paprika3D (the three.js toolset for coding agents)
NPM · PAPRIKA3D
Lets coding agents see, play, inspect and speed up three.js, R3F and WebGL pages in headless Chrome
Available components
Last scanned (19 hours ago)
Scores higher than 46% of npm servers
Category Testing and QA
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security100
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- No production dependencies, so there is no dependency health to assess. View diagnostics → Pass
Provenance & Transparency97
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Cryptographically verified build provenance (signed, bound to paprika3d/paprika3d). View diagnostics → Pass
- Clear OSI-approved license (Apache-2.0).Pass
- Actively maintained (last published 7 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability62
- AI-judged instruction clarity (good).Pass
- Context-footprint check failed: tool/resource definitions use about 1844 tokens (~167/item across 11 items; 11 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage85
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 55% of tool parameters carry a description.Partial
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 2 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "game_eval" implies "eval" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 12 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 15 Oct 26 76
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 22 Oct 2026 · Analysed npm/paprika3d@0.1.4
Provenance Verified
A signed build attestation was found and verified, binding this exact artifact to the source repository it claims to come from.
| Result | Verified |
|---|---|
| Ecosystem | npm |
| Reason | Verified |
| Discovered via | Registry attestation endpoint |
| Source repo | paprika3d/paprika3d |
| Certificate issuer | https://token.actions.githubusercontent.com |
| Certificate SAN | https://github.com/paprika3d/paprika3d/.github/workflows/npm-publish.yml@refs/tags/v0.1.4 |
| Rekor log index | 3259061354 |
| Predicate type | SLSA build provenance https://slsa.dev/provenance/v1 |
| Subject digest | sha512:70cd725b77722b974e22da6943cf4fe4bb3572631341df3e6f1a2c5dc0abfd238cd5d2c67687060f9b8c9dafcace3fbae3c7a2765b8a44c18d416e678 |
Background: How many MCP packages publish verified provenance →
Dependencies 0 packages
| Packages resolved | 0 |
|---|---|
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
game_act ~178
Sends input to the open page, frame by frame: { key, down?, frames? }, { mouse: click|down|up|move, x, y }, { touch: start|move|end|tap, x, y }, { wait: frames, draw? } or { action, ...args } for window.__game.act; draw: false on a long wait runs its frames without drawing all but the last (much faster; leave it out when the picture builds up over frames, like trails). Each step advances `frames` (default 1). Returns the state after and what changed; with `look: true` also game_look's picture and list after the steps, in the same reply.
| Name | Type | Req | Description |
|---|---|---|---|
| look | boolean | – | Also return game_look's picture after the steps. |
| steps | array | yes | – |
No output schema declared.
No examples provided.
game_check ~53
Runs the game contract against the open game, each keypoint on a fresh page. When the project has a game contract, call it after every change to the game, and once more just before saying the game is done.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
game_clock ~53
Controls the open page's clock: step n frames, pause or resume real-time play, set the time scale.
| Name | Type | Req | Description |
|---|---|---|---|
| paused | boolean | – | – |
| step | number | – | – |
| timescale | number | – | – |
No output schema declared.
No examples provided.
game_contract ~140
For a game with exact rules (scoring, collisions, matching, turn order, stated numbers) or when the user asks for a locked spec or tests, call it before writing game code: it turns the user's prompt into a game contract (keypoints the game must pass). It writes a brief for a fresh subagent that has seen no game code and tells you how to start it; that subagent drafts and issues the contract and replies with the keypoints. Never edit game-contract.json by hand.
| Name | Type | Req | Description |
|---|---|---|---|
| cwd | string | yes | The game project's folder (where game-contract.json lives). |
| prompt | string | yes | The user's prompt, verbatim. |
No output schema declared.
No examples provided.
game_eval ~158
Runs JavaScript in the open page and returns what it returns, as JSON. In scope: scene, camera, renderer, find(name), stats(target) (vertices, triangles, bounds, closed, volume, genus per mesh), realNow() and window. performance.now and Date run on the harness's paused clock, so to time code here use realNow() (real milliseconds), and end GPU work with a 1-pixel gl.readPixels before reading it. Use it to inspect the scene, try a change before writing it into the source, measure an imported model, or check procedural geometry with stats after each step; changes vanish on reload.
| Name | Type | Req | Description |
|---|---|---|---|
| code | string | yes | The body of an async function; return the value to see. |
No output schema declared.
No examples provided.
game_feel ~125
Measures how the page reacts to an event: sends the steps, then watches the next frames for camera shake, scale pops, eased motion versus teleports, colour flashes, spawned particles, HUD text ticks and sounds. Use it on every event the user's feel brief names (hits, clears, explosions, pickups, deaths, wins) to check they feel like something, and to confirm nothing teleports.
| Name | Type | Req | Description |
|---|---|---|---|
| frames | number | – | Frames to watch after the steps (default 45). |
| steps | array | yes | Steps as for game_act, the inputs that cause the event. |
No output schema declared.
No examples provided.
game_look ~328
Saves a screenshot of the open page (returned in the reply, so there is no file to read) and an ID image (one colour per object), and lists what is on screen and the named objects no look has seen, with their size and where they are: it catches a model at the wrong scale, out of view or never loaded, which a screenshot alone misses. Call it after game_open and after each visible change. `camera` views from another place for this picture only. A game drawn in passes (post-processing) is pictured as it drew its last frame, so state set since then shows after a step. `target` instead pictures one named object alone from the front, right, top and a three-quarter angle, framed to its size, in one picture: use it to check a model or procedural shape from every side. `sheet` instead pictures up to 9 moments in one labelled grid, each on a freshly reloaded page set with `state`, played with `steps` (as game_act) and `frames`: use it to compare stages, levels or views at once instead of a screenshot script. `zoom` instead pictures one part of the screen enlarged up to 4×, for detail too small to judge (an edge, text, a distant object).
| Name | Type | Req | Description |
|---|---|---|---|
| camera | object | – | – |
| sheet | array | – | – |
| target | string | – | The name of an object in the main scene. |
| zoom | array | – | [x, y, width, height] in the picture's pixels (as the boxes look lists). |
No output schema declared.
No examples provided.
game_observe ~41
The open page's state (window.__game.observe(), or its named three.js objects), renderer counts, new console errors and what changed since the last observe.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
game_open ~255
Opens a three.js, React Three Fiber or WebGL page (a game, viewer, configurator, simulation or shader demo) in a headless Chrome on a paused, seeded clock, closing any page already open, and lists the files it loaded and any that failed. Open once: after an edit, the next game_act, game_look, game_observe, game_eval, game_clock or game_feel reloads the page by itself. Call it after writing or changing such a page, before saying it is done. Give a file or folder to serve (`url`, relative to cwd), an http URL, or a dev-server `command` run in cwd. When cwd holds a game contract, the result ends with its first check.
| Name | Type | Req | Description |
|---|---|---|---|
| command | string | – | – |
| cwd | string | yes | The game project's folder (where game-contract.json lives). |
| size | array | – | The page's width and height in CSS pixels until the next open, 1280 × 800 by default: [390, 844] for a phone held upright, [1920, 1080] for a large screen. |
| url | string | – | – |
| window | boolean | – | Show a Chrome window. |
No output schema declared.
No examples provided.
game_optimize ~91
Call only when a check reports the frame over budget or the user asks about performance: measures the frame time (no game_perf needed first), tries the @paprika3d/three-runtime switches on the open page, keeps those that help without failing a keypoint or changing the picture, writes game-runtime.json, and ends with the final game_check of the whole contract.
| Name | Type | Req | Description |
|---|---|---|---|
| switches | array | – | – |
No output schema declared.
No examples provided.
game_perf ~199
Call when a check reports the frame over budget or the user asks about performance (stutter, low fps, a phone target): measures frame time, draw calls, triangles and asset size of the open page against a budget (desktop by default, or the contract's). To find what costs the frame, give `variants`: each is measured on a fresh page against the baseline, in this one call, with named objects hidden, a pixel ratio, code run with `renderer` and `scene` (shadows or antialias off, a material swapped), or a `query` the page loads with ("noshadow&pr=0.5", for switches the game reads at load); no reopening or reload code needed.
| Name | Type | Req | Description |
|---|---|---|---|
| budget | string|object | – | desktop, mobile, quest, or limits to override: { frameMs, assetMB, triangles, textureMax, pixelRatioMax }. |
| variants | array | – | – |
No output schema declared.
No examples provided.
How do I install the paprika3D (the three.js toolset for coding agents) MCP server?
paprika3D (the three.js toolset for coding agents) runs locally as an npm package, launched with npx -y paprika3d. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · paprika3d
claude mcp add paprika3d-paprika3d -- npx -y paprika3d
What is the paprika3D (the three.js toolset for coding agents) MCP server?
paprika3D (the three.js toolset for coding agents) is an MCP server listed in the public MCP registry as io.github.paprika3d/paprika3d. Lets coding agents see, play, inspect and speed up three.js, R3F and WebGL pages in headless Chrome. This page covers its npm package (paprika3d).
Is the paprika3D (the three.js toolset for coding agents) MCP server safe to use?
paprika3D (the three.js toolset for coding agents) scores 76 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 22 October 2026. It declares no install or post-install scripts. Its build provenance is signed and verified. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the paprika3D (the three.js toolset for coding agents) MCP server expose?
paprika3D (the three.js toolset for coding agents) exposes 11 tools: game_contract, game_open, game_observe, game_eval, game_act, and 6 more. Their descriptions and schemas cost roughly 1,621 tokens of context every time the server is loaded.
Is the paprika3D (the three.js toolset for coding agents) MCP server still maintained?
paprika3D (the three.js toolset for coding agents) is still listed as active in the MCP registry. We last reached this channel on 22 October 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the paprika3D (the three.js toolset for coding agents) MCP server under?
paprika3D (the three.js toolset for coding agents) declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.