Loading…
Agent-first CAD runtime for creating and reviewing 3D parts via editable TypeScript source files and OpenCASCADE kernel.
Do not connect
A critical issue was found. Do not connect this server as-is.
Scanned 7 days ago Due for re-check
A server can change after it's graded. Re-run the automated scan to refresh this report.
This grade is deterministic and reproducible: the same server surface always yields the same grade under a given algorithm version. It is a real automated assessment computed by the MCPGrade engine from what the probe actually observed — not a fabricated or opinion score. It is not a manual human pentest, so it can miss context-specific risks.
Every signal below was measured directly by the automated probe. The grade is derived only from evidence like this — nothing is assumed.
The kernelcad MCP server exposes 45 tools, focused primarily on database, web, and AI capabilities. Its published description reads: "Agent-first CAD runtime for creating and reviewing 3D parts via editable TypeScript source files and OpenCASCADE kernel". It communicates over Streamable HTTP using the 2025-06-18 protocol revision, and does not require authorization to connect. MCPGrade currently rates kernelcad F — a critical issue was found and the server should not be connected as-is. Its most notable findings include "Cross-tool shadowing" and "Cross-tool shadowing". This report is a deterministic, reproducible automated assessment: the same observed surface always yields the same grade under a given algorithm version, and it is refreshed as new scans arrive and free to read — but it is not a substitute for a manual human security review. Always re-check kernelcad's advertised tools, transport security, and authorization posture before connecting an autonomous agent or sharing sensitive context with it.
Add kernelcad to an MCP client using the endpoint below. Review the grade and findings above before granting an autonomous agent access.
MCP endpoint
https://mcp.kernelcad.com/mcpStreamable HTTP transport. This is the MCP endpoint, not a website — paste it into your MCP client server list rather than a browser.
Captured passively during the read-only scan. Click any value to find servers that match it.
The tools this server advertises via tools/list — names, purposes, and the parameters each accepts, exactly as enumerated read-only.
Return the newest brush-painted review packet from a Studio session. After sharing a /p/<slug> link, the user can open it in the browser and paint marks over the 3D viewport to give visual feedback. C
Use this when the user wants to SEE or share the model — it persists the current kernelCAD model and returns a one-click link that opens it in the kernelCAD Studio web app, where the user can view and
Sorted worst-first. Each finding shows its severity, what it means, its OWASP MCP Top-10 mapping, and a recommended fix — the check id links to the exact methodology row that produced it.
tool: open_in_studio
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: get_project
A tool description tries to alter the model’s use of another tool.
— then edit and open_in_studio with the same slug so the user's open tab updatRecommendationDescriptions must describe only their own tool.
tool: get_project_revision
A tool description tries to alter the model’s use of another tool.
red at a prior `open_in_studio` version. Use this to read-after-write verify aRecommendationDescriptions must describe only their own tool.
tool: get_latest_render
A tool description tries to alter the model’s use of another tool.
Use this after open_in_studio (or any /p/<slug> link): call with that `slug`RecommendationDescriptions must describe only their own tool.
tool: mesh_summary
A tool description tries to alter the model’s use of another tool.
ered model, use open_in_studio + get_latest_render instead.RecommendationDescriptions must describe only their own tool.
tool: evaluate_script
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
evaluate_script Evaluate CAD Script Use this when you need to run a script and checRecommendationAnnotate destructive tools and require human approval.
tool: evaluate_script
A tool description tries to alter the model’s use of another tool.
100x+ on boolean/fillet-heavy scripts). A dry run catches script throws, cRecommendationDescriptions must describe only their own tool.
tool: evaluate_script
An exec/shell/run-code tool exposes a command/code/args parameter that is a free-form string with no enum/pattern guard — a direct command-injection / RCE surface. A tool constraining the command to an `enum` of allowed operations does not fire.
unconstrained command parameter "code"RecommendationReplace the free-form command with a fixed `enum` of allowed operations (or structured, escaped arguments) and require explicit human approval.
tool: diff_scripts
A tool description tries to alter the model’s use of another tool.
umbers matching inspect({ of: 'part-stats' })), total interference-voluRecommendationDescriptions must describe only their own tool.
tool: inspect
A tool description tries to alter the model’s use of another tool.
({ feature_id?, query? }); returns @kc[...] refs. - 'face-edges' — boRecommendationDescriptions must describe only their own tool.
tool: verify
A tool description tries to alter the model’s use of another tool.
ve session (run evaluate_script first). - 'urdf' — structural validity of a .urRecommendationDescriptions must describe only their own tool.
tool: why_did_this_fail
A tool description tries to alter the model’s use of another tool.
agnostic — call lookup_diagnostics for the full catalogue. Pass { file?, code?, feRecommendationDescriptions must describe only their own tool.
tool: add_feature
A tool description tries to alter the model’s use of another tool.
ted code — use `lookup_api` to see `featureKindFaceLabels` for the full vaRecommendationDescriptions must describe only their own tool.
tool: add_surface
A tool description tries to alter the model’s use of another tool.
() (do that via add_feature on the binding name). Returns the modified codeRecommendationDescriptions must describe only their own tool.
tool: add_curve
A tool description tries to alter the model’s use of another tool.
(spine input), `add_surface({ kind: 'boundary' })` (boundary curve), or dowRecommendationDescriptions must describe only their own tool.
tool: add_variable_sweep
A tool description tries to alter the model’s use of another tool.
..)`, etc. via `add_feature`. `spine_binding` references an existing variabRecommendationDescriptions must describe only their own tool.
tool: project_curve
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: query
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
'evaluate'): - 'evaluate' — inspect a Query (@kc[...] ref, @kcq[...] DSL, or { ast }); retuRecommendationAnnotate destructive tools and require human approval.
tool: query
A tool description tries to alter the model’s use of another tool.
d to resolve or inspect topology against a script's lowered geometry. SRecommendationDescriptions must describe only their own tool.
tool: export
A tool description tries to alter the model’s use of another tool.
un a watertight verify by default; failures return ok: false with expoRecommendationDescriptions must describe only their own tool.
tool: lookup_cookbook
A tool description tries to alter the model’s use of another tool.
atural-language query, ranked by BM25 over title/tags/keywords/triggeRecommendationDescriptions must describe only their own tool.
tool: find_part
A tool description tries to alter the model’s use of another tool.
ecords by fuzzy query and faceted filters. Tokens AND-combine; cross-RecommendationDescriptions must describe only their own tool.
tool: fetch_part
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
part record and write its STEP file to the local cache. Bundled ids resolve offlineRecommendationAnnotate destructive tools and require human approval.
tool: fetch_part
A tool description tries to alter the model’s use of another tool.
or single-match query) to a part record and write its STEP file to thRecommendationDescriptions must describe only their own tool.
tool: add_connector
A tool description tries to alter the model’s use of another tool.
ing returned by add_part. Returns modified source plus diagnostics fromRecommendationDescriptions must describe only their own tool.
tool: add_mate
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "notes"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: review_cad
Tools that execute commands / write files / make arbitrary requests are exposed without annotations or guards.
AD review loop: evaluate the script, validate the assembly/mate graph, check mate cRecommendationAnnotate destructive tools and require human approval.
tool: review_cad
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
tool: review_cad
An exec/shell/run-code tool exposes a command/code/args parameter that is a free-form string with no enum/pattern guard — a direct command-injection / RCE surface. A tool constraining the command to an `enum` of allowed operations does not fire.
unconstrained command parameter "code"RecommendationReplace the free-form command with a fixed `enum` of allowed operations (or structured, escaped arguments) and require explicit human approval.
tool: design_loop
A tool description tries to alter the model’s use of another tool.
ch attempt with review_cad, continue past functional attempts that still hRecommendationDescriptions must describe only their own tool.
tool: evaluate_sdf
A tool description tries to alter the model’s use of another tool.
de. Use this to verify SDF composition before calling sdf.materializeRecommendationDescriptions must describe only their own tool.
tool: capture_animation
A tool description tries to alter the model’s use of another tool.
no bundled-static serving mode yet, so the same dev-server preconditionRecommendationDescriptions must describe only their own tool.
tool: render_preview
A tool exposes a free-text/webhook/feedback parameter with no honest purpose — a classic exfil channel.
parameter "base_url"RecommendationRemove side-channel parameters; constrain tool inputs.
tool: render_preview
A tool description tries to alter the model’s use of another tool.
RecommendationDescriptions must describe only their own tool.
The server accepts tool enumeration (and likely invocation) with no authentication.
RecommendationRequire OAuth 2.1 authorization for any server exposing non-public tools.
tool: open_in_studio
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_project
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_project_revision
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: get_model_mesh
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: remove_feature
The server advertises open-world / broadly-scoped capabilities.
annotations.destructiveHint = trueRecommendationScope tools to the minimum needed.
tool: export
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: find_part
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: fetch_part
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: fetch_part
One tool both accesses the filesystem and reaches the network. Combining two capability classes in a single tool widens its blast radius and is the substrate for confused-deputy and exfiltration abuse.
part record and write its STEP file to the local cache. Bundled ids resolve offlineRecommendationSeparate filesystem and network capabilities into distinct, independently-scoped tools.
tool: capture_animation
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: render_preview
The server advertises open-world / broadly-scoped capabilities.
annotations.openWorldHint = trueRecommendationScope tools to the minimum needed.
tool: export
An unusually long description is a common injection-padding tactic.
description length 2106 charsRecommendationKeep descriptions concise.
Vantaj uptime monitoring via MCP — manage monitors, heartbeats, incidents, and status pages.
Unified gateway to Algeria's TKAWEN ecosystem: commerce, certification, and AI tools.
Provides access to the Cohereon Doctrine AI safety framework with governance components, tiered access, and agent onboarding.
Agentic rails for complex workflows with receipts, fees, and MCP tool access.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Structural TC39 spec lookup for ECMA-262 and ECMA-402 in AI agents, SHA-pinned and offline-first.
Use this when you need to reopen a saved project or browse what the user has saved — it fetches a kernelCAD Studio project, or lists the signed-in user's saved projects. Pass `slug` (from a /p/<slug>
Fetch the exact immutable .kcad source and parameters captured at a prior `open_in_studio` version. Use this to read-after-write verify a release: pass the returned `slug` and `version`, then hash or
Render a project's current model server-side and return it as an inline image so you can SEE what you built. Use this after open_in_studio (or any /p/<slug> link): call with that `slug` to inspect whe
Return the raw per-feature triangle mesh (positions/indices/normals) of a project's current model, by slug. For the in-chat 3D viewer widget to render geometry; delivered over the MCP Apps bridge. The
Return the kernelcad-authoring SKILL.md body — conventions for writing .kcad.ts scripts (imports, parameters, evaluation contract, common pitfalls). Use this tool BEFORE generating CAD code if your MC
Mesh a kernelCAD .kcad.ts source server-side and return a COMPACT geometry summary — overall bounds plus, per feature, its id, kind, triangle count, and bounding box. Use this to INSPECT a model's geo
Use this when you need to run a script and check it compiles. Run a kernelCAD .kcad.ts script and report pass/fail + feature count + diagnostics. When the scene is assembly-built (assembly().part(...)
Use this when you need to see exactly what changed between two script versions. Structured geometric delta between two versions of a kernelCAD script — a baseline ({ baseFile } or { baseCode }) and a
Use this when you need to read facts about a model. One reader, selected by `of`: - 'assembly' — physical assembly inventory (parts, bboxes, connectors, mates, disconnected solids). - 'robot' — URDF/S
Use this when you need to check a design against a rule set. One verifier, selected by `check`: - 'assembly' — mate-aware assembly validator on the active session (run evaluate_script first). - 'urdf'
Use this when you need to trace why a feature failed. Walk the upstream chain of a failing feature. Returns the diagnostics of the requested feature plus the diagnostics of every upstream feature in t
Use this when you need to edit a param() default value in a kernelCAD script. Returns the modified code as text plus diagnostics from re-evaluating the result. Caller persists the new code via standar
Use this when you need to insert a new feature line into a script. Insert a new feature line into a kernelCAD script before the last top-level return statement. Returns the modified code as text plus
Use this when you need to author a NURBS Surface into the user's .kcad.ts. One authoring path, selected by `kind`: - 'nurbs' — insert a nurbsSurface(...) / surfaceFromCurves(...) call. Pass either { c
Use this when you need to author a 3D Curve3D into the user's .kcad.ts immediately before the last top-level return. One authoring path, selected by `kind`: - 'nurbs' — insert a `nurbsCurve(controlPoi
Use this when you need to append a curved segment to an existing PathBuilder chain on the named `chain_anchor` variable. The call is injected at the END of the chain, immediately before any `.close()`
Use this when you need to trace features from a reference photo into waypoints. Trace pixel-space features from a reference photo into normalized [0..1] waypoints the agent can map to mm via a known s
Use this when you need to author a variable-section sweep along a spine. Insert a `variableSweep(spine, sections, opts?)` declaration into the user's .kcad.ts immediately before the last top-level ret
Use this when you need to author text into a kernelCAD script before the last top-level return. One authoring path, selected by `mode`: - 'sketch' — insert a sketch.text(...) call. The emitted sketch
Use this when you need to wrap a 2D curve onto a 3D face. Insert a `<shape>.projectCurve({ curve, face, scaleMode?, asEdge? })` chained call into a kernelCAD script. Wraps a 2D closed curve onto a 3D
Use this when you need to repeat a feature in a pattern. Insert a Shape.patternLinear / .patternCircular / .patternGrid call into a kernelCAD script before the last top-level return. Pass structured a
Use this when you need to remove a feature line from a script. Remove a single line from a kernelCAD script identified by a substring match. Returns the modified code plus diagnostics from re-evaluati
Use this when you need to resolve or inspect topology against a script's lowered geometry. Selected by `mode` (default 'evaluate'): - 'evaluate' — inspect a Query (@kc[...] ref, @kcq[...] DSL, or { as
Use this when you need to list the kernelCAD script-runtime surface: global functions (box, path, selectEdges, helix, etc), Shape methods (fillet, sweep, lower, etc), Sketch methods (extrude, revolve,
Use this when you need the kernelCAD 26-code diagnostic catalogue with hint templates. Tiny one-shot call; useful for an agent that wants to pre-populate retry strategies. Hints are also inline on eve
Use this when you need to export geometry to a file. One exporter, selected by `target`: - target:'model' — export the script geometry to one file. Pass { file | code }, a required { output_path }, an
Use this when you need a canonical pattern snippet for a CAD task. Search the kernelCAD cookbook for canonical pattern snippets. Returns top-k snippets matching the natural-language query, ranked by B
Use this when you need to find a part in the catalog. Discover bundled (and optionally remote) part-catalog records by fuzzy query and faceted filters. Tokens AND-combine; cross-facet filters AND-comb
Use this when you need to download a catalog part as a STEP file. Resolve an id (or single-match query) to a part record and write its STEP file to the local cache. Bundled ids resolve offline; non-bu
Use this when you need to solve a 2D sketch constraint set. Solve a 2D sketch constraint set. Side-effect-free: pass { entities, constraints } and receive solved entities plus the original constraints
Use this when you need to add a sketch constraint to a list. Append one validated sketch constraint to a constraint list. Side-effect-free: pass { constraints, constraint } and receive the updated lis
Use this when you need to add a part to an assembly. Durably insert `const <binding> = <assembly>.part(partName, shapeExpression, opts?)` before the final top-level return in a kernelCAD source string
Use this when you need to add a mate connector to a part. Durably insert `<partBinding>.connector(name, { type, origin, axis?, normal? })` before the final top-level return. Use the part binding retur
Use this when you need to author a mate-graph relationship into the source, selected by `relation` (default 'mate'): - 'mate' — a typed mate between two connectors ({ name, a, b, type, pose?, limitsDe
Use this when you need to declare a reachability target for a connector. Durably insert `<assembly>.workspace(connectorRef, { reachable, toleranceMm? })` before the final top-level return. Workspace t
Use this when you need to set how the script returns its assembly. Replace the final top-level return statement with `return <assembly>.model();` or `return <assembly>.solvedModel(poses, options?);`.
Use this when you need to solve the mate graph and get part poses. Run the v0.6 mate-graph solver on the active assembly. Returns { status, poses, iterations? } where each pose is a serialized Transfo
Use this when you need to review a mechanism for fitness and repair mode. Run the deterministic CAD review loop: evaluate the script, validate the assembly/mate graph, check mate connectors touch mode
Use this when you need to run a CAD design loop over multiple attempts. Run an agent CAD design loop over one or more attempt scripts: review each attempt with review_cad, continue past functional att
Use this when you need the unfolded flat pattern of a bent sheet-metal part. Return the unfolded 2D flat-pattern of a bent sheet-metal Shape as a Region (outer polyline + holes + bend lines + sketch p
Use this when you need to sample a signed-distance field at a point. Sample the signed distance from an in-script sdf.* field at a 3D point. Returns { distance, inside, aabb, kind }. Distance is in mm
Use this when you need to render a script's animation timeline to a video. Capture a kernelCAD script's animationView({...}) timeline to an MP4 (ffmpeg) or a PNG frame sequence, verifying the sampled
Use this when you need to LOOK at a kernelCAD model — render its script to deterministic PNG views for visual self-check (the visual half of the evaluate → render → inspect → fix loop), with NO studio