
Security News
PHP Foundation Says Chainguard Broke Security Embargo Ahead of Emergency Patches
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.
@manycore/coohom-lux3d-mcp
Advanced tools
This package is the authoritative implementation and release source for the Lux3D MCP. It exposes image-to-3D generation to Codex while delegating browser-authenticated Coohom API execution to the companion Executor page.
Change this package when work affects:
prepare_workspace, _meta.threadId, executor_required, or task-specific executorUrl values.Do not implement browser UI or authenticated page operations here. The companion Executor repository at i18n-fe/bim/ai-home/lux3d-mcp-server owns:
/pub/tool/bim/ai-home/mcp-executor.The Codex plugin at i18n-fe/ai/coohom-freeform orchestrates this MCP with the Coohom Freeform MCP. It must consume the public contract without reimplementing the server or Executor.
Qunhe internal npm:
[mcp_servers.lux3d-mcp-server]
command = "npx"
args = ["-y", "@qunhe/lux3d-mcp-server@latest"]
[mcp_servers.lux3d-mcp-server.env]
npm_config_registry = "https://npm-registry.qunhequnhe.com/"
No Cookie, Authorization header, or site URL is configured in Codex. The user signs in through the Executor page.
The stdio server normally shares 127.0.0.1:18766 across Codex tasks:
_meta.threadId. The server does not generate a replacement session ID.prepare_workspace returns the task-specific Executor URL with the matching codexThreadId.PAGE_CONFLICT.The Executor may run in the Codex browser, Chrome, or Safari, but it must run on the same computer as the MCP process to reach the loopback Broker.
prepare_workspaceRead-only and credit-free. Returns:
{
"threadId": "codex-task-id",
"status": "connected",
"executorUrl": "https://www.coohom.com/pub/tool/bim/ai-home/mcp-executor?codexThreadId=codex-task-id"
}
When the matching Executor is not connected, status is executor_required. Open the returned URL unchanged and call prepare_workspace again after the page connects.
create_lux3d_model_taskAccepts exactly one HTTPS imageUrl or a PNG/JPEG/WEBP imageBase64 value and creates a Turbo / Lux3D G1 task. A successful submission returns { "taskId": "...", "status": "submitted" }.
If the Executor is not connected, the request is not forwarded and the tool returns the workspace result with status: "executor_required".
get_lux3d_model_taskQueries one generation task. Results distinguish queued, generating, archiving, succeeded, and failed. succeeded must include both generatedModelUrl and a nonempty obsBrandGoodId; missing either field is a protocol error.
archiving means model generation has completed but Coohom is still saving the asset. Poll every 3–5 seconds until a terminal status.
open_credits_paymentOpens the Credits payment dialog in the signed-in Executor after the user explicitly chooses to pay. { "opened": true } means only that the dialog opened; it does not claim that payment completed.
get_creditsReturns { "availableCredits": number } for the account signed in to the Executor. This balance is informational, may not include free generation allowances, and must not gate task creation. The result of create_lux3d_model_task is authoritative.
prepare_workspace.executor_required, open the complete executorUrl and wait for the matching page to connect.prepare_workspace again and require connected.create_lux3d_model_task.get_lux3d_model_task until succeeded or failed.If task creation fails because Credits are insufficient, offer the user the workflow choices defined by the calling plugin. Only after the user chooses payment should the caller invoke open_credits_payment. The user completes payment in the browser and confirms completion to Codex. Codex may call get_credits to display the paid balance, but retries the original generation request once regardless of that number because free allowances are determined by the creation response.
Do not construct a thread ID, use a fixed Executor URL, or submit a generation task merely to test connectivity.
From this package directory:
pnpm typecheck
pnpm build
npm pack --dry-run ./dist
LUX3D_MCP_EXECUTOR_URL may override the Executor page for Coohom HTTPS environments. LUX3D_MCP_BRIDGE_PORT may override the local port for diagnostics, but normal installations should use the default.
FAQs
Frontend MCP Server for Lux3D image-to-3D model generation
The npm package @manycore/coohom-lux3d-mcp receives a total of 0 weekly downloads. As such, @manycore/coohom-lux3d-mcp popularity was classified as not popular.
We found that @manycore/coohom-lux3d-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 8 open source maintainers collaborating on the project.

Security News
The PHP Foundation says Chainguard broke a security embargo ahead of critical RCE patches, as leaks disrupted the coordinated release.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.