# PartCAD (pypi · partcad)

Inspect, render, test and export the parts and assemblies of PartCAD hardware packages

- Trust score: 71/100 (medium)
- Change this week: +18
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-11-05

## Components

- pypi · `partcad`: 71/100 (this document), [markdown](https://verifymcp.io/servers/partcad-partcad/partcad.md), [page](https://verifymcp.io/servers/partcad-partcad/partcad)

## Channel facts

- Registry: `pypi`
- Package: `partcad`
- Version: `0.9.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-11-05.

- **Supply Chain Security**: 76/100
  - No malware found by supply-chain analysis.
  - CVE check failed: a known high-severity CVE affects filelock 3.32.0, a direct dependency. A fixed version is available.
  - Declares code that runs automatically (its declared build backend, an in-tree build backend) and that we could not recognise. It may be perfectly ordinary, but we have not established what it does.
  - 7 of 69 dependencies flagged as unhealthy.
- **Provenance & Transparency**: 48/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (Apache-2.0).
  - Actively maintained (last published 0 days ago).
  - Publishes a security disclosure policy (SECURITY.md).
- **Schema Quality & AI Usability**: 74/100
  - 100% of prompts and resources have a non-trivial description (not blank, and not just the item's name).
  - AI-judged instruction clarity (good).
  - Context-footprint check failed: tool/resource definitions use about 2527 tokens (~180/item across 14 items; 12 tools + 2 resources), over budget; trim descriptions and params.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 53/100
  - Stability observed for 16 of 30 days with no destabilising changes; credit accrues until the full window elapses.
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Tool Safety**: 100/100
  - No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.
  - All 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation.
  - An AI judge read all 14 captured unit(s) of tool text and found none that tries to manipulate the model reading it.
- **Capabilities**: 100/100
  - Implements a current MCP spec version (2026-07-28).

## Install

### How do I install the PartCAD MCP server?

PartCAD runs locally as a PyPI package, launched with uvx partcad. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.

### Claude

```bash
claude mcp add partcad-partcad -- uvx partcad
```

### Cursor

```json
{
  "mcpServers": {
    "partcad-partcad": {
      "command": "uvx",
      "args": [
        "partcad"
      ]
    }
  }
}
```

### VS Code

```json
{
  "servers": {
    "partcad-partcad": {
      "command": "uvx",
      "args": [
        "partcad"
      ]
    }
  }
}
```

### Codex

```bash
codex mcp add partcad-partcad -- uvx partcad
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "partcad-partcad": {
      "type": "local",
      "command": [
        "uvx",
        "partcad"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add partcad-partcad --command uvx --arg partcad
```

### Hermes

```yaml
mcp_servers:
  partcad-partcad:
    command: "uvx"
    args: ["partcad"]
```

### Netclaw

```json
{
  "McpServers": {
    "partcad-partcad": {
      "Transport": "stdio",
      "Command": "uvx",
      "Arguments": [
        "partcad"
      ]
    }
  }
}
```

### Vellum

```bash
assistant mcp add partcad-partcad -t stdio -c uvx -a partcad
```

### Other

```json
{
  "mcpServers": {
    "partcad-partcad": {
      "command": "uvx",
      "args": [
        "partcad"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-11-05 (score 71, +15)

- [security improvement] Malware scan: unverified → pass
- [functional regression] Schema quality: 139 → 180
- [functional] Package version: 0.8.273 → 0.9.2

### 2026-11-04 (score 56, −15)

- [security regression] Malware scan: pass → unverified

### 2026-11-03 (score 71, +1)

No change was recorded against any check on this day. Stability & Change Management went from 43 to 47. That category is still filling its 30-day observation window: 13 days of observed history at the previous scan, 14 at this one. The score rises as the window fills, whether or not the server changes.

### 2026-11-02 (score 70, +15)

- [security improvement] Malware scan: unverified → pass

### 2026-11-01 (score 55, −14)

- [security regression] Malware scan: pass → unverified
- [functional] Package version: 0.8.235 → 0.8.273

### 2026-10-30 (score 69, +16)

- [security improvement] Malware scan: unverified → pass

### 2026-10-29 (score 53, 0)

- [security regression] CVE-2026-112938 affects this package: high
- [security regression] CVE-2026-112915 affects this package: high
- [security regression] CVE-2026-112936 affects this package: high
- [security regression] CVE-2026-112911 affects this package: high
- [security regression] CVE-2026-112910 affects this package: high
- [security regression] CVE-2026-112935 affects this package: high
- [security regression] CVE-2026-112909 affects this package: high
- [security regression] CVE-2026-112939 affects this package: high
- [security regression] CVE-2026-112908 affects this package: high

### 2026-10-28 (score 53, −14)

- [security regression] Malware scan: pass → unverified

## MCP tools (12)

### `list_objects` (~99 tokens)

List objects

List the packages, parts, sketches, assemblies, scenes, interfaces, materials or software of a package.

\`pc list <kind>`. The listing is in the log of the result.

Input parameters:

- `kind` (string): What to list.
- `package`: The package, as '//package/path' or relative to the workspace's own; the workspace's own package when left out.
- `recursive` (boolean): Also list the packages below this one.

### `info` (~163 tokens)

Show an object's declaration

Show an object's configuration, parameters and properties, or the package's when no object is named.

\`pc info`.

Input parameters:

- `kind`: What the object is. Looked up from its name when left out, which is the usual way to call this.
- `object`: The object: its name in the package, or fully qualified as '//package/path:name'. A name with '...' in its package ('//pub/examples...:bolt') reaches every package below that one. The package itself…
- `package`: The package, as '//package/path' or relative to the workspace's own; the workspace's own package when left out.
- `params`: Values for the object's declared parameters, by name ('-p name=value' on the command line).

### `render` (~513 tokens)

Look at an object

Render one part, assembly, scene or sketch and return the picture.

\`pc render`, returned instead of written. The first render of an object builds it, which can take minutes.
Ports, interfaces and callouts are drawn only when asked for.

Input parameters:

- `format` (string): The file type: png (the default) and jpg come back as an image, svg as text; anything else, such as pdf or dxf, is better written with export.
- `kind`: What the object is. Looked up from its name when left out, which is the usual way to call this.
- `object` (string, required): The object: its name in the package, or fully qualified as '//package/path:name'. A name with '...' in its package ('//pub/examples...:bolt') reaches every package below that one.
- `options_package`: A package whose 'render:' section implements the file type, such as a drawing style.
- `package`: The package, as '//package/path' or relative to the workspace's own; the workspace's own package when left out.
- `params`: Values for the object's declared parameters, by name ('-p name=value' on the command line).
- `with_component_names` (boolean): Put a callout on every component with its name ('--with-component-names').
- `with_component_prices` (boolean): Put a callout on every component with its price: its share of the object's cheapest supply quote, which asks the suppliers ('--with-component-prices'). With with_component_names, the price is the sec…
- `with_interface_names` (boolean): Write the name of every interface with_interfaces draws; false draws the boundaries alone.
- `with_interfaces` (boolean): Draw the boundary of every port, labelled with its interface ('--with-interfaces').
- `with_internals` (boolean): With with_ports or with_interfaces, draw the ports of everything inside an assembly too, not only the ones it externalizes ('--with-internals').
- `with_materials` (boolean): Put a callout on every cluster of a material, naming it: the faces of one material that touch or are closer than the user's materialClusterDistance, 10 mm by default ('--with-materials').
- `with_port_names` (boolean): Write the name of every port with_ports draws; false draws the frames alone.
- `with_ports` (boolean): Draw a labelled coordinate frame at every port ('--with-ports').

### `export` (~557 tokens)

Write an object to a file

Export or render one object to a file in the workspace.

\`pc export` / `pc render` for one object, written where the agent says. The ports, interfaces and
callouts are drawn on a picture (png, svg, ...) and mean nothing to a model format such as step.

Input parameters:

- `format` (string, required): The file type: step, stl, 3mf, obj, gltf, brep, png, svg, mp4, webm, ...
- `kind`: What the object is. Looked up from its name when left out, which is the usual way to call this.
- `object` (string, required): The object: its name in the package, or fully qualified as '//package/path:name'. A name with '...' in its package ('//pub/examples...:bolt') reaches every package below that one.
- `options_package`: A package whose 'export:' or 'render:' section implements the file type.
- `package`: The package, as '//package/path' or relative to the workspace's own; the workspace's own package when left out.
- `params`: Values for the object's declared parameters, by name ('-p name=value' on the command line).
- `path` (string, required): Where to write it, relative to the workspace: a file, or an existing directory to write it into under the name PartCAD chooses. Overwrites what is there.
- `with_component_names` (boolean): Put a callout on every component with its name ('--with-component-names').
- `with_component_prices` (boolean): Put a callout on every component with its price: its share of the object's cheapest supply quote, which asks the suppliers ('--with-component-prices'). With with_component_names, the price is the sec…
- `with_interface_names` (boolean): Write the name of every interface with_interfaces draws; false draws the boundaries alone.
- `with_interfaces` (boolean): Draw the boundary of every port, labelled with its interface ('--with-interfaces').
- `with_internals` (boolean): With with_ports or with_interfaces, draw the ports of everything inside an assembly too, not only the ones it externalizes ('--with-internals').
- `with_materials` (boolean): Put a callout on every cluster of a material, naming it: the faces of one material that touch or are closer than the user's materialClusterDistance, 10 mm by default ('--with-materials').
- `with_port_names` (boolean): Write the name of every port with_ports draws; false draws the frames alone.
- `with_ports` (boolean): Draw a labelled coordinate frame at every port ('--with-ports').

### `test` (~148 tokens)

Test objects

Check objects against the requirements and tests they declare.

\`pc test`. ok is false when any check failed, and the errors say which.

Input parameters:

- `kind`: What the object is. Looked up from its name when left out, which is the usual way to call this.
- `object`: The object to test; every object of the package when left out.
- `package`: The package, as '//package/path' or relative to the workspace's own; the workspace's own package when left out.
- `params`: Values for the object's declared parameters, by name ('-p name=value' on the command line).
- `recursive` (boolean): Also test the packages below this one.

### `lint` (~70 tokens)

Lint a package

Check a package's partcad.yaml, ASSY files and scripts for mistakes.

\`pc lint`.

Input parameters:

- `package`: The package, as '//package/path' or relative to the workspace's own; the workspace's own package when left out.
- `recursive` (boolean): Also lint the packages below this one.

### `bom` (~131 tokens)

Bill of materials

What has to be bought or made to build a part, an assembly or a scene.

\`pc bom --json`.

Input parameters:

- `object` (string, required): The object: its name in the package, or fully qualified as '//package/path:name'. A name with '...' in its package ('//pub/examples...:bolt') reaches every package below that one.
- `package`: The package, as '//package/path' or relative to the workspace's own; the workspace's own package when left out.
- `params`: Values for the object's declared parameters, by name ('-p name=value' on the command line).

### `search` (~140 tokens)

Search objects

Find parts, sketches, assemblies, scenes, interfaces or packages by keyword or by interface.

\`pc search`. The matches are in the log of the result.

Input parameters:

- `interface`: Only objects that implement this interface, or one derived from it.
- `keyword` (string): Words to look for in names and descriptions.
- `kind` (string): What to look for.
- `package`: Where to look; the workspace root, '//', when left out. '//pub' is the public catalog.
- `recursive` (boolean): Also look in the packages below. Below '//pub' that is the whole public catalog, fetched over the network the first time.

### `instructions` (~165 tokens)

Assembly instructions

The step-by-step build of an assembly: what goes where, in which order, with which parts.

\`pc instructions`, as data. The user's Build vs Buy choices on this machine are applied.

Input parameters:

- `object` (string, required): The object: its name in the package, or fully qualified as '//package/path:name'. A name with '...' in its package ('//pub/examples...:bolt') reaches every package below that one.
- `package`: The package, as '//package/path' or relative to the workspace's own; the workspace's own package when left out.
- `params`: Values for the object's declared parameters, by name ('-p name=value' on the command line).
- `subassemblies` (boolean): Also write the steps of the subassemblies.

### `version` (~26 tokens)

PartCAD version

The version of this server and of the daemon serving the workspace, which should be the same.

### `list_methods` (~44 tokens)

List daemon methods

The methods the PartCAD daemon serves, each with a one-line summary, for use with execute.

Input parameters:

- `filter`: Only methods whose name or summary contains this, ignoring case.

### `execute` (~155 tokens)

Run a daemon method

Run any PartCAD daemon method -- everything the command line can do, and what the IDE asks for.

The result carries the method's answer and its log.

Input parameters:

- `method` (string, required): The method, as list_methods names it, such as 'cae.analyze'.
- `params`: Its parameters, as `pc` sends them: 'package' and 'object' for what it acts on, and 'params' for the values of the object's own parameters, as {name: value} or as ['name=value', ...] ('-p name=value'…

## Diagnostics

Captured diagnostic sections: Provenance, Install scripts, Vulnerabilities, Dependencies. The full working is on the page: https://verifymcp.io/servers/partcad-partcad/partcad#diagnostics

## Score history

- 2026-11-05: 71
- 2026-11-04: 56
- 2026-11-03: 71
- 2026-11-02: 70
- 2026-11-01: 55
- 2026-10-31: 69
- 2026-10-30: 69
- 2026-10-29: 53
- 2026-10-28: 53
- 2026-10-27: 67
- 2026-10-26: 67
- 2026-10-25: 67
- 2026-10-24: 51
- 2026-10-23: 55
- 2026-10-22: 70
- 2026-10-21: 70
- 2026-10-20: 55

## Common questions

### What is the PartCAD MCP server?

PartCAD is an MCP server listed in the public MCP registry as io.github.partcad/partcad. Inspect, render, test and export the parts and assemblies of PartCAD hardware packages. This page covers its PyPI package (partcad).

### Is the PartCAD MCP server safe to use?

PartCAD scores 71 out of 100 on VerifyMCP. We recorded 12 known advisories against it as of 5 November 2026. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.

### What tools does the PartCAD MCP server expose?

PartCAD exposes 12 tools: list_objects, info, render, export, test, and 7 more. Their descriptions and schemas cost roughly 2,211 tokens of context every time the server is loaded.

### Is the PartCAD MCP server still maintained?

PartCAD is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.

### What licence is the PartCAD MCP server under?

PartCAD declares the Apache-2.0 licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.

## Links

- PyPI project: https://pypi.org/project/partcad/
- Socket report: https://socket.dev/pypi/package/partcad
- Repository: https://github.com/partcad/partcad
- Website: https://partcad.org/
- Changelog RSS feed: https://verifymcp.io/servers/partcad-partcad/partcad.xml
- Changelog JSON feed: https://verifymcp.io/servers/partcad-partcad/partcad.json
- HTML version of this page: https://verifymcp.io/servers/partcad-partcad/partcad