3DAssets.dev
REMOTE · 3DASSETS.DEV · 2 COMPONENTS · SCANNED SEP 20
Search and download free CC0 GLB models and game packs, and submit new ones on a user behalf.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically against the live server, and we only credit what we can confirm. How we score → Why this is hard to score →
Endpoint Security66
- The endpoint's TLS certificate is valid, in date, and uses a strong key. View diagnostics → Pass
- Authorisation not fully verified: no authorisation is required to call this server, and 20 tool(s) never declared a destructiveHint. The MCP spec treats an absent hint as destructive by default, so we cannot call this surface safe. See how to fix → View diagnostics → Unverified
- HTTPS is enforced; there's no plaintext access path. View diagnostics → Pass
- The HSTS (Strict-Transport-Security) header is present. View diagnostics → Pass
- DNSSEC is configured correctly; the domain's records validate against the full chain to the root. View diagnostics → Pass
Transport & Reachability100
- Verified streamable-http transport via a live MCP handshake. View diagnostics → Pass
Schema Quality & AI Usability77
- AI-judged instruction clarity (good).Pass
- Tool/resource definitions use about 2060 tokens (~103/item across 20 items; 20 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management40
- Stability observed for 12 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage83
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 49% of tool parameters carry a description.Partial
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 20 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 21 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a current MCP spec version (2026-07-28).Pass
How do I install the 3DAssets.dev MCP server?
3DAssets.dev is a hosted endpoint at https://3dassets.dev/mcp, so there is nothing to install locally. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
remote · 3dassets.dev
claude mcp add --transport http dev-3dassets-catalogue 'https://3dassets.dev/mcp'
{
"mcpServers": {
"dev-3dassets-catalogue": {
"url": "https://3dassets.dev/mcp"
}
}
} {
"servers": {
"dev-3dassets-catalogue": {
"type": "http",
"url": "https://3dassets.dev/mcp"
}
}
} [mcp_servers.dev-3dassets-catalogue] url = "https://3dassets.dev/mcp"
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"dev-3dassets-catalogue": {
"type": "remote",
"url": "https://3dassets.dev/mcp",
"enabled": true
}
}
} openclaw mcp add dev-3dassets-catalogue --url 'https://3dassets.dev/mcp' --transport streamable-http
mcp_servers:
dev-3dassets-catalogue:
url: "https://3dassets.dev/mcp" {
"McpServers": {
"dev-3dassets-catalogue": {
"Transport": "http",
"Url": "https://3dassets.dev/mcp"
}
}
} assistant mcp add dev-3dassets-catalogue -t streamable-http -u 'https://3dassets.dev/mcp'
{
"mcpServers": {
"dev-3dassets-catalogue": {
"type": "http",
"url": "https://3dassets.dev/mcp"
}
}
} The mcpServers block is a cross-client convention. Remote transports vary, so check your client's docs.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 37 to 40. That category is still filling its 30-day observation window: 11 days of observed history at the previous scan, 12 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 30 to 33. That category is still filling its 30-day observation window: 9 days of observed history at the previous scan, 10 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 23 to 27. That category is still filling its 30-day observation window: 7 days of observed history at the previous scan, 8 at this one. The score rises as the window fills, whether or not the server changes.
- 15 Sept 26 +1
- DNSSEC: fail → pass ▲ security
- 14 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 17 to 20. That category is still filling its 30-day observation window: 5 days of observed history at the previous scan, 6 at this one. The score rises as the window fills, whether or not the server changes.
- 12 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 10 to 13. That category is still filling its 30-day observation window: 3 days of observed history at the previous scan, 4 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 3 to 7. That category is still filling its 30-day observation window: 1 days of observed history at the previous scan, 2 at this one. The score rises as the window fills, whether or not the server changes.
- 9 Sept 26 0
- Stability: unverified → 0.03 ▲ functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Probed https://3dassets.dev/mcp
TLS valid
Negotiated TLS 1.3 with TLS_AES_128_GCM_SHA256 .
| Subject | Issuer | Valid from | Valid until | Key | Signature | Serial |
|---|---|---|---|---|---|---|
| CN=3dassets.dev | CN=WE1,O=Google Trust Services,C=US | 5 Sept 2026 | 5 Dec 2026 | ECDSA 256 | ECDSA-SHA256 | 2d65a4ff9241b2800ec9def4bcbb858d |
| SANs: 3dassets.dev, *.3dassets.dev | ||||||
| CN=WE1,O=Google Trust Services,C=US (CA) | CN=GTS Root R4,O=Google Trust Services LLC,C=US | 13 Dec 2023 | 20 Feb 2029 | ECDSA 256 | ECDSA-SHA384 | 7ff31977972c224a76155d13b6d685e3 |
| CN=GTS Root R4,O=Google Trust Services LLC,C=US (CA) | CN=GlobalSign Root CA,OU=Root CA,O=GlobalSign nv-sa,C=BE | 15 Nov 2023 | 28 Jan 2028 | ECDSA 384 | SHA256-RSA | 7fe530bf331343bedd821610493d8a1b |
Background: What to check on a remote MCP endpoint →
DNSSEC secure
Validation of 3dassets.dev. — Secure
| Zone | DS | Keys | Algorithms | Outcome |
|---|---|---|---|---|
| . | trust_anchor | 20326, 38696 | 8, 8 | Verified |
| dev. | present | 60074 | 8 | Verified |
| 3dassets.dev. | present | 2371 | 13 | Verified |
| 3dassets.dev. | Verified address RRset verified with the apex keys |
Authentication No authorisation required
The endpoint answered without asking for a token. Anyone who knows the URL can reach it.
| Result | No authorisation required |
|---|---|
| HTTP status | 200 |
| Header | Value |
|---|---|
| strict-transport-security | max-age=31536000; includeSubDomains |
| x-content-type-options | nosniff |
| x-frame-options | SAMEORIGIN |
| referrer-policy | strict-origin-when-cross-origin |
| permissions-policy | camera=(), microphone=(), geolocation=(), payment=() |
Background: How OAuth 2.1 works in the 2026 MCP spec →
Transports 2 probes
| Transport | URL | Outcome | Status | Location |
|---|---|---|---|---|
| streamable-http | https://3dassets.dev/mcp | Verified | 200 | |
| http (plaintext) | http://3dassets.dev/mcp | HTTPS enforced | 302 | https://3dassets.dev/mcp |
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
create_account Create account ~129
Create a contributor account for the user. Needs only a username and email. There is no password anywhere in this product, so never ask the user for one. A 6-digit code is emailed to them; ask the user to read it to you, then call verify_account to receive their API key. Only do this with the user’s explicit consent.
| Name | Type | Req | Description |
|---|---|---|---|
| string | yes | – | |
| name | string | – | Optional display name shown on assets; defaults to the username |
| username | string | yes | Public handle, lowercase letters/numbers/hyphens |
| website | string | – | – |
No output schema declared.
No examples provided.
finalize_upload Finalize upload ~270
After PUTting the file to the URL from get_upload_url, describe the asset and submit it for processing and review.
| Name | Type | Req | Description |
|---|---|---|---|
| aiGenerated | boolean | – | AI helped create geometry, code or textures; not merely uploading |
| aiModel | string | – | Contributor-reported model ID or custom model/tool name; use list_ai_models for suggestions. Omit if unknown. |
| attestation | boolean | yes | Required contributor acceptance (including for agent submissions): I confirm that I created this asset or hold the rights to publish it under CC0 1.0 Universal, and agree to dedicate it to the public… |
| category | string | yes | From list_categories |
| description | string | – | Markdown: scale, pivot, what is included |
| license | string | – | Fixed CC0 1.0 Universal dedication; no licence selection |
| previewKey | string | – | – |
| quarantineKey | string | yes | – |
| sourceUrl | string | – | Where the original was first published |
| summary | string | yes | Plain 1–2 sentence description |
| tags | array | – | – |
| title | string | yes | – |
No output schema declared.
No examples provided.
get_asset Get asset ~46
Full details for one asset by slug: CDN URL, licence + attribution text, stats, bounding box, animations, and ready-to-paste loader snippets.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | – |
No output schema declared.
No examples provided.
get_asset_usage Get usage snippet ~50
Code or steps to load an asset in three.js, React Three Fiber, <model-viewer>, Blender, Godot or Unity.
| Name | Type | Req | Description |
|---|---|---|---|
| framework | string | – | – |
| slug | string | yes | – |
No output schema declared.
No examples provided.
get_demo Get a walkable pack demo layout ~81
Get one demo: the pack, the spawn point, the walkable bounds, the points of interest, and every placement (public asset slug, position in metres, yaw in degrees) with the CDN URL and bounds of each model placed. Load the models with a plain GLTFLoader and apply the transforms to reproduce the scene.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | – |
No output schema declared.
No examples provided.
get_pack Get a complete game asset pack ~47
Get a free pack manifest with direct CDN URLs, licences, geometry budgets, loader snippets and its assembled starter scene. Download models individually or use the starter scene.
| Name | Type | Req | Description |
|---|---|---|---|
| slug | string | yes | – |
No output schema declared.
No examples provided.
get_upload_url Get upload URL ~66
For clients that can upload bytes: returns a presigned PUT URL for a .glb (and optionally a PNG preview). Then call finalize_upload with the returned keys.
| Name | Type | Req | Description |
|---|---|---|---|
| contentLength | integer | yes | – |
| filename | string | yes | – |
| withPreview | boolean | – | – |
No output schema declared.
No examples provided.
list_ai_models Find AI models ~46
Search model suggestions from OpenRouter, refreshed hourly. Custom model/tool names are accepted; the list is not exhaustive. Unavailable suggestions never block uploads.
| Name | Type | Req | Description |
|---|---|---|---|
| q | string | – | – |
No output schema declared.
No examples provided.
list_categories List categories ~26
List categories available on 3dassets.dev (slugs are what other tools accept).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_demos List walkable pack demos ~51
List the walkable demo scenes staff have built from single packs. Each is a small environment a person can walk through on the site and an agent can load as a layout. Use get_demo for the placements.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_licenses List licences ~30
Returns the sole accepted submission dedication: CC0 1.0 Universal. No licence selection is needed.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
list_tags List tags ~26
List tags available on 3dassets.dev (slugs are what other tools accept).
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
my_assets My assets ~55
List the user’s submissions with status (processing, pending review, published, rejected + reason, failed + reason). `pendingEdit` means the user has metadata changes waiting for review; the published version is unchanged until they are approved.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
my_packs My packs ~37
List the user’s pack proposals with status (submitted, approved + pack URL, rejected + reason) and the status of each member model.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
search_assets Search assets ~224
Search the free GLB catalogue on 3dassets.dev (three.js, Blender, Godot, Unity) by text, category (what it is), theme (what world) and style (what look). Returns direct CDN URLs (CORS *, immutable) that load with a plain GLTFLoader. Published models use CC0 1.0 Universal: free personal and commercial use without attribution. Licence metadata is retained in each result.
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | – | Category slug from list_categories |
| limit | integer | – | – |
| page | integer | – | – |
| q | string | – | Alias for query, as spelled by the REST API |
| query | string | – | Free-text search over title and summary |
| sort | string | – | Default: best match for a query, newest otherwise |
| style | string | – | Style tag slug, e.g. low-poly, realistic, voxel |
| tag | string | – | Any tag slug from list_tags |
| theme | string | – | Theme tag slug, e.g. sci-fi, fantasy, modern |
No output schema declared.
No examples provided.
search_packs Search game asset packs ~117
Find cohesive free GLB game kits by text, theme or style. Returns file counts, total bytes and starter scene URLs. Use get_pack for every individual model and loader snippet.
| Name | Type | Req | Description |
|---|---|---|---|
| q | string | – | Alias for query, as spelled by the REST API |
| query | string | – | Free-text search over pack titles and summaries |
| style | string | – | Style tag slug, e.g. low-poly, realistic, voxel |
| theme | string | – | Theme tag slug, e.g. sci-fi, fantasy, modern |
No output schema declared.
No examples provided.
submit_asset_from_url Submit asset from URL ~311
Submit a .glb hosted at a public https URL on the user’s behalf (requires their API key). We download it, validate and re-encode it, then a human reviews it before publishing. CC0 is automatic, but the user must accept its irrevocable dedication before submission. Max 25 MB, 1M triangles, embedded textures only.
| Name | Type | Req | Description |
|---|---|---|---|
| aiGenerated | boolean | – | AI helped create geometry, code or textures; not merely uploading |
| aiModel | string | – | Contributor-reported model ID or custom model/tool name; use list_ai_models for suggestions. Omit if unknown. |
| attestation | boolean | yes | Required contributor acceptance (including for agent submissions): I confirm that I created this asset or hold the rights to publish it under CC0 1.0 Universal, and agree to dedicate it to the public… |
| category | string | yes | From list_categories |
| description | string | – | Markdown: scale, pivot, what is included |
| license | string | – | Fixed CC0 1.0 Universal dedication; no licence selection |
| sourceUrl | string | – | Where the original was first published |
| summary | string | yes | Plain 1–2 sentence description |
| tags | array | – | – |
| title | string | yes | – |
| url | string | yes | – |
No output schema declared.
No examples provided.
submit_pack Propose a pack ~125
Group 2–50 of the user’s own uploads (any that are processing, pending or published) into a pack proposal. Upload the models first with finalize_upload or submit_asset_from_url, then pass their slugs here. Each model is still reviewed on its own; a person approves the pack as a whole, which publishes any members still pending and creates the pack page. Nothing goes live until then. The user is emailed the outcome.
| Name | Type | Req | Description |
|---|---|---|---|
| assets | array | yes | – |
| description | string | – | – |
| summary | string | yes | – |
| title | string | yes | – |
No output schema declared.
No examples provided.
update_asset Update asset ~131
Edit the metadata of one of the user’s own assets. The uploaded GLB can never be changed. Editing an asset that is already published does not change it: the proposal goes to the review queue and the live version keeps serving until a person approves it.
| Name | Type | Req | Description |
|---|---|---|---|
| aiGenerated | boolean | – | – |
| aiModel | string | – | Model ID or custom name; empty string clears attribution |
| category | string | – | From list_categories |
| description | string | – | – |
| slug | string | yes | – |
| summary | string | – | – |
| tags | array | – | – |
| title | string | – | – |
No output schema declared.
No examples provided.
verify_account Verify account ~58
Exchange the emailed 6-digit code for the account’s API key. Show the key to the user and tell them to configure it as the Bearer token for this MCP server.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | – |
| string | yes | – |
No output schema declared.
No examples provided.
What is the 3DAssets.dev MCP server?
3DAssets.dev is an MCP server listed in the public MCP registry as dev.3dassets/catalogue. Search and download free CC0 GLB models and game packs, and submit new ones on a user behalf. This page covers its hosted endpoint (https://3dassets.dev/mcp).
Is the 3DAssets.dev MCP server safe to use?
3DAssets.dev scores 73 out of 100 on VerifyMCP. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the 3DAssets.dev MCP server expose?
3DAssets.dev exposes 20 tools: search_packs, get_pack, list_demos, get_demo, search_assets, and 15 more. Their descriptions and schemas cost roughly 1,926 tokens of context every time the server is loaded.
Does the 3DAssets.dev MCP server require authentication?
No. We connected to 3DAssets.dev without credentials and it answered, so anything it exposes is reachable by anyone who knows the address.
Is the 3DAssets.dev MCP server still maintained?
3DAssets.dev is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.