v1.6.1 — Security fix

Security fix — updating is recommended

In 1.6.0 and earlier, while Blockbench and the MCP server were running, any website open in your browser could connect to the ws://127.0.0.1:8188 bridge and run code on your computer through eval_code.

In 1.6.1 the bridge accepts only connections without an Origin header (Node) and the Blockbench window (file://). Connections from websites are refused during the handshake. Test: scripts/verify-bridge-origin.mjs.

Other changes

• README rewritten: installing from a release, update steps, Blockbench 5.2 features, a security section, the low-poly example build script.
• npm run build:release: a single-file server with bundled dependencies. This release's files were built with it.

Installation

1. Download blockbench_mcp.js and mcp-server.js (or unzip the archive). No npm install needed: the server is bundled with its dependencies.
2. Blockbench → File → Plugins → Load Plugin from File → blockbench_mcp.js.
3. Add it to Claude:

claude mcp add --scope user blockbench -- node /path/to/mcp-server.js

Requires Node.js 18+.

Updating from 1.6.0

1. Overwrite both files with the new ones.
2. Restart Blockbench.
3. Restart Claude Desktop or your Claude Code session.

get_status should show plugin_version: "1.6.1".