threlte-mcp

The server operates primarily as a local development tool, communicating with IDEs via standard I/O and with the game client via a local WebSocket (ws://localhost:8083). It handles file operations for GLTF asset processing, leveraging trusted libraries like `@gltf-transform` and `meshoptimizer`. While these operations involve file system access, input paths are validated, and remote URLs are disallowed, mitigating common file traversal risks. No direct 'eval' or hardcoded sensitive secrets were found. The primary risk lies with potential vulnerabilities in third-party GLTF processing libraries or if the local WebSocket server were exposed externally, allowing unauthorized scene manipulation. However, for its intended local use, it is considered robust.