Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
-
No community reviews yet
Ran this server? Tell others if you would trust it in production. Reviews are separate from our grade.
Write a reviewWhy it got a B
A community MCP server (MIT, by neka-nat) that controls FreeCAD from an AI client: create and edit models, inspect documents, run FEM analyses and run Python scripts. It has two parts: an addon you copy into FreeCAD that starts a local XML-RPC server, and a stdio MCP server you launch with uvx freecad-mcp. The RPC server listens on localhost by default and has no authentication unless you set one auth token; remote connections are an opt-in with an IP allowlist, and the docs say traffic is never encrypted. The tools include execute_code, which runs Python inside FreeCAD with your user's permissions, and execute_code_headless, which runs a script through freecadcmd in a separate process. Active repo: last commit and PyPI release 0.1.30 on 2026-11-07, 14 human authors in the last 90 days. One high advisory on record, GHSA-v4pw-r6h3-v75q (CVSS 8.8, published 2026-09-24): in addon versions up to 0.1.24, a web page open in a browser on the same machine could send a request to the RPC server and run Python in FreeCAD. The fix landed in 0.1.25 the same day and the server now refuses browser-style requests. The addon is copied in by hand, so it only updates when you replace your copy. Biggest deduction: the transport check, because the server's job is to run model-written code with your user's privileges (and to shell out to freecadcmd for headless runs), and the optional token is off by default. Keep the RPC server on localhost, replace your addon copy with 0.1.25 or later, and stop the server when you are not using it.
How to connect
// claude_desktop_config.json (README quick start). Also needs the FreeCAD addon installed and its RPC server started.
{
"mcpServers": {
"freecad": {
"command": "uvx",
"args": ["freecad-mcp"]
}
}
}Is FreeCAD MCP safe?
Is FreeCAD MCP safe to use?
FreeCAD MCP grades B (solid, with minor gaps). Login is optional, so check that it is turned on in your setup. It shells out to helper programs or serves HTTP without enforced TLS, so keep it local and isolated.
Does FreeCAD MCP have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does FreeCAD MCP support authentication?
Optionally. It can run with a login, but it does not require one, so turn it on.
Alternatives in Developer Tools
- A Appwrite MCP ServerOfficial Appwrite server that exposes databases, users, functions, teams and storage as tools, hosted with OAuth or run locally with a project API key.
- A Atlassian Rovo MCP ServerOfficial hosted Atlassian server for Jira, Confluence, Jira Service Management, Compass, Bitbucket, Loom, Goals, Projects, and Teams, with OAuth 2.1 sign-in.
- A Buildkite MCP ServerOfficial Buildkite server for pipelines, builds, jobs, logs, annotations, and Test Engine data, hosted or local.
- A Dynatrace Remote MCP ServerDynatrace's hosted MCP server, running inside your Dynatrace SaaS environment, to run and explain DQL, look into problems, vulnerabilities and Kubernetes events, and forecast time series.
- A GitHub MCP ServerOfficial GitHub server for repos, issues, pull requests, Actions, and code security, hosted or local.
Embed this badge
[](https://trustedmcp.io/servers/freecad-mcp)<a href="https://trustedmcp.io/servers/freecad-mcp"><img src="https://trustedmcp.io/badge/freecad-mcp.svg" alt="TrustedMCP grade B" height="80"></a>Community reviews
No published community reviews yet.
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.