3dsmax-mcp@1.6.8

CAUTION

Publisher claims: "MCP server for AI agents to control Autodesk 3ds Max" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry PyPI (MCP server)Publisher cl0nazepamm · joined 0 days agoInstalls 534Last detonated 2 h ago

Dispute verdict

Behavior trace

Honeypot run · 1 s · 2 scenarios · 0 deviations

t+CategoryObserved action

0.2sprocessexited 1: EOFError: EOF when reading a line

0.5sprocessdependency install exit 1

0.5sprocessexec /usr/bin/timeout

0.5sprocessexec .venv/bin/3dsmax-mcp

0.5sprocessexited 127: timeout: failed to run command '.venv/bin/3dsmax-mcp': No such file or directory

0.5sclaimedno tools/list reply (exit 127)

0.5sprocessscript backend runs setup only

Static findings

CRITICAL

Access to sensitive file pathsdocs/CHANGELOG.md:114 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system files

AST05

CRITICAL

Destructive file system command detectedinstall.py:204 · Destructive file system command detected

AST05

HIGH

Python subprocess execution detectedinstall.py:205 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedinstall.py:395 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedinstall.py:345 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detecteduninstall.py:56 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detectedinstall.py:550 · Python subprocess execution detected

AST05

MEDIUM

MCP server using network transport (SSE/HTTP)docs/CHANGELOG.md:114 · MCP server using network transport (SSE/HTTP) — data sent over network

AST04

MEDIUM

File type combined with upload actiondocs/CHANGELOG.md:130 · File type combined with upload action — agent may exfiltrate local data files

AST07

MEDIUM

File type combined with upload actiondocs/ADVANCED.md:59 · File type combined with upload action — agent may exfiltrate local data files

AST07

HIGH

Auto-update or dynamic fetch configurationmaxmcp/tools/inspect.py:288 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06

HIGH

Python subprocess execution detecteduninstall.py:295 · Python subprocess execution detected

AST05

HIGH

Python subprocess execution detecteduninstall.py:275 · Python subprocess execution detected

AST05

HIGH

Auto-update or dynamic fetch configurationmaxmcp/tools/inspect.py:286 · Auto-update or dynamic fetch configuration — agent may load new code at runtime

AST06