
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
Mojulo — a 3D compiler for coding agents: an MCP server that runs wherever your agent runs, on your machine or in the throwaway Linux box it gives itself (the Claude app or web, ChatGPT work mode with Codex, Grok chat, Meta Muse), where you build worlds,

Mojulo is a 3D compiler for coding agents: an MCP server that runs wherever your agent runs, on your machine or in the throwaway Linux box it gives itself, where everything your agent makes is stored as a small recipe (the source), compiled back to the same geometry on every read, and emitted to Godot, Blender, STL and more. A compiler, not a generator; a recipe minted in a box re-mints byte for byte at home.
npx mojulo init
That wires mojulo into the coding agents on this machine (Claude Code, Codex, Claude Desktop — one yes/no each) and opens the dashboard. Node 22.12+. No API key; your agent is the reasoning loop.
You talk to the agent you already run; it does the reasoning, and mojulo is the machine it works in. Build objects, worlds, and games by conversation. An object blocks out at literal scale, a world is a place you can walk, a level is a world under a game contract, a game composes the levels — and music folds in as an asset, synthesized from seeded math with no samples. Each rung is a small deterministic recipe: readable, seeded to regenerate identically, never a render.
Two pipelines out. DIGITAL: worlds, levels and scenes render dependency-free in the browser and export to Godot as a real project, to Unity and Unreal as a data pack plus importer (each with an advisory gate when the engine is installed), and to Blender as an art-pass pack — with .glb and OpenUSD for everything else. PHYSICAL: objects, vehicles and wordmarks export as print-ready STL or 3MF at true scale — mm units, z-up, slicer-ready, with a slicer gate that stamps what it measured.
Mojulo is the upstream that feeds the tools you already use. It does not try to out-render a game engine, and it is not just an exporter: the recipe is where the thing is born and re-renders; the engine or the printer is where it is optionally finished. Every handoff carries a ledger of what did not travel.
Not a second brain — a body. Your agent is the only intelligence in the loop. Mojulo holds state, runtime, and the audit trail, and needs no LLM credentials of its own. Optional local workers — Blender, a slicer, a mesh sculptor — are yours to host and never dependencies.
The bins, one install:
mojulo — stdio MCP server (npx -y mojulo, wired into Claude Code, Codex, or any other MCP host); also the installer and a CLI front door (below).mojulo-ui — local dashboard (npx -y -p mojulo mojulo-ui).mojulo-config — provider key CLI, only needed for directed images or the optional chatbot pack.mojulo and mojulo-ui share the same ~/.mojulo/ state, so anything you mint from your agent shows up in the dashboard immediately.
Prerequisite: Node.js 22.12+ (node --version). Everything below runs through
npx, which ships with Node — if you don't have it, install it from
nodejs.org, or ask your coding agent to install it for you.
No provider key: your agent is the reasoning loop. Verified on macOS (Apple Silicon),
on native Windows (init and a first render, under Claude Code), and on Linux x64 in
the throwaway boxes of the Claude app and web, ChatGPT work mode with Codex, Grok chat and Meta Muse,
each run to a mint and an export; a cold install is also checked on Linux arm64.
# 1. Wire mojulo into your MCP-capable agent. The one-shot installer detects
# the MCP hosts on this machine by declared profile (Claude Code, Codex,
# Claude Desktop, and others), asks y/n per host, and opens the dashboard:
npx mojulo init
# Or wire manually —
# Claude Code:
# claude mcp add --scope user mojulo -- npx -y mojulo
# Codex CLI: add to ~/.codex/config.toml
# [mcp_servers.mojulo]
# command = "npx"
# args = ["-y", "mojulo"]
# Claude Desktop: add under "mcpServers" in claude_desktop_config.json, then restart it
# "mojulo": { "command": "npx", "args": ["-y", "mojulo"] }
# Other MCP hosts: register the same `npx -y mojulo` stdio command.
# 2. In an agent session, just ask:
# what is this? → mojulo orients itself, out loud
# make me a coffee mug, 90 mm tall → a solid; download the .stl
# generate a 3D city at night → a world; open the /scene URL
# turn that into a game → a game; export it for Godot
# 3. In your agent's own box with an MCP client (Claude Code on the web, a
# Codex cloud task), nobody is at a keyboard — init takes its defaults and
# skips the dashboard:
# npx -y mojulo init --yes --no-ui
# A box with no MCP client (Grok chat, ChatGPT work mode, the Claude app,
# Meta Muse) skips init and drives the same registry from the shell:
# npx mojulo orient # read first: the connect preamble, as shell
# npx mojulo call forward_context # the routing index
# npx mojulo call <tool> --json '{…}'
# Ask for format 'bundle' on the way out: one zip, recipe included, that
# re-mints byte for byte on your own machine.
# 4. Optional add-ons, same choice on your machine or in a box:
# npx -y -p mojulo mojulo install recall # the embedding model behind
# # semantic_search (lexical without it)
# npx -y -p mojulo mojulo install chatbot # the bot factory — needs an LLM key
# npx -y -p mojulo mojulo-config set anthropic sk-ant-...
First install is the big one: npx pulls a ~27 MB tarball plus its native dependencies (about 590 MB on disk; 2.0.6 measured 885 MB before the embedding runtime became opt-in, below). Measured sizes, lazy downloads, and what each engine leg needs: docs/tech-requirements.md.
Why these dependencies. The install is mostly two things, and all of them run on your machine.
puppeteer-core drives a local headless Chrome for stills and bakes; the browser
itself is fetched on first use, or skipped if you already have Chrome. better-sqlite3 is the one
database file under ~/.mojulo/. The local search model behind semantic_search
(@huggingface/transformers on onnxruntime-node, which ships binaries for every platform in one
package) is the opt-in mojulo install recall; without it semantic_search ranks lexically over the
same index. Nothing in that list reaches the network on its own. The per-dependency sheet, with
sizes, is in the same tech-requirements page.
The same mojulo bin doubles as a command-line front door over the same
engine and data — no agent, no dashboard, no API key required. Useful for
spot checks, cron jobs, and CI:
npx mojulo orient # what an MCP client gets at initialize, plus the shell grammar
npx mojulo tools # the connect surface: spine + packs
npx mojulo tools pack_object # one pack's members
npx mojulo packs # pack ids with their recognizers
npx mojulo help export_model # full description + input schema
npx mojulo call version # invoke any tool
npx mojulo call export_model --json '{"ref":"sk_…","format":"3mf"}'
npx mojulo pack_object # open a pack: orientation + member manual
Arguments can be inline JSON (--json '{…}', @file.json, or - for
stdin) or per-property flags derived from the tool's schema
(--theme dungeon --seed 7; flags win over --json). --timeout <ms>
bounds long-poll tools (exit code 124), --quiet keeps only the exit code
(0 success, 1 tool error, 2 usage). Results print to stdout as-is, so
npx mojulo call version | jq . works; diagnostics go to stderr. Bare
npx mojulo remains the stdio MCP server.
Mojulo runs wherever your agent runs, and a recipe minted in one place re-mints byte for byte in the other. Two shapes, one install.
In your agent's box, nothing on your machine. One sentence to the agent installs mojulo in the throwaway Linux box it gives itself:
Each of those has been run this way, from the sentence to a mint and an export handed back. You get
the same recipes and the same exports, as files: the export result names this host's door, an
artifact page, a PR or a file card. The box has no dashboard you can reach, a scene-to-PNG bake needs a
browser it may not be allowed to fetch, and it is gone when the session ends, so ask for the bundle
(one zip: world.html, mesh, print STL for literal-scale objects, recipe.json, README) and keep
the recipe. A box with no MCP client never sends initialize, so tell the agent to run
npx mojulo orient first: it prints what an MCP client is handed at connect, translated to the
shell, and points at the routing index. Claude's box built a 47-part phone at true scale this way and handed back the glTF;
Grok chat's sandbox minted a city from the shell. Blender installs in those boxes too.
On your machine: macOS, Windows, Linux. npx mojulo init wires mojulo into the agents it finds,
opens the dashboard at localhost:3001, keeps everything under ~/.mojulo/, and probes your PATH for
the optional local workers (Blender, a slicer, OpenSCAD, the game engines). This is the whole loop, and
where a recipe from a box comes home to.
Who has run it where. persistent (your machine;
~/.mojulo/ stays) · ephemeral (the web
agent's throwaway Linux box; keep the recipe). Blank means not verified yet, not "does not work".
| agent | macOS | Windows | Web Agent Linux Box (Headless) |
|---|---|---|---|
| Claude Code | |||
| Claude app (macOS, Windows, web, iOS) | |||
| ChatGPT (work mode; Codex) | |||
| Hermes Agent | |||
| Grok (Build; chat) | |||
| Meta Muse (iOS, web, macOS app; one session across them) |
Three add-ons, the same choice in both places:
| add | with | what you get |
|---|---|---|
| creative (on by default) | plain npm install | worlds, audio, wordmark fonts, exact booleans, OpenSCAD in-process, sharp for skins and sprite sheets. npm install --omit=optional sheds it; the kernel still mints diagrams, floorplans and workbench solids and exports GLB and STL. |
| recall | mojulo install recall | the embedding model behind semantic_search. Without it, search still answers by the words in your ask, and most sessions never need more: the agent reads the tool index and the vocab cards directly. About 480 MB plus a 130 MB model, kept under ~/.mojulo/ across upgrades. |
| chatbot | mojulo install chatbot | the bot factory: build, deploy and operate chatbots. Needs an LLM key of its own and Docker for the default deploy, so it is for your machine, not a temporary box. Installs recall first. |
mojulo install with no argument prints which are present.
Iterate in place — update_sketch changes a field on the stored recipe; nothing is re-minted — and keep what you tuned: save_recipe writes it to a cookbook of plain files in a local git repo with no remote, recallable by intent in a later session. Attach the public recipe book to add chapters and whole new kinds from disk.
Also in the box, present by default and never in the way: diagrams and charts, directed images an external model paints, publications, research, plans, local apps whose inference parks back on your agent, and connected services over the MCPs you already run. The chatbot factory is opt-in.
mojulo install recall) and the chatbot factory (mojulo install chatbot) are opt-in. Uninstalled packs neither list nor run, so your agent's context isn't spent on tools this host doesn't have.npx -y -p mojulo mojulo-ui # auto-port, opens browser
npx -y -p mojulo mojulo-ui --port 3999 # pin the port
npx -y -p mojulo mojulo-ui --no-open # skip browser launch
Same primitives as the MCP, different face: Studio leads and opens by default — browse the Library, walk your worlds, play your games in the Arcade, review motion, beats, and voice at a glance — with Ideate (research, plans, stashes) beside it and Operate tiles appearing only once something actually runs there. It renders state and hands authoring back to your agent — the workshop is driven from the conversation.
The dashboard starts in English but ships fully translated in every locale under messages/, including right-to-left scripts — switch anytime under Settings → Language; the choice is remembered per browser.
The five paradigm loops (media · game · connected service · app · bot) and the recipe format are the stable surface: additive-only DB migrations, deterministic re-render of stored recipes, loopback-only transport. A kernel's output for given params is a compatibility promise over already-minted rows. The creative vocabularies keep growing in minor releases. See the changelog.
FAQs
Mojulo — a 3D compiler for coding agents: an MCP server that runs wherever your agent runs, on your machine or in the throwaway Linux box it gives itself (the Claude app or web, ChatGPT work mode with Codex, Grok chat, Meta Muse), where you build worlds,
The npm package mojulo receives a total of 844 weekly downloads. As such, mojulo popularity was classified as not popular.
We found that mojulo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.