← Back to search

@shapeitup/mcp-server

GitHub Actions Scanned 13d ago

ShapeItUp MCP server — scripted CAD tools (Replicad/OpenCascade) for Claude Code, Cursor, Claude Desktop, and other MCP clients.

C
64.2 / 100

Versions

1.23.0latest
Jul 8, 2026
1.22.0
Jul 8, 2026
1.21.0
Jul 7, 2026
1.20.0
Jul 7, 2026
1.19.0
Jul 4, 2026
+ show 9 moreshow less
1.17.0
Jun 30, 2026
1.6.3
Apr 21, 2026
1.6.2
Apr 21, 2026
1.6.1
Apr 21, 2026
1.6.0
Apr 21, 2026
1.3.0
Apr 20, 2026
1.2.0
Apr 20, 2026
1.1.0
Apr 20, 2026
1.0.0
Apr 20, 2026
PermissionsTool SafetyAuthAnnotationsCode QualityStabilitySpecVuln HistoryAuthorTransparencyCommunity

Tools 27

setup_shape_project
annotations: none low

Bootstrap a folder so `.shape.ts` files get correct types in editors. Writes node_modules/shapeitup and node_modules/replicad type stubs + a minimal tsconfig.json if missing. Idempotent — safe to call repeatedly. Does NOT run npm install; replicad and OCCT are bundled inside this MCP server at runtime. Typically you don

directory string
create_shape
annotations: none low

Create a new .shape.ts CAD script file and execute it. Fails if file already exists — use modify_shape to update existing files. Path resolution precedence: absolute `directory` used as-is; relative `directory` probed against each heartbeat-reported VSCode workspace root (first match wins), else `process.cwd()`; omitted `directory` defaults to the first active VSCode workspace root (or cwd if no extension is running). Refuses to create a file when the resolved path contains a duplicated segment (e.g. `examples/examples/...`) unless `allowPathDuplication: true` is passed.

code string directory string overwrite boolean allowPathDuplication boolean
open_shape
annotations: none low

Execute an existing .shape.ts file; when the ShapeItUp VSCode extension is open it will also reflect the file in its interactive viewer. Relative paths probe each open VSCode workspace (first match wins), else fall back to process.cwd(). Pass `capture: true` to also render a screenshot through the bundled SVG pipeline (runs standalone — no extension needed). A capture failure does not fail the whole call — it

capture boolean filePath string forceBundleRebuild boolean
modify_shape
annotations: none low

Change an existing .shape.ts file and execute it. Three write modes plus a re-run mode: (1) `code` — full overwrite; (2) `edits` — apply one or more exact-string patches in place (token-cheap for a few-line change — no need to resend the whole file); (3) `params` only (no `code`/`edits`) — re-execute with ephemeral param overrides, no disk write; (4) all omitted — behaves like `open_shape` (re-executes from disk), useful after editing an imported dependency like `constants.ts`. Relative paths probe each open VSCode workspace (first match wins), else fall back to process.cwd(). Precedence when several are supplied: `code` > `edits` > `params`; the losers are reported as ignored.

code string filePath string newString string oldString string replaceAll boolean
read_shape
annotations: none low

Read the contents of a .shape.ts file. Relative paths probe each open VSCode workspace (first match wins), else fall back to process.cwd().

filePath string
delete_shape
annotations: none low

Delete a .shape.ts file. Relative paths probe each open VSCode workspace (first match wins), else fall back to process.cwd().

filePath string
export_shape
annotations: none low

Export the last executed shape to STEP, STL, or 3MF. Optionally pass `filePath` to execute and export a specific file in one call. For multi-part assemblies, pass `partName` to export a single named part instead of the whole assembly, or `splitParts: true` to write EACH part to its own file in a folder (best for 3D printing — every part becomes an independent file the slicer can arrange). Pass `bom: true` to write a `*.bom.json` sidecar next to the exported file with per-part volume, mass, qty, material, and bounding box.

bom boolean filePath string partName string outputPath string splitParts boolean
list_installed_apps
annotations: none low

List 3D apps detected on the user

list_shapes
annotations: none low

Find all .shape.ts files in a directory. Relative `directory` probes each open VSCode workspace (first existing match wins), else falls back to process.cwd(). Omitted `directory` defaults to the first active VSCode workspace root.

directory string recursive boolean
validate_syntax
annotations: none low

Validate TypeScript syntax and detect common CAD pitfalls (sketch mischain, missing sketchOnPlane, unclosed pen, non-uniform scale, oversized fillet, hand-rolled boolean loops including for/while/forEach/reduce with .cut/.fuse/.intersect, fillet-after-boolean). Does NOT verify imports, types, or runtime behavior — for that, call create_shape or modify_shape.

code string inline boolean focusPart string workingDir string captureScreenshot boolean
preview_shape
annotations: none low

Execute a .shape.ts snippet WITHOUT writing it to the user

code string inline boolean focusPart string workingDir string captureScreenshot boolean
tune_params
annotations: none low

Re-execute an existing .shape.ts with ephemeral `params` overrides WITHOUT modifying the file — the file on disk is untouched. Returns the same stats as get_render_status (volume, surface area, bounding box, timings, warnings) so agents can binary-search a design constraint (target volume, bounding box, mass, fit tolerance) before committing the winning value with modify_shape. Pass `captureScreenshot: true` to also render a PNG of the tuned configuration through the bundled headless SVG pipeline (runs standalone; the ShapeItUp VSCode extension, when open, will also reflect the render in its interactive viewer). Pass `persist: true` to also write the override map to a `.shapeitup-params.json` sidecar next to the file so every later execution (render_preview, open_shape, export_shape, etc.) picks them up automatically; clear with `clear_params`.

inline boolean persist boolean filePath string captureScreenshot boolean
clear_params
annotations: none low

Clear persisted param overrides written by `tune_params({ persist: true })`. Persistence model: `tune_params` with `persist: true` writes a `.shapeitup-params.json` sidecar alongside the shape file; subsequent executions (render_preview, open_shape, export_shape, modify_shape, preview_finder, check_collisions) merge those overrides on top of the script

all boolean filePath string workingDir string
get_api_reference
annotations: none low

Get Replicad API reference. Call without category to list available categories, pass `search` to find the most relevant sections across all categories, or pass `signaturesOnly: true` to get just the method signatures (token-efficient lookup).

full boolean search string signaturesOnly boolean
render_preview
annotations: none low

Render a PNG screenshot of the current shape through the bundled headless SVG pipeline — a 4-pane (top/front/right/iso) shaded view produced from the in-memory tessellation. Runs standalone; the ShapeItUp VSCode extension, when open, will also reflect the same shape in its interactive viewer. PNGs are written to `{workspace}/shapeitup-previews/` — Read the returned absolute path to view the image. Pass `finder` to overlay pink dots at matched edges/faces (for a text-only match count, use `preview_finder`). Pass `meshQuality:

width number finder string height number inline boolean filePath string partName string showAxes boolean focusPart string partIndex number showDimensions boolean forceBundleRebuild boolean
get_preview
annotations: none low

Return the latest (or a specified) ShapeItUp preview PNG as inline MCP image content — base64 bytes delivered directly in the tool response, no filesystem Read required. Use this when your sandbox ignores `shapeitup-previews/` (gitignored) or restricts filesystem reads. Does NOT trigger a render — call `render_preview` first if no preview exists yet.

filePath string
set_render_mode
annotations: none low

Switch the interactive VSCode viewer between dark and AI mode. UI-only setting — when no VSCode viewer is attached the preference is recorded for the next viewer to pick up (the tool never fails on a missing viewer).

toggle_dimensions
annotations: none low

Show or hide dimension measurements on the VSCode viewer. UI-only setting — when no viewer is attached the preference is recorded for the next connection (the tool never fails on a missing viewer). Omit `show` to toggle the current state.

get_render_status
annotations: none low

Get the result of the last shape render — whether it succeeded or failed, with stats, geometric properties (volume, area, center of mass, mass when material is exported), and bounding box. Reads the shared status file, which both MCP-driven and VSCode-driven renders write to. Includes currentParams — the resolved values of every exported param, so you don

preview_finder
annotations: none low

Preview which edges/faces a Replicad EdgeFinder or FaceFinder matches on a shape — WITHOUT editing the user

code string finder string filePath string partName string partIndex number workingDir string
run_simulation
annotations: none low

Runs the Phase-1 kinematic MOTION simulation declared by a shape

code string filePath string workingDir string
check_collisions
annotations: none low

Detects pairwise intersections between named parts in a multi-part assembly. AABB prefilter skips obviously-disjoint pairs; the rest run Replicad

code string filePath string tolerance number workingDir string pressFitThreshold number
check_stack
annotations: none low

Reports each part

code string filePath string workingDir string
validate_joints
annotations: none low

Validates declared mate joints: executes the shape, reads the `joints` map on each rendered part (world coordinates — auto-populated by the stdlib `Part`/`entries()` API, or supplied directly via `{shape, name, joints}` returns), and measures each joint point

path string tolerance number
verify_shape
annotations: none low

Single-call inspection bundle: executes the shape ONCE and runs any combination of geometry, collision, and joint checks against that single execution. Faster than calling describe_geometry → check_collisions → validate_joints separately (each of those re-executes the shape). Returns a structured JSON report with one section per requested check plus a top-level `ok` flag and `summary`. Pick `checks` to scope the work; per-check options are prefixed (geometryFormat, collisionTolerance, jointTolerance, etc.). Use the individual tools for one-off queries; use this when verifying an assembly comprehensively.

code string filePath string workingDir string geometryLimit number jointTolerance number geometryPartName string collisionTolerance number collisionPressFitThreshold number
sweep_check
annotations: none low

Rotate a single named part through a range of angles around a pivot+axis and report any collisions it would make with the other parts at each step. Useful for articulated mechanisms (hinges, arms, linkages) where static collision checks miss motion conflicts. The moving part is cloned at every step so the original assembly is never mutated. Also reports the swept-volume AABB — the union of the moving part

code string steps number moving string filePath string tolerance number workingDir string
describe_geometry
annotations: none low

Enumerate the faces and/or edges of a rendered shape with per-entity geometry (normal, centroid, area, type; edges: start/end/length/type) plus a bounding box and a grouped-count `summary`. Use `format:

code string limit number filePath string partName string workingDir string

Permissions 4

network medium
Server uses network capabilities via: fetch()
filesystem low
Server uses filesystem capabilities via: fs, fs sync ops, fs.promises
shell high
Server uses shell capabilities via: child_process, execSync(), spawn()
env_vars low
Server uses env_vars capabilities via: process.env

Scan Findings 74

low
Tool 'setup_shape_project' has no annotations annotation_checker · 100%
low
Tool 'create_shape' has no annotations annotation_checker · 100%
low
Tool 'open_shape' has no annotations annotation_checker · 100%
low
Tool 'modify_shape' has no annotations annotation_checker · 100%
low
Tool 'read_shape' has no annotations annotation_checker · 100%
low
Tool 'delete_shape' has no annotations annotation_checker · 100%
low
Tool 'export_shape' has no annotations annotation_checker · 100%
low
Tool 'list_installed_apps' has no annotations annotation_checker · 100%
low
Tool 'list_shapes' has no annotations annotation_checker · 100%
low
Tool 'validate_syntax' has no annotations annotation_checker · 100%
low
Tool 'preview_shape' has no annotations annotation_checker · 100%
low
Tool 'tune_params' has no annotations annotation_checker · 100%
low
Tool 'clear_params' has no annotations annotation_checker · 100%
low
Tool 'get_api_reference' has no annotations annotation_checker · 100%
low
Tool 'render_preview' has no annotations annotation_checker · 100%
low
Tool 'get_preview' has no annotations annotation_checker · 100%
low
Tool 'set_render_mode' has no annotations annotation_checker · 100%
low
Tool 'toggle_dimensions' has no annotations annotation_checker · 100%
low
Tool 'get_render_status' has no annotations annotation_checker · 100%
low
Tool 'preview_finder' has no annotations annotation_checker · 100%
low
Tool 'run_simulation' has no annotations annotation_checker · 100%
low
Tool 'check_collisions' has no annotations annotation_checker · 100%
low
Tool 'check_stack' has no annotations annotation_checker · 100%
low
Tool 'validate_joints' has no annotations annotation_checker · 100%
low
Tool 'verify_shape' has no annotations annotation_checker · 100%
low
Tool 'sweep_check' has no annotations annotation_checker · 100%
low
Tool 'describe_geometry' has no annotations annotation_checker · 100%
medium
OAuth implementation without PKCE auth_checker · 75%
info
Sandbox failed to start for behavioral verification behavioral_verifier · 100%
medium
Vulnerable dependency: esbuild@0.24.0 (GHSA-67mh-4wv8-2f99) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@2.0.0 (GHSA-5xrq-8626-4rwp) dependency_analyzer · 95%
medium
Vulnerable dependency: vitest@2.0.0 (GHSA-9crc-q9x8-hgqq) dependency_analyzer · 95%
medium
Vulnerable dependency: ws@8.20.0 (GHSA-58qx-3vcg-4xpx) dependency_analyzer · 95%
medium
Vulnerable dependency: ws@8.20.0 (GHSA-96hv-2xvq-fx4p) dependency_analyzer · 95%
medium
Vulnerable dependency: @modelcontextprotocol/sdk@1.0.0 (GHSA-w48q-cv73-mx4w) dependency_analyzer · 95%
medium
High-entropy string (5.95 bits/char) in asbis-ShapeItUp-f65affc/packages/extension/src/viewer-provider.ts:1508 entropy_analyzer · 54%
medium
Buffer.from base64 in asbis-ShapeItUp-f65affc/packages/extension/src/viewer-provider.ts:1430 entropy_analyzer · 75%
info
package.json metadata manifest_parser · 100%
info
Tool: setup_shape_project manifest_parser · 70%
info
Tool: create_shape manifest_parser · 70%
info
Tool: open_shape manifest_parser · 70%
info
Tool: modify_shape manifest_parser · 70%
info
Tool: read_shape manifest_parser · 70%
info
Tool: delete_shape manifest_parser · 70%
info
Tool: export_shape manifest_parser · 70%
info
Tool: list_installed_apps manifest_parser · 70%
info
Tool: list_shapes manifest_parser · 70%
info
Tool: validate_syntax manifest_parser · 70%
info
Tool: preview_shape manifest_parser · 70%
info
Tool: tune_params manifest_parser · 70%
info
Tool: clear_params manifest_parser · 70%
info
Tool: get_api_reference manifest_parser · 70%
info
Tool: render_preview manifest_parser · 70%
info
Tool: get_preview manifest_parser · 70%
info
Tool: set_render_mode manifest_parser · 70%
info
Tool: toggle_dimensions manifest_parser · 70%
info
Tool: get_render_status manifest_parser · 70%
info
Tool: preview_finder manifest_parser · 70%
info
Tool: run_simulation manifest_parser · 70%
info
Tool: check_collisions manifest_parser · 70%
info
Tool: check_stack manifest_parser · 70%
info
Tool: validate_joints manifest_parser · 70%
info
Tool: verify_shape manifest_parser · 70%
info
Tool: sweep_check manifest_parser · 70%
info
Tool: describe_geometry manifest_parser · 70%
info
Transport: stdio manifest_parser · 90%
info
Required env vars (4) manifest_parser · 80%
info
Sandbox failed to start for output poisoning scan output_poisoning · 100%
medium
Permission: network access detected permission_analyzer · 70%
low
Permission: filesystem access detected permission_analyzer · 90%
high
Permission: shell access detected permission_analyzer · 95%
low
Permission: env_vars access detected permission_analyzer · 90%
info
SBOM generated: 23 components sbom_generator · 100%
medium
No build provenance detected (SLSA L0) slsa_assessor · 90%