MCP Connector for 3ds Max

What it does

A 3ds Max add-in that lets your existing AI assistant read and edit the scene that is open on the user's machine. You bring your own AI subscription. Supported on 3ds Max 2022 to 2027.

How edits are controlled

The connector carries out calls from programs running under the same Windows account, normally your AI client. Whether you approve each call is set in the AI client. The connector does not require a separate confirmation for every edit.

The free tier cannot modify scene data. Its tools query and report on the scene, change the selection or the viewport, and capture a viewport image to a path named in the call, or to a temporary file deleted once the image is returned.

Most tools that change the scene add one named entry to the 3ds Max undo history, so the change can be reversed with Undo. A batch of calls adds one entry for the whole batch. A call that fails part-way can leave the changes it had already made: the MAXScript tool, batches and some multi-step tools such as scatter edits and imports keep what they completed. Imports and merges, scene-wide settings such as units and render settings, and file operations such as renders and saves sit outside the undo history. A recovery copy can restore the scene state, but cannot reverse writes to external files.

Four Pro tools accept MAXScript written by the AI. One runs it straight away. The other three store it in the scene as controller or wire code, which is saved with the scene and runs whenever 3ds Max evaluates it, subject to the 3ds Max security settings. None of them is sandboxed, and the code can do anything a script run by the user could.

Before the first scene-changing operation that requires automatic protection, the connector creates a recovery copy under the user's local application data. Verification is strict by default; failure blocks the requested edit. Version 1.6.2 accounts for camera and light target nodes omitted by the saved-file name index. Saved source files over 300 MB require an explicit snapshot before editing. Recovery copies contain the full scene and remain on disk until removed; external assets and other files are not backed up.

An operator may enable the automatic metadata warning mode for a compatibility problem. It still requires a saved, nonempty native copy, preservation checks, a hash and a durable record. A permitted metadata failure is surfaced as a warning; that copy cannot be restored by the connector. Save and integrity failures still block edits. Explicit snapshots, checkpoints and pre-restore copies remain strict.

Local recovery diagnostics include live and saved-index counts, object names, handles and classes. They are written alongside each copy even when optional diagnostic logging is off, remain on disk until removed and are never sent to AUTOM8LABS.

Restoring a recovery point starts with a preview and requires an explicit apply call with the preview token. It replaces the whole scene, including manual edits since the snapshot, and first requires a verified copy of the current scene. Restoration loads a separate working file and preserves the original and retained copies. Saving or rendering to a named output remains a separate file-writing action.

Where model data goes

Tool results go to the AI application you connect. If it uses a cloud AI provider, project information is processed under your account settings and agreement with that provider. A local AI setup can keep inference on your own computer or server. Running the connector locally does not, by itself, make the AI processing local.

The add-in runs inside 3ds Max on the workstation. The component that talks to your AI client makes no outbound network connections of its own.

If Chaos Cosmos is installed, the Cosmos tools send search text and asset identifiers to the Cosmos service on the same computer, which contacts Chaos under your Chaos account. AUTOM8LABS is not part of that exchange.

Project files and outputs

The connector does not send model content or tool results to AUTOM8LABS. Your AI application controls what it sends to its provider. Files, images and reports requested through tools can contain project information and can be written to locations available to your Windows account, including network shares.

What AUTOM8LABS receives

The machine identifier is a SHA-256 hash of hardware identifiers, or of the machine and account names where Windows cannot supply them. The underlying values never leave the machine.

What is stored

On the workstation

• No listening port by default. The add-in communicates with your AI client over a Windows named pipe, not a network socket.
• Optional local asset listener. One Pro tool can open a TCP listener on 127.0.0.1 only, port 24981 unless another is chosen, so an asset launcher on the same computer can announce downloaded packages. It is off until that tool starts it, and stops when told to or when 3ds Max closes. It has no authentication, so any program on that computer can send to it. It accepts only folder paths inside the library folder chosen at start and only updates a local catalogue there. It never runs scripts, imports files or changes the scene.
• Access restricted to the same Windows user. The pipe is scoped to the account 3ds Max is running under, and no other account on the machine can open it. Any program running under that account can use it. A pipe that cannot be scoped that way is never created.
• No log file by default. Diagnostics are off unless a user sets an environment variable for troubleshooting. When enabled, the log records start-up, licence and AI app setup events, with licence keys masked. Files are kept for 30 days and never leave the machine.
• Stored credentials are encrypted. The licence cache is protected with Windows DPAPI at machine scope, so a copy taken to another computer cannot be read. A key placed by IT for pre-deployment stays unencrypted until it is first validated.
• Adds itself to AI apps. Setup and the Configure AI Clients button add the connector to the MCP settings of AI apps found on the machine. Each time 3ds Max starts, the connector repairs its own entry if the connector has moved, including Codex settings inside running WSL distributions, which it reaches by running wsl.exe. It changes nothing else in those files.
• No elevated privileges are required at runtime. Installation needs administrator rights once.

Administrator controls

With Pro, an administrator can block tools by name or permit only an approved list. These restrictions apply when tools are listed and when a call is executed, including calls inside a batch. They restrict the licensed tools; they do not grant additional access. The controls are off unless configured.

The policy is set for the computer through administrator-managed Windows registry settings. This release has no separate Read-Only Session switch or Group Policy template. To restrict Pro to approved operations, use the tool allow list.

Optional audit log

The optional Pro audit log is off by default. When an administrator enables it, the connector records tool calls, including refusals and batch steps. Records contain the Windows user and computer, host version, project name or path, AI app name, tool, outcome, duration and shortened arguments and error text. These fields can contain project information. Tool results are not copied into the audit log.

An administrator can also request a short reason from the AI for each call. This is the AI's account of the request, not a copy of the user's chat. Logs are written locally and can be copied to an administrator-selected folder or network share. Local audit files are retained for 90 days; retention and access at the destination are controlled by your organisation. AUTOM8LABS does not receive them.

Audit recording is best effort. A failed write or unavailable share does not block the tool, so the log is not a guaranteed or tamper-proof record.

Supply chain

All third-party .NET components are widely used libraries from the official NuGet ecosystem. Every component declares a licence, and all are MIT.

The component that talks to your AI client is a self-contained executable built on a pinned Node.js runtime. Its own dependency set is MIT, ISC or BSD licensed. There are no copyleft licences in the shipped product.

Dependency inventories cover the plug-in and its AI connection component, including the bundled runtime. CycloneDX SBOMs are available on request for this release. Release package checks on 12 October 2026 reported no known vulnerabilities in the dependencies checked. This is a dated check, not a guarantee against vulnerabilities discovered later.

SBOMs are available on request from [email protected].

Assurance

Every AUTOM8LABS binary and the installer are code-signed as AUTOM8LABS LTD through Azure Trusted Signing. Third-party libraries keep their publishers' own signatures.

See the Trust Center for the full assurance position and the sub-processor list.