entry)tests/tools/test_mcp_tool.pyofficial/prefix →_build_server_configdiscover_mcp_tools()→ registered = exactly core 4 + 4 MCP protocol tools, none of the 18 service tools leaked →get_scene_info+execute_blender_codeexecuted against a live Blender 4.5.3 through Hermes dispatchValidated against a live Blender 4.5.3 + blender-mcp session end-to-end (modeled, rendered, and exported a full asset through the server before writing the manifest).
Infographic