EchelonGraph CVE & Exposure
CVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.
Description from the maker (original English)
MCP server for Cinema 4D — entity CRUD, parameter-level access, batched undo, security controls.
These three are never merged into one score: opinions, measurements and popularity are different things.
We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.
Pick the AI app you use, then copy the settings.
You need
Which app do you use?
Pick your app above. We remember it, so next time the button says “Install in …”.
Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json
{
"mcpServers": {
"cinema4d": {
"command": "npx",
"args": [
"-y",
"@kumoproductions/mcp-cinema4d"
]
}
}
}Run this in your terminal
claude mcp add cinema4d -- npx -y @kumoproductions/mcp-cinema4dPaste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json
{
"mcpServers": {
"cinema4d": {
"command": "npx",
"args": [
"-y",
"@kumoproductions/mcp-cinema4d"
]
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
Paste into .vscode/mcp.json in your project
{
"servers": {
"cinema4d": {
"type": "stdio",
"command": "npx",
"args": [
"-y",
"@kumoproductions/mcp-cinema4d"
]
}
}
}Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.
This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.
Your choice stays on this device in a cookie; no account needed.
These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.
Runs on your computer; the tool list appears in your AI app after you install it.
We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 8, 2026
The registry name was verified with the GitHub account kumoproductions, which owns the repo
We have not read this repo from GitHub yet
We have not read this repo from GitHub yet
This one runs on your computer; there is no internet endpoint
Runs on your computer and uses local settings instead
Runs on your computer; we can only read tool lists from internet endpoints
Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.
It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.
The registry does not list a required key, though some servers ask you to sign in on first use.
It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).
The GitHub repo last changed –, and the latest version (0.5.1) reached the registry 38 days ago.
Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Node.js on your computer.
In the same category: EchelonGraph CVE & Exposure, SML Risk Firewall, Nife
Servers in the same category from other makers, sorted by stars.
Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi
CVE, KEV, EPSS, SBOM and advisory lookups; per-CVE exposure from Shodan data (© Shodan). Keyless.
Pre-trade risk checks for agent trades: orders vs your limits, signed receipts.
Manage Nife.io cloud apps, sites, secrets and Git integrations from MCP clients.
Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.
Let an LLM drive Cinema 4D. mcp-cinema4d bridges MCP-compatible clients (Claude Desktop, Claude Code, or any other stdio-capable MCP client) to a running Cinema 4D 2026 session so the model can inspect scene hierarchy, author shots, build node materials, and rig animation through a typed, undo-safe tool layer — not arbitrary Python pasted into a Script Manager.
日本語
简体中文
[!IMPORTANT]
Cinema 4D now ships an official MCP server. From Cinema 4D 2026.4, Maxon builds an MCP server into Cinema 4D itself: nothing to install, set up from Preferences → MCP, and supported by Maxon. If you run 2026.4 or later and simply want an AI assistant in Cinema 4D, start there — see Maxon's MCP Server page and documentation.
mcp-cinema4d is an independent community project. It remains an option where the built-in server does not fit:
- Cinema 4D 2026.0–2026.3, which have no built-in server.
- Several Cinema 4D processes from one session (multi-instance mode), which the built-in server's documentation does not cover.
- Open source — read, audit, or extend the tools and the bridge yourself.
Do not register both servers in the same client. Their tool sets overlap (both expose
exec_python, for example), so the model is offered two competing sets of Cinema 4D tools. Maxon's FAQ likewise asks you to switch third-party servers off while you use the built-in one.
Good for:
hero layer; flag any with non-uniform scale or missing Texture tags."[!CAUTION]
Do not proceed unless you understand what this does. An LLM with a live connection to Cinema 4D can read your scene, write to it, and (if you opt in) execute arbitrary code on your machine. In concrete terms:
1. Your scene data leaves your machine. Object names, hierarchy paths, material/parameter values, imported file paths — whatever the LLM reads via
list_entities/describe/get_container/dump_shader/get_mesh— is forwarded to your chosen LLM provider and may be logged by your MCP client. Under NDA or on unreleased IP? Confirm with your studio/legal team first that the provider's retention policy and your client's logs are acceptable.
2. The LLM gets write access. It can create, mutate, and delete objects, tags, materials, takes, render data, and layers; import / merge / open / save files; and render. Ctrl/Cmd-Z covers most edits —
save_document,open_document,render, and somecall_commandinvocations do not.
3. Arbitrary Python is off by default.
exec_pythonruns unrestricted code with the full authority of the Cinema 4D process (file I/O, subprocess, network). Enabled only whenC4D_MCP_ENABLE_EXEC_PYTHON=1is set on both sides; turn it back off when you no longer need it. The same applies to plugin types that store Python source in their container — Python tag, Python generator, MoGraph Python effector, Python field, and the Xpresso Python operator. Creating or editing them is gated behind a separateC4D_MCP_ENABLE_PYTHON_OPS=1opt-in, since their code parameter is RCE-equivalent toexec_python.
Before first use: back up (or commit) your scene, start on a throwaway project, and leave your MCP client's per-call approval prompts enabled. See Security before exposing the bridge beyond loopback.
MCP client
↓ stdio MCP server (this repo, Node.js) ↓ TCP, JSON Lines (default 127.0.0.1:18710) cinema4d_mcp_bridge (Python plugin inside C4D) ↓ Cinema 4D
Two pieces to install: the MCP server (this npm package, runs as an MCP stdio process) and the bridge plugin (Python, lives inside Cinema 4D). C4D must be running for the bridge to respond.
Assuming you already have Cinema 4D 2026.0.0+ and Node.js 24+.
cinema4d_mcp_bridge- .zip from the Releases page and extract the cinema4d_mcp_bridge/ folder into your Cinema 4D plugins directory (see Installing the bridge plugin for platform-specific paths).[cinema4d_mcp_bridge] listening on 127.0.0.1:18710. echo '{"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"ping","arguments":{}}}' \
| npx -y @kumoproductions/mcp-cinema4d
Then wire it into your MCP client (see Client configuration) and try:
_"List every object in the scene, then add a cube named
hero200 units above the origin."_
The LLM will call list_entities → create_entity in sequence; you should see a new cube appear in the viewport.
Prefer running from a local checkout? See CONTRIBUTING.md for the source-install flow.
Generate a random token and set it on both the MCP server process (via the client's env map, below) and the Cinema 4D launch environment. The bridge rejects mismatched requests (constant-time compare); the Node client forwards the value automatically. Strongly recommended — localhost is not a trust boundary on a shared workstation.
openssl rand -hex 16
Register the MCP server in your client with the token in the env map:
{
"mcpServers": { "cinema4d": { "command": "npx", "args": ["-y", "@kumoproductions/mcp-cinema4d"], "env": { "C4D_MCP_TOKEN": "paste-your-random-hex-here" } } } }
| Client | Config file |
|---|---|
| Claude Desktop / Claude Code | %APPDATA%\Claude\claude_desktop_config.json (Windows) · ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) |
| Other MCP clients | see the client's docs for registering a stdio server |
**The same C4D_MCP_* variables must also be set in the Cinema 4D launch environment** — the bridge plugin reads them at C4D startup. macOS: open -a "Cinema 4D" --env C4D_MCP_TOKEN=... (or export in your shell profile before launch). Windows: set as User environment variables and restart C4D.
To change the bridge socket, set C4D_MCP_PORT (and optionally C4D_MCP_HOST — see Security) alongside C4D_MCP_TOKEN in the same env map, plus the C4D launch env.
72 tools across 17 groups. The LLM picks tools itself based on the prompt — you rarely invoke them directly. See docs/TOOLS.md for the full table with per-tool descriptions.
| Group | Count | What's in it |
|---|---|---|
| Basics | 4 | ping, render, preview_render (Viewport renderer + Constant Lines, returns inline PNG), reset_scene. |
| Script-style | 5 | exec_python (opt-in), call_command, list_plugins, undo, batch — escape hatches + undo-grouped multi-op. |
| Generic CRUD | 9 | list_entities, describe, get_params/set_params, get_container, dump_shader, create_entity, remove_entity, set_keyframe. |
| Shot setup | 11 | Document state, fps / frame range / camera, import_scene (merge), RenderData + Take, take_override, timeline markers (create_marker / list_markers / set_marker / remove_marker), sample_transform. |
| Selection · Hierarchy | 4 | Active selection read / write; reparent, reorder, clone. |
| Modeling · Mesh | 4 | modeling_command (CSO / Make Editable / Connect / Subdivide / …), get_mesh, set_mesh, set_mesh_selection. |
| Document I/O | 6 | save_document, open_document, new_document, list_documents, set_active_document (switch between already-open docs), close_document (force-gated for unsaved changes). |
| Node graphs | 10 | Node-material graphs (walk / asset enum / apply_graph_description / per-port edits / removal) and Xpresso (GvNodeMaster) graphs (list_xpresso_nodes / apply_xpresso_graph / set_xpresso_port / remove_xpresso_node). |
| Tag helpers · Animation | 5 | assign_material; list_tracks, get_keyframes, delete_keyframe, delete_track. |
| Transforms · User data · MoGraph | 5 | set_transform; add_user_data / list_user_data / remove_user_data; list_mograph_clones. |
| Layers | 5 | Enumerate, create, assign, query, flag toggles (solo / view / render / locked / …).
Only the beginning is shown; read the rest in the repo