No red flags found in any of the 11 categories — no credential harvesting, no data exfiltration, no curl-pipe-shell installer. Scanned against the SlowMist agent-security taxonomy, refreshed every 8 hours. Full audit →
by aydinfer · MCP Server · ★ 78
Last updated: · Indexed by AgentSkillsHub · Auto-synced every 8h
🔒 Is spline-mcp-server safe to install? View the security audit →
Spline.design MCP Server (Archived) This project is archived. Spline.design does not provide a public REST API, making most of this server's functionality non-operational. See below for details. Why archived This MCP server was built to programmatically control Spline.design 3D scenes through Claude. However, Spline does not offer a public REST API for scene manipulation. The 130 tools that call target endpoints that don't exist and will fail with network errors. Spline's actual developer tools are: Code API — A client-side JavaScript runtime () that only works in a browser with a canvas element. It can manipulate objects in exported scenes but cannot create scenes or objects. Real-time API — A feature inside the Spline editor for making outbound API calls from Spline to external services. Not an inbound API. Neither of these enables the kind of server-side programmatic control this MCP server attempts. What does work 10 code generation tools generate code for Vanilla JS, React, and Next.js. However, Claude can already write this code without an MCP server, making these tools redundant.
| Stars | 78 |
| Forks | 14 |
| Language | JavaScript |
| Category | MCP Server |
| License | MIT |
| Quality Score | 68.4626720571692/100 |
| Last Updated | 2026-03-09 |
| Created | 2025-03-22 |
| Platforms | mcp, node |
| Est. Tokens | ~11k |
Explore other popular mcp server tools:
spline-mcp-server is An MCP server for working with Spline 3D design tool API. It is categorized as a MCP Server with 78 GitHub stars.
spline-mcp-server is primarily written in JavaScript.
You can find installation instructions and usage details in the spline-mcp-server GitHub repository at github.com/aydinfer/spline-mcp-server. The project has 78 stars and 14 forks, indicating an active community.
spline-mcp-server is released under the MIT license, making it free to use and modify according to the license terms.
Grades come from a rule-based scan built on the SlowMist agent-security taxonomy, covering 11 red-flag categories including credential harvesting, data exfiltration, and curl | sh installers. It is a first-layer scan, not a manual audit — we say so rather than overstate it.
The scale of the problem is documented independently: Liu et al. (2026), in a study of 31,132 agent skills, report that 26.1% contain security vulnerabilities. Our own full-catalog census is published as a citable open dataset.
Sources & who's responsible: