
Security News
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.
threejs-devtools-mcp
Advanced tools
Three.js MCP server — inspect and edit scenes, materials, shaders, lights in real time from any AI agent
MCP server for inspecting and modifying Three.js scenes in real time — 52 tools for objects, materials, shaders, textures, animations, performance monitoring, memory diagnostics, and code generation.
Zero changes to your project. Works with vanilla Three.js, React Three Fiber, and any framework.

claude mcp add threejs-devtools-mcp -- npx threejs-devtools-mcp
Add to claude_desktop_config.json:
{
"mcpServers": {
"threejs-devtools-mcp": {
"command": "npx",
"args": ["-y", "threejs-devtools-mcp"]
}
}
}
Add to .cursor/mcp.json in your project:
{
"mcpServers": {
"threejs-devtools-mcp": {
"command": "npx",
"args": ["-y", "threejs-devtools-mcp"]
}
}
}
Or use the HTTP transport — see Cursor setup guide.
Add to ~/.codeium/windsurf/mcp_config.json:
{
"mcpServers": {
"threejs-devtools-mcp": {
"command": "npx",
"args": ["-y", "threejs-devtools-mcp"]
}
}
}
Add to .vscode/mcp.json:
{
"servers": {
"threejs-devtools-mcp": {
"command": "npx",
"args": ["-y", "threejs-devtools-mcp"]
}
}
}
Start your Three.js dev server as usual (npm run dev). The MCP server auto-detects the port from package.json and opens a browser at localhost:9222 with the devtools bridge injected.
Keep the browser tab open. The MCP server talks to your scene through a WebSocket bridge. Close the tab = tools stop working.
"show me the scene tree"
"why is my model invisible?"
"make the car red"
"check for memory leaks"
"what's my FPS?"
"generate a React component from character.glb"
A built-in devtools panel with live performance stats, interactive scene graph, material editor, and 3D object preview. Activated automatically or via the toggle_overlay tool.

Unnamed objects show as (unnamed) in the scene tree. Named objects are easier to find and modify:
// Three.js
mesh.name = "player";
// React Three Fiber
<mesh name="player" geometry={geometry} material={material} />
MIT
FAQs
Three.js MCP server — inspect and edit scenes, materials, shaders, lights in real time from any AI agent
The npm package threejs-devtools-mcp receives a total of 228 weekly downloads. As such, threejs-devtools-mcp popularity was classified as not popular.
We found that threejs-devtools-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.