Flint

The server uses `subprocess.run` to interact with Blender and the `uvx blender-mcp` toolchain, which is necessary for its functionality. Inputs to these subprocess calls are derived from controlled configurations (`BLENDER_PATH`, `EXPORT_FOLDER`, `EXPORT_FILENAME`) rather than direct user input, mitigating command injection risks. The `/download` endpoint is explicitly restricted to `exported_model.usdz` to prevent arbitrary file access. The MCP agent uses `toolAllowList` to restrict the LLM's capabilities, enhancing security by limiting potential malicious tool calls. The primary remaining risk is the inherent power of the `execute_blender_code` tool, which allows the LLM to generate and run arbitrary Python code within Blender, though the agent's constraints (max steps, prompt truncation, system hints) aim to guide it to safe operations. Hardcoded API keys are avoided, relying on `.env` for sensitive information.