
Security News
Lovable’s OJ Rewrites Vite’s Dev Server in Rust as AI Lowers the Cost of Forking Open Source
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.
MCP server that builds and proves 3D assets: checks any GLB against a spec without Blender, OCCT b-rep CAD, and embeds the measured certificate inside the GLB.
3D tooling where every asset carries its own proof.
Rupa3D builds 3D — exact b-rep CAD (OpenCascade), meshes (headless Blender),
and scenes with physics (three.js + Rapier) — and then measures what it
built against closed-form references or independent measurements. The
measurements travel with the asset: a certificate embedded in the GLB at
asset.extras.rupa3d, readable with a few lines of code and no Rupa3D
installed.
It is designed to be driven by AI agents over MCP, and by CI over a command-line gate.
Status — 1.6.2 · 297 tests · MIT · on npm as
rupa3d· in the official MCP Registry asio.github.tiranyx/rupa3d. Developed and tested on Windows 11 with Node 22. Tool descriptions and messages are still in Indonesian.
claude mcp add rupa3d -- npx -y rupa3d
Or in any MCP client configuration:
{ "mcpServers": { "rupa3d": { "command": "npx", "args": ["-y", "rupa3d"] } } }
Requires Node ≥ 22.14. Workspaces live in ~/.rupa3d; override with
RUPA3D_RUANG.
Blender is optional. 23 of the 36 tools run without it:
| without Blender | tools |
|---|---|
| Check any GLB against a spec; the certificate is embedded in a copy of the file | rupa_periksa with berkas |
| Triangle topology, texel density (pixels per metre), VRAM per texture format | rupa_topologi, rupa_tekstur |
| Convex collision hull, with how far it misses the shape | rupa_proksi |
| Exact b-rep CAD: primitives, booleans, fillets, 2D sketch → solid, exact volume and area, STEP/IGES/STL/GLB export | rupa_cad_* (11 tools) |
| three.js scenes with Rapier physics, published as a single HTML page | rupa_adegan_* (8 tools) |
The other 13 drive headless Blender — bpy modeling, import (GLB, OBJ, FBX,
STL, PLY, SVG), renders, LOD, baking, collision proxies, source-mesh
topology. Blender is found under C:\Program Files\Blender Foundation\*, at
RUPA3D_BLENDER, or as blender on PATH.
Every number below comes from the test suite or the documentation in this repository.
eksak)
and by how much the approximation misses.ok: true is not accepted as proof. A fillet larger than
half the smallest edge came back ok with a broken solid whose volume grew
by 1,971 mm³ on a 6,000 mm³ box. Independent checks reject it.npx -p rupa3d rupa periksa model.glb
Exit code 0 — passes every required rule. 1 — fails a required rule (fix
the asset). 2 — could not be checked (fix the tool or the input).
--json for machine output, --spek for another spec, --tempel to write a
certified copy.
npm install
npm test
297 tests run against real Blender, OpenCascade and Rapier — not mocks — and
one suite talks to the server over real MCP stdio, including from a foreign
working directory the way an MCP client launches it. Tests that need a local
asset are skipped with the reason and how to obtain it; node contoh/flange-cad.mjs rebuilds the flange fixture in about 40 seconds without
Blender.
rupa_skrip runs arbitrary bpy Python inside Blender. That is the
modeling capability, not a bug — but do not expose the server to untrusted
input over a network.MIT. Dependencies keep their own licenses — notably brepjs-opencascade
(LGPL-2.1-only). The scripts in bpy/ run inside Blender.
| docs/INTEGRASI.md | using Rupa3D from outside: library, MCP server, and reading the certificate without installing anything |
| docs/SERTIFIKAT.md | specs and certificates |
| docs/BERKAS.md | checking other people's GLB files without Blender |
| docs/CAD-MCP.md · docs/SKETSA.md · docs/TAHAP-B-BREP.md | b-rep CAD over MCP, and 2D sketch → solid |
| docs/FISIKA.md · docs/ADEGAN.md | physics, scenes and the web runtime |
| docs/TOPOLOGI.md · docs/TEKSTUR.md · docs/DRACO.md | topology, textures, compressed files |
| docs/PERAKIT.md · docs/OPTIMASI.md | the one-call asset pipeline, and performance |
| CHANGELOG.md | every release — including a Terbongkar ("exposed") section for what broke, measuring tools included |
FAQs
MCP server that builds and proves 3D assets: checks any GLB against a spec without Blender, OCCT b-rep CAD, and embeds the measured certificate inside the GLB.
The npm package rupa3d receives a total of 60 weekly downloads. As such, rupa3d popularity was classified as not popular.
We found that rupa3d demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Lovable’s OJ rewrites Vite’s dev server in Rust, reducing memory use and preview times as AI lowers the cost of open source reimplementation.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.