blenderwright 2.1.0__tar.gz → 2.2.0__tar.gz

{blenderwright-2.1.0 → blenderwright-2.2.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: blenderwright
-Version: 2.1.0
+Version: 2.2.0
 Summary: The most intuitive and efficient MCP Server for Blender
 License-Expression: MIT
 License-File: LICENSE.md
@@ -49,7 +49,7 @@ The most intuitive and efficient MCP Server for Blender. Control Blender entirel
 - **Visual feedback loop**: fast viewport screenshots via OpenGL render (~ms, not seconds) with auto-critique prompts that guide the LLM to check its own work
 - **Mesh quality analysis**: structured reports covering non-manifold edges, loose vertices, zero-area faces, duplicate vertices, and wire edges
 - **Extension suggestions**: proactively recommends Bool Tool, LoopTools, and Node Wrangler when a task would benefit from them (skips already-installed extensions)
-- **Sandboxed code execution**: `execute_blender_code` blocks dangerous imports (`os`, `subprocess`, `socket`, etc.) and dangerous builtins (`exec`, `eval`, `open`) while allowing safe Blender operations
+- **Raw Python is opt-in**: `execute_blender_code` is off until you tick "Allow raw Python" in the N-panel, per session, never saved into the .blend. When on, every snippet is echoed to the console and listed in the panel. A restricted namespace blocks obvious mistakes (`os`, `subprocess`, `exec`, `open`, ...); it is a guard against accidents, not a security boundary
 - **Render-aware**: automatically detects when Blender is rendering and queues commands. Recovers from stuck render guards via `load_post` handler and reset command
 - **Blender 4.2+ compatible**: ships as a Blender Extension; tested against Blender 5.1 with EEVEE identifier, Annotation API, sculpt stroke_method, SLIM UV unwrap, Raycast shader node, and EEVEE light path intensity controls
 - **Custom port**: configure the server port from the N-panel UI (default: 9876, range: 1024–65535)
@@ -349,7 +349,8 @@ AI Assistant <--stdio/MCP--> blenderwright server <--TCP socket--> Blender addon
 <summary><strong>Security</strong></summary>
 
 - **Localhost only**: The TCP socket binds to `127.0.0.1`, never exposed to the network.
-- **Sandboxed code execution**: `execute_blender_code` blocks 25 dangerous imports (`os`, `subprocess`, `socket`, `shutil`, `sys`, `ctypes`, `importlib`, `pathlib`, `signal`, `multiprocessing`, `pickle`, `shelve`, `tempfile`, `http`, `urllib`, `ftplib`, `smtplib`, `xmlrpc`, `code`, `codeop`, `compileall`, `webbrowser`, `antigravity`, `turtle`, `tkinter`) and removes dangerous builtins (`__import__`, `exec`, `eval`, `compile`, `open`, `globals`, `locals`, `vars`, `input`, `breakpoint`, `exit`, `quit`, `help`, `memoryview`). Safe Blender imports (`bpy`, `bmesh`, `mathutils`, `math`, `json`) are allowed.
+- **Raw Python is off by default**: `execute_blender_code` refuses to run until you tick "Allow raw Python" in the blenderwright N-panel. The switch is a `WindowManager` property, so it is per Blender session and is never written into a `.blend` file. Every run is echoed to the system console and the panel shows a count and the last snippet. The 191 structured tools do not need it.
+- **The restricted namespace is not a sandbox**: when raw Python is on, the import hook refuses 25 imports (`os`, `subprocess`, `socket`, `shutil`, `sys`, `ctypes`, `importlib`, `pathlib`, `signal`, `multiprocessing`, `pickle`, `shelve`, `tempfile`, `http`, `urllib`, `ftplib`, `smtplib`, `xmlrpc`, `code`, `codeop`, `compileall`, `webbrowser`, `antigravity`, `turtle`, `tkinter`) and the builtins `__import__`, `exec`, `eval`, `compile`, `open`, `globals`, `locals`, `vars`, `input`, `breakpoint`, `exit`, `quit`, `help` and `memoryview` are removed. That catches a model making a mistake. It does not contain an adversary: the code runs in-process with full `bpy`, and `bpy` alone can save files anywhere and run any operator. Treat "Allow raw Python" the way you would treat running a script someone else wrote: read what the model is about to run, and turn it off when you are done.
 - **Input validation**: All inputs pass through validators before reaching Blender: name sanitization, path traversal prevention, numeric range checks, enum allowlists.
 - **File safety**: Import operations disable `use_scripts_auto_execute` to prevent script injection from imported files. File extensions are checked against allowlists.
 - **Command allowlist**: The addon dispatcher only processes explicitly registered commands. Unknown commands are rejected.

{blenderwright-2.1.0 → blenderwright-2.2.0}/README.md

@@ -31,7 +31,7 @@ The most intuitive and efficient MCP Server for Blender. Control Blender entirel
 - **Visual feedback loop**: fast viewport screenshots via OpenGL render (~ms, not seconds) with auto-critique prompts that guide the LLM to check its own work
 - **Mesh quality analysis**: structured reports covering non-manifold edges, loose vertices, zero-area faces, duplicate vertices, and wire edges
 - **Extension suggestions**: proactively recommends Bool Tool, LoopTools, and Node Wrangler when a task would benefit from them (skips already-installed extensions)
-- **Sandboxed code execution**: `execute_blender_code` blocks dangerous imports (`os`, `subprocess`, `socket`, etc.) and dangerous builtins (`exec`, `eval`, `open`) while allowing safe Blender operations
+- **Raw Python is opt-in**: `execute_blender_code` is off until you tick "Allow raw Python" in the N-panel, per session, never saved into the .blend. When on, every snippet is echoed to the console and listed in the panel. A restricted namespace blocks obvious mistakes (`os`, `subprocess`, `exec`, `open`, ...); it is a guard against accidents, not a security boundary
 - **Render-aware**: automatically detects when Blender is rendering and queues commands. Recovers from stuck render guards via `load_post` handler and reset command
 - **Blender 4.2+ compatible**: ships as a Blender Extension; tested against Blender 5.1 with EEVEE identifier, Annotation API, sculpt stroke_method, SLIM UV unwrap, Raycast shader node, and EEVEE light path intensity controls
 - **Custom port**: configure the server port from the N-panel UI (default: 9876, range: 1024–65535)
@@ -331,7 +331,8 @@ AI Assistant <--stdio/MCP--> blenderwright server <--TCP socket--> Blender addon
 <summary><strong>Security</strong></summary>
 
 - **Localhost only**: The TCP socket binds to `127.0.0.1`, never exposed to the network.
-- **Sandboxed code execution**: `execute_blender_code` blocks 25 dangerous imports (`os`, `subprocess`, `socket`, `shutil`, `sys`, `ctypes`, `importlib`, `pathlib`, `signal`, `multiprocessing`, `pickle`, `shelve`, `tempfile`, `http`, `urllib`, `ftplib`, `smtplib`, `xmlrpc`, `code`, `codeop`, `compileall`, `webbrowser`, `antigravity`, `turtle`, `tkinter`) and removes dangerous builtins (`__import__`, `exec`, `eval`, `compile`, `open`, `globals`, `locals`, `vars`, `input`, `breakpoint`, `exit`, `quit`, `help`, `memoryview`). Safe Blender imports (`bpy`, `bmesh`, `mathutils`, `math`, `json`) are allowed.
+- **Raw Python is off by default**: `execute_blender_code` refuses to run until you tick "Allow raw Python" in the blenderwright N-panel. The switch is a `WindowManager` property, so it is per Blender session and is never written into a `.blend` file. Every run is echoed to the system console and the panel shows a count and the last snippet. The 191 structured tools do not need it.
+- **The restricted namespace is not a sandbox**: when raw Python is on, the import hook refuses 25 imports (`os`, `subprocess`, `socket`, `shutil`, `sys`, `ctypes`, `importlib`, `pathlib`, `signal`, `multiprocessing`, `pickle`, `shelve`, `tempfile`, `http`, `urllib`, `ftplib`, `smtplib`, `xmlrpc`, `code`, `codeop`, `compileall`, `webbrowser`, `antigravity`, `turtle`, `tkinter`) and the builtins `__import__`, `exec`, `eval`, `compile`, `open`, `globals`, `locals`, `vars`, `input`, `breakpoint`, `exit`, `quit`, `help` and `memoryview` are removed. That catches a model making a mistake. It does not contain an adversary: the code runs in-process with full `bpy`, and `bpy` alone can save files anywhere and run any operator. Treat "Allow raw Python" the way you would treat running a script someone else wrote: read what the model is about to run, and turn it off when you are done.
 - **Input validation**: All inputs pass through validators before reaching Blender: name sanitization, path traversal prevention, numeric range checks, enum allowlists.
 - **File safety**: Import operations disable `use_scripts_auto_execute` to prevent script injection from imported files. File extensions are checked against allowlists.
 - **Command allowlist**: The addon dispatcher only processes explicitly registered commands. Unknown commands are rejected.

{blenderwright-2.1.0 → blenderwright-2.2.0}/addon/__init__.py

@@ -8,7 +8,7 @@ Blender's Python API.
 bl_info = {
     "name": "blenderwright",
     "author": "blenderwright",
-    "version": (2, 1, 0),
+    "version": (2, 2, 0),
     "blender": (4, 2, 0),
     "location": "View3D > Sidebar > blenderwright",
     "description": "MCP Server integration for AI-assisted 3D workflows",

{blenderwright-2.1.0 → blenderwright-2.2.0}/addon/blender_manifest.toml

@@ -1,7 +1,7 @@
 schema_version = "1.0.0"
 
 id = "blenderwright"
-version = "2.1.0"
+version = "2.2.0"
 name = "blenderwright"
 tagline = "MCP server integration for AI-assisted 3D workflows"
 maintainer = "jabberwock <88205+jabberwock@users.noreply.github.com>"

blenderwright-2.2.0/addon/handlers/code_exec.py

@@ -0,0 +1,176 @@
+"""Blender addon handler for raw Python execution (off by default).
+
+What this is: a restricted namespace that blocks the obvious footguns
+(import os/subprocess/socket..., exec/eval/open/compile) so a model
+that makes a mistake fails loudly instead of touching the filesystem
+or the network by accident.
+
+What this is NOT: a security boundary. The code runs in-process inside
+Blender with full `bpy`, and `bpy` alone can save files anywhere and
+run any operator. A denylist cannot contain a determined adversary in
+the same interpreter, and this module does not claim to.
+
+So the real control is the switch, not the list:
+
+- `execute_code` is refused unless the user has ticked "Allow raw
+  Python" in the blenderwright N-panel. The flag lives on
+  `bpy.types.WindowManager`, so it is per session and is never saved
+  into a .blend file that could be handed to someone else.
+- Every snippet that runs is echoed to the system console and kept in
+  a short log that the panel displays, so the user can see what the
+  model actually did.
+"""
+
+import sys
+import io
+import time
+from collections import deque
+from .. import dispatcher
+
+
+# Name of the per-session switch registered on bpy.types.WindowManager
+# by ui_panel.register(). Not a Scene property on purpose: Scene props
+# are written into the .blend.
+SWITCH_PROP = "blenderwright_allow_code_exec"
+
+# How many recent runs the panel can show.
+EXEC_LOG_SIZE = 20
+_exec_log: deque = deque(maxlen=EXEC_LOG_SIZE)
+
+
+def is_enabled() -> bool:
+    """True only if the user turned raw Python on for this Blender session.
+
+    Anything other than a real `True` (missing property, wrong type, no
+    window manager yet, bpy not importable) counts as off.
+    """
+    try:
+        import bpy
+        flag = getattr(bpy.context.window_manager, SWITCH_PROP, False)
+    except Exception:
+        return False
+    return isinstance(flag, bool) and flag
+
+
+def get_exec_log() -> list:
+    """Copy of the recent-run log, oldest first."""
+    return list(_exec_log)
+
+
+def _record(code: str, ok: bool) -> None:
+    lines = code.strip().splitlines() or [""]
+    _exec_log.append({
+        "time": time.strftime("%H:%M:%S"),
+        "first_line": lines[0].strip(),
+        "lines": len(lines),
+        "ok": ok,
+    })
+
+
+# Modules refused by the import hook. A guard against accidental misuse by
+# the model, not a security control: see the module docstring.
+BLOCKED_MODULES = frozenset({
+    "os", "subprocess", "socket", "shutil", "sys", "ctypes",
+    "importlib", "pathlib", "signal", "multiprocessing",
+    "pickle", "shelve", "tempfile", "http", "urllib", "ftplib",
+    "smtplib", "xmlrpc", "code", "codeop", "compileall",
+    "webbrowser", "antigravity", "turtle", "tkinter",
+})
+
+# Builtins removed from the restricted namespace. Same caveat as above.
+_REMOVED_BUILTINS = frozenset({
+    "__import__", "exec", "eval", "compile", "open",
+    "globals", "locals", "vars", "input", "breakpoint",
+    "exit", "quit", "help", "memoryview",
+})
+
+# Reference to the real __import__ for the safe import hook
+_real_import = builtins_import = __builtins__.__import__ if hasattr(
+    __builtins__, "__import__"
+) else __builtins__["__import__"] if isinstance(__builtins__, dict) else __import__
+
+
+def _safe_import(name, *args, **kwargs):
+    """Import hook that refuses the modules in BLOCKED_MODULES."""
+    base_module = name.split(".")[0]
+    if base_module in BLOCKED_MODULES:
+        raise ImportError(
+            f"Module '{name}' is blocked inside execute_blender_code. "
+            f"Use the structured MCP tools instead of direct Python imports."
+        )
+    return _real_import(name, *args, **kwargs)
+
+
+def _build_safe_builtins():
+    """Build the restricted builtins dict."""
+    # Get all builtins as a dict
+    if isinstance(__builtins__, dict):
+        raw = dict(__builtins__)
+    else:
+        raw = {k: getattr(__builtins__, k) for k in dir(__builtins__)}
+
+    # Remove dangerous builtins
+    safe = {k: v for k, v in raw.items() if k not in _REMOVED_BUILTINS}
+
+    # Add our safe import hook
+    safe["__import__"] = _safe_import
+
+    return safe
+
+
+# Build once at module load
+SAFE_BUILTINS = _build_safe_builtins()
+
+
+def handle_execute_code(params: dict) -> dict:
+    """Run Python inside Blender, if the user has allowed it this session.
+
+    - Refuses with PermissionError while "Allow raw Python" is unticked.
+    - Echoes the snippet to the system console (stderr) and records it
+      in the exec log before running it.
+    - Runs in the restricted namespace (see module docstring for what
+      that does and does not mean) and captures stdout.
+    """
+    code = params.get("code", "")
+    if not code:
+        raise ValueError("No code provided")
+
+    if not is_enabled():
+        raise PermissionError(
+            "execute_blender_code is disabled. Raw Python is off by default; "
+            "tick 'Allow raw Python' in the blenderwright panel "
+            "(View3D > Sidebar > blenderwright) to enable it for this Blender "
+            "session, or use the structured tools instead."
+        )
+
+    # Echo to the real console so the user can see what ran, regardless
+    # of whether the MCP client shows tool inputs. Goes to stderr so it
+    # is never mixed into the captured stdout returned to the model.
+    print(
+        f"[blenderwright] execute_code ({time.strftime('%H:%M:%S')}):\n{code}",
+        file=sys.stderr,
+    )
+
+    # Capture stdout
+    old_stdout = sys.stdout
+    sys.stdout = buffer = io.StringIO()
+
+    try:
+        exec(code, {"__builtins__": SAFE_BUILTINS})
+        output = buffer.getvalue()
+        _record(code, ok=True)
+        return {
+            "output": output.strip(),
+            "success": True,
+        }
+    except Exception as e:
+        output = buffer.getvalue()
+        _record(code, ok=False)
+        raise RuntimeError(f"{type(e).__name__}: {e}\nOutput before error: {output}")
+    finally:
+        sys.stdout = old_stdout
+
+
+def register():
+    """Register code execution handler with the dispatcher."""
+    dispatcher.register_handler("execute_code", handle_execute_code)

{blenderwright-2.1.0 → blenderwright-2.2.0}/addon/ui_panel.py

@@ -3,6 +3,7 @@
 import bpy
 
 from . import server as addon_server
+from .handlers import code_exec
 
 
 class BLENDERWRIGHT_PT_MainPanel(bpy.types.Panel):
@@ -26,6 +27,23 @@ class BLENDERWRIGHT_PT_MainPanel(bpy.types.Panel):
             layout.prop(context.scene, "blenderwright_port", text="Port")
             layout.operator("blenderwright.start_server", text="Start Server", icon="PLAY")
 
+        # Raw Python switch: per session, never saved into the .blend.
+        box = layout.box()
+        wm = context.window_manager
+        box.prop(wm, code_exec.SWITCH_PROP, text="Allow raw Python")
+        if getattr(wm, code_exec.SWITCH_PROP, False):
+            box.label(text="Model may run Python in this session", icon="ERROR")
+            log = code_exec.get_exec_log()
+            if log:
+                last = log[-1]
+                status = "ok" if last["ok"] else "failed"
+                box.label(text=f"{len(log)} run(s), last {last['time']} ({status}):")
+                box.label(text=f"  {last['first_line'][:48]}")
+            else:
+                box.label(text="No runs yet this session")
+        else:
+            box.label(text="execute_blender_code is off", icon="LOCKED")
+
 
 class BLENDERWRIGHT_OT_StartServer(bpy.types.Operator):
     """Start the blenderwright MCP server"""
@@ -69,10 +87,26 @@ def register():
         max=65535,
     )
 
+    # WindowManager, not Scene: WindowManager properties are not written
+    # into the .blend, so the switch cannot travel with a file and is
+    # always off when Blender starts.
+    setattr(bpy.types.WindowManager, code_exec.SWITCH_PROP, bpy.props.BoolProperty(
+        name="Allow raw Python",
+        description=(
+            "Let execute_blender_code run model-written Python in this Blender "
+            "session. Off by default. The restricted namespace blocks obvious "
+            "mistakes but is not a security boundary: bpy itself can write files "
+            "and run any operator. Every run is echoed to the system console"
+        ),
+        default=False,
+    ))
+
 
 def unregister():
     if hasattr(bpy.types.Scene, "blenderwright_port"):
         del bpy.types.Scene.blenderwright_port
+    if hasattr(bpy.types.WindowManager, code_exec.SWITCH_PROP):
+        delattr(bpy.types.WindowManager, code_exec.SWITCH_PROP)
 
     for cls in reversed(classes):
         bpy.utils.unregister_class(cls)

{blenderwright-2.1.0 → blenderwright-2.2.0}/docs/index.html

@@ -261,15 +261,31 @@ boolean modifier (a warning will be included in the response).</p><table class="
 <tr><th>location</th><td>XYZ location to point at as [x, y, z]. Mutually exclusive with target.</td></tr></tbody></table><p class="ret"><span>Returns</span> Confirmation dict.</p></article><article class="tool" id="set_active_camera" data-search="set_active_camera set the active scene camera."><h3><a href="#set_active_camera">set_active_camera</a></h3><pre class="sig"><code>set_active_camera(object_name: str)</code></pre><p>Set the active scene camera.</p><table class="args"><tbody><tr><th>object_name</th><td>Name of the camera object to make active.</td></tr></tbody></table><p class="ret"><span>Returns</span> Confirmation dict.</p></article><article class="tool" id="set_camera_from_view" data-search="set_camera_from_view match the active camera to the current 3d viewport view."><h3><a href="#set_camera_from_view">set_camera_from_view</a></h3><pre class="sig"><code>set_camera_from_view()</code></pre><p>Match the active camera to the current 3D viewport view.</p><p class="ret"><span>Returns</span> Confirmation dict with the camera&#x27;s new location and rotation.</p></article><article class="tool" id="set_camera_property" data-search="set_camera_property set a property on a camera."><h3><a href="#set_camera_property">set_camera_property</a></h3><pre class="sig"><code>set_camera_property(object_name: str, property: str, value: Any)</code></pre><p>Set a property on a camera.</p><table class="args"><tbody><tr><th>object_name</th><td>Name of the camera object.</td></tr>
 <tr><th>property</th><td>Property to set. One of: lens, clip_start, clip_end, sensor_width, sensor_height, dof.use_dof, dof.focus_distance, dof.aperture_fstop, ortho_scale, shift_x, shift_y, type, sensor_fit.</td></tr>
 <tr><th>value</th><td>The value to set.</td></tr></tbody></table><p class="ret"><span>Returns</span> Confirmation dict.</p></article></section>
-<section class="module" id="code_exec" data-module="code execution"><h2>Code Execution <span class="n">1</span></h2><article class="tool" id="execute_blender_code" data-search="execute_blender_code execute python code inside blender&#x27;s sandboxed environment.
-
-the code runs in a restricted sandbox that blocks dangerous imports
-(os, subprocess, socket, etc.) and dangerous builtins (exec, eval, open).
-safe blender imports (bpy, bmesh, mathutils, math, json) are allowed."><h3><a href="#execute_blender_code">execute_blender_code</a></h3><pre class="sig"><code>execute_blender_code(code: str)</code></pre><p>Execute Python code inside Blender&#x27;s sandboxed environment.
-
-The code runs in a restricted sandbox that blocks dangerous imports
-(os, subprocess, socket, etc.) and dangerous builtins (exec, eval, open).
-Safe Blender imports (bpy, bmesh, mathutils, math, json) are allowed.</p><table class="args"><tbody><tr><th>code</th><td>Python code to execute. bpy is available but must be imported.</td></tr></tbody></table><p class="ret"><span>Returns</span> Dict with &#x27;output&#x27; (captured stdout) and &#x27;success&#x27; boolean.</p></article></section>
+<section class="module" id="code_exec" data-module="code execution"><h2>Code Execution <span class="n">1</span></h2><article class="tool" id="execute_blender_code" data-search="execute_blender_code run python inside blender. off by default; prefer the structured tools.
+
+the user must tick &quot;allow raw python&quot; in the blenderwright n-panel
+(view3d &gt; sidebar &gt; blenderwright) for the current blender session.
+until they do, this tool returns an error saying so; relay that to the
+user and do not retry. never ask the user to enable it just to do
+something a structured tool already covers.
+
+the code runs in a restricted namespace that blocks obvious mistakes
+(import os/subprocess/socket, exec/eval/open/compile). that is a guard
+against accidents, not a security boundary: the code runs in-process
+with full bpy. every snippet is echoed to blender&#x27;s system console and
+listed in the panel so the user can see what ran."><h3><a href="#execute_blender_code">execute_blender_code</a></h3><pre class="sig"><code>execute_blender_code(code: str)</code></pre><p>Run Python inside Blender. OFF BY DEFAULT; prefer the structured tools.
+
+The user must tick &quot;Allow raw Python&quot; in the blenderwright N-panel
+(View3D &gt; Sidebar &gt; blenderwright) for the current Blender session.
+Until they do, this tool returns an error saying so; relay that to the
+user and do not retry. Never ask the user to enable it just to do
+something a structured tool already covers.
+
+The code runs in a restricted namespace that blocks obvious mistakes
+(import os/subprocess/socket, exec/eval/open/compile). That is a guard
+against accidents, not a security boundary: the code runs in-process
+with full bpy. Every snippet is echoed to Blender&#x27;s system console and
+listed in the panel so the user can see what ran.</p><table class="args"><tbody><tr><th>code</th><td>Python code to execute. bpy is available but must be imported.</td></tr></tbody></table><p class="ret"><span>Returns</span> Dict with &#x27;output&#x27; (captured stdout) and &#x27;success&#x27; boolean.</p></article></section>
 <section class="module" id="collections" data-module="collections"><h2>Collections <span class="n">4</span></h2><article class="tool" id="create_collection" data-search="create_collection create a new collection, optionally nested under a parent collection."><h3><a href="#create_collection">create_collection</a></h3><pre class="sig"><code>create_collection(name: str, parent: str = &#x27;&#x27;)</code></pre><p>Create a new collection, optionally nested under a parent collection.</p><table class="args"><tbody><tr><th>name</th><td>Name for the new collection.</td></tr>
 <tr><th>parent</th><td>Optional name of parent collection to nest under. Empty string uses the scene&#x27;s root collection.</td></tr></tbody></table><p class="ret"><span>Returns</span> Dict with the created collection&#x27;s name and parent.</p></article><article class="tool" id="delete_collection" data-search="delete_collection delete a collection."><h3><a href="#delete_collection">delete_collection</a></h3><pre class="sig"><code>delete_collection(collection_name: str, delete_objects: bool = False)</code></pre><p>Delete a collection.</p><table class="args"><tbody><tr><th>collection_name</th><td>Name of the collection to delete.</td></tr>
 <tr><th>delete_objects</th><td>If True, also delete all objects in the collection. If False, objects are unlinked but kept in the scene.</td></tr></tbody></table><p class="ret"><span>Returns</span> Confirmation dict.</p></article><article class="tool" id="move_to_collection" data-search="move_to_collection move objects to a collection, unlinking them from their current collections."><h3><a href="#move_to_collection">move_to_collection</a></h3><pre class="sig"><code>move_to_collection(object_names: list[str], collection_name: str)</code></pre><p>Move objects to a collection, unlinking them from their current collections.</p><table class="args"><tbody><tr><th>object_names</th><td>List of object names to move.</td></tr>

{blenderwright-2.1.0 → blenderwright-2.2.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "blenderwright"
-version = "2.1.0"
+version = "2.2.0"
 description = "The most intuitive and efficient MCP Server for Blender"
 readme = "README.md"
 requires-python = ">=3.10"

blenderwright-2.2.0/src/blenderwright/tools/code_exec.py

@@ -0,0 +1,39 @@
+"""MCP tool for running raw Python inside Blender. Off by default."""
+
+from typing import Any
+
+from blenderwright.server import mcp, get_connection
+
+
+@mcp.tool()
+def execute_blender_code(
+    code: str,
+) -> dict[str, Any]:
+    """Run Python inside Blender. OFF BY DEFAULT; prefer the structured tools.
+
+    The user must tick "Allow raw Python" in the blenderwright N-panel
+    (View3D > Sidebar > blenderwright) for the current Blender session.
+    Until they do, this tool returns an error saying so; relay that to the
+    user and do not retry. Never ask the user to enable it just to do
+    something a structured tool already covers.
+
+    The code runs in a restricted namespace that blocks obvious mistakes
+    (import os/subprocess/socket, exec/eval/open/compile). That is a guard
+    against accidents, not a security boundary: the code runs in-process
+    with full bpy. Every snippet is echoed to Blender's system console and
+    listed in the panel so the user can see what ran.
+
+    Args:
+        code: Python code to execute. bpy is available but must be imported.
+
+    Returns:
+        Dict with 'output' (captured stdout) and 'success' boolean.
+    """
+    if not code or not code.strip():
+        raise ValueError("No code provided")
+
+    conn = get_connection()
+    response = conn.send_command("execute_code", {"code": code})
+    if response.get("status") == "error":
+        raise RuntimeError(f"Blender error: {response.get('result')}")
+    return response.get("result")

{blenderwright-2.1.0 → blenderwright-2.2.0}/tests/test_addon/test_handlers/test_code_exec_handler.py

@@ -35,6 +35,20 @@ def code_exec_handler():
     return mod
 
 
+@pytest.fixture(autouse=True)
+def raw_python_enabled(code_exec_handler):
+    """Turn the per-session switch on for the sandbox tests below.
+
+    The switch lives on bpy.types.WindowManager so it is never saved into a
+    .blend. The mock bpy would otherwise return a truthy MagicMock, so the
+    handler must only honour a real bool True; set it explicitly here.
+    """
+    import bpy
+    bpy.context.window_manager.blenderwright_allow_code_exec = True
+    yield
+    bpy.context.window_manager.blenderwright_allow_code_exec = False
+
+
 class TestSandboxBlocksDangerousImports:
     """Verify that dangerous modules are blocked."""
 
@@ -187,3 +201,88 @@ class TestSandboxConstants:
     def test_blocked_modules_is_set(self, code_exec_handler):
         """BLOCKED_MODULES is a set (for O(1) lookup)."""
         assert isinstance(code_exec_handler.BLOCKED_MODULES, (set, frozenset))
+
+
+class TestRawPythonIsOffByDefault:
+    """execute_code refuses unless the user ticked the box this session."""
+
+    def test_disabled_when_switch_is_false(self, code_exec_handler):
+        import bpy
+        bpy.context.window_manager.blenderwright_allow_code_exec = False
+        with pytest.raises(PermissionError, match="(?i)disabled|Allow raw Python"):
+            code_exec_handler.handle_execute_code({"code": "print('x')"})
+
+    def test_disabled_when_switch_is_missing(self, code_exec_handler):
+        """No property registered (or a non-bool stand-in) means off."""
+        import bpy
+        bpy.context.window_manager.blenderwright_allow_code_exec = MagicMock()
+        with pytest.raises(PermissionError):
+            code_exec_handler.handle_execute_code({"code": "print('x')"})
+
+    def test_disabled_when_bpy_context_raises(self, code_exec_handler, monkeypatch):
+        """Any failure reading the switch is treated as off, never on."""
+
+        class _NoContext:
+            @property
+            def context(self):
+                raise AttributeError("no context yet")
+
+        monkeypatch.setitem(sys.modules, "bpy", _NoContext())
+        assert code_exec_handler.is_enabled() is False
+
+    def test_refusal_does_not_run_code(self, code_exec_handler):
+        import bpy
+        bpy.context.window_manager.blenderwright_allow_code_exec = False
+        code_exec_handler._exec_log.clear()
+        before = 0
+        with pytest.raises(PermissionError):
+            code_exec_handler.handle_execute_code({"code": "print('never')"})
+        assert len(code_exec_handler.get_exec_log()) == before
+
+    def test_refusal_message_names_the_panel(self, code_exec_handler):
+        import bpy
+        bpy.context.window_manager.blenderwright_allow_code_exec = False
+        with pytest.raises(PermissionError, match="blenderwright"):
+            code_exec_handler.handle_execute_code({"code": "print('x')"})
+
+    def test_enabled_runs(self, code_exec_handler):
+        result = code_exec_handler.handle_execute_code({"code": "print('on')"})
+        assert result["success"] is True
+        assert "on" in result["output"]
+
+
+class TestExecLog:
+    """Every run is recorded so the user can see what the model did."""
+
+    def test_records_each_run(self, code_exec_handler):
+        code_exec_handler._exec_log.clear()
+        code_exec_handler.handle_execute_code({"code": "print('a')\nprint('b')"})
+        log = code_exec_handler.get_exec_log()
+        assert len(log) == 1
+        entry = log[-1]
+        assert entry["first_line"] == "print('a')"
+        assert entry["lines"] == 2
+        assert entry["ok"] is True
+        assert "time" in entry
+
+    def test_records_failed_run(self, code_exec_handler):
+        with pytest.raises(RuntimeError):
+            code_exec_handler.handle_execute_code({"code": "raise ValueError('x')"})
+        assert code_exec_handler.get_exec_log()[-1]["ok"] is False
+
+    def test_log_is_capped(self, code_exec_handler):
+        for i in range(code_exec_handler.EXEC_LOG_SIZE + 5):
+            code_exec_handler.handle_execute_code({"code": f"x = {i}"})
+        assert len(code_exec_handler.get_exec_log()) == code_exec_handler.EXEC_LOG_SIZE
+
+    def test_echoes_code_to_console(self, code_exec_handler, capsys):
+        """The snippet is printed to the real stdout, not the captured buffer."""
+        code_exec_handler.handle_execute_code({"code": "print('seen')"})
+        err = capsys.readouterr().err
+        assert "[blenderwright] execute_code" in err
+        assert "print('seen')" in err
+
+    def test_get_exec_log_returns_copy(self, code_exec_handler):
+        log = code_exec_handler.get_exec_log()
+        log.clear()
+        assert isinstance(code_exec_handler.get_exec_log(), list)

{blenderwright-2.1.0 → blenderwright-2.2.0}/tests/test_addon/test_ui_panel.py

@@ -58,3 +58,23 @@ class TestCustomPort:
         """unregister() removes blenderwright_port from Scene."""
         # Should delete the property during unregister
         assert "del" in ui_source and "blenderwright_port" in ui_source
+
+
+class TestRawPythonSwitch:
+    def _switch_line(self, ui_source):
+        lines = [ln for ln in ui_source.splitlines() if "SWITCH_PROP" in ln and ".prop(" in ln]
+        assert len(lines) == 1, "expected exactly one prop() call for the raw Python switch"
+        return lines[0]
+
+    def test_switch_is_a_checkbox_not_a_toggle_button(self, ui_source):
+        """A BoolProperty drawn with icon= becomes a toggle button that reads as
+        a one-shot 'Allow' action. No icon, so it draws as a checkbox."""
+        assert "icon=" not in self._switch_line(ui_source)
+        assert "toggle=" not in self._switch_line(ui_source)
+
+    def test_switch_lives_on_window_manager(self, ui_source):
+        assert "context.window_manager" in ui_source
+        assert "WindowManager, code_exec.SWITCH_PROP" in ui_source
+
+    def test_panel_states_off_when_unticked(self, ui_source):
+        assert "execute_blender_code is off" in ui_source

{blenderwright-2.1.0 → blenderwright-2.2.0}/tests/test_tools/test_code_exec.py

@@ -53,3 +53,19 @@ class TestExecuteBlenderCode:
 
         with pytest.raises(RuntimeError, match="Blender error"):
             execute_blender_code(code="print(")
+
+    def test_disabled_in_blender_raises_with_hint(self, mock_conn):
+        """When the user has not enabled raw Python, the error says how to."""
+        mock_conn.send_command.return_value = {
+            "status": "error",
+            "result": "PermissionError: execute_blender_code is disabled. "
+            "Tick 'Allow raw Python' in the blenderwright panel.",
+        }
+        with pytest.raises(RuntimeError, match="Allow raw Python"):
+            execute_blender_code(code="print('x')")
+
+    def test_docstring_says_off_by_default(self):
+        """The model must learn from the tool description that it is opt-in."""
+        doc = execute_blender_code.__doc__ or ""
+        assert "off by default" in doc.lower()
+        assert "not a security boundary" in doc.lower()

{blenderwright-2.1.0 → blenderwright-2.2.0}/uv.lock

@@ -51,7 +51,7 @@ wheels = [
 
 [[package]]
 name = "blenderwright"
-version = "2.1.0"
+version = "2.2.0"
 source = { editable = "." }
 dependencies = [
     { name = "mcp" },