FreeCAD MCP

Control FreeCAD via MCP to create and modify 3D models, automate CAD tasks, solve constraints, and integrate part libraries programmatically.

This skill appears to implement a legitimate FreeCAD MCP server, but review the following before installing: - Arbitrary-code execution: The RPC API includes execute_code which will run Python inside your FreeCAD process. Only use this on a trusted machine, restrict network access to localhost, and avoid exposing the RPC port to untrusted networks. - Documentation mismatch: SKILL.md shows the MCP endpoint at port 9876 but client code uses 9875. Verify the actual port and configuration before connecting agents. - Examples reference external tools/keys (uv/uvx, GROQ_API_KEY, LLM models) that are not required by the addon itself — don’t provide unrelated API keys unless you understand why an example needs them. - Installation writes into your FreeCAD Mod directory; inspect the addon files locally before copying them and consider running inside an isolated environment or VM if you want to be cautious. If you plan to use this skill, audit/limit which agents can connect to the RPC server, and avoid running it on machines with sensitive data or exposed network services.

Type: OpenClaw Skill Name: openclaw-freecad-mcp Version: 1.0.0 The skill bundle provides a bridge to control FreeCAD via MCP but includes a highly dangerous `execute_code` tool in `src/freecad_mcp/server.py` and `addon/FreeCADMCP/rpc_server/rpc_server.py` that allows for arbitrary Python execution using `exec()`. While documented as a feature for complex CAD operations, this capability presents a significant Remote Code Execution (RCE) risk if the AI agent is targeted by prompt injection. Additionally, the XML-RPC server used for communication between the MCP bridge and FreeCAD lacks authentication, relying solely on its binding to localhost.