# Changelog

> **This is the PUBLIC form of this artifact. Findings are listed in full, but the details of SECURITY findings — which rule fired, in which file, on which line, and how to fix it — are deliberately withheld, and any secret-scanner results are excluded entirely. Where detail is absent here it was REMOVED FOR PUBLICATION; it is not missing from the analysis. The complete artifact is available from the repository owner.**

## Score

- CAI 52 → 48 (-3.9)
- Rubric changed (rubric-2026.10.1 → rubric-2026.10.5) — scores are not directly comparable.

## Lenses

- Code Health 66 → 54 (-11.6)
- Architecture 97 → 97 (+0.3)
- Maturity 53 → 45 (-8.8)
- Readiness 35 → 35 (+0.0)
- Security 82 → 81 (-0.4)
- Performance 100 → 100 (+0.0)

## Resolved (18)

- Duplicated block (12 lines × 2) (addon.py)
- Duplicated block (13 lines × 2) (src/blender_mcp/server.py)
- Duplicated block (15 lines × 2) (src/blender_mcp/server.py)
- Duplicated block (18 lines × 2) (src/blender_mcp/server.py)
- Duplicated block (24–26 lines × 2) (src/blender_mcp/server.py)
- Medium CVE: PYSEC-2026-2132 (uv.lock)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (addon.py)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (addon.py)
- Members sharing a duplicated core (8 members, 50+ identical tokens) (addon.py)
- Off-boarding risk: anonymized user #1
- server.download_polypizza_model (cognitive 20) (src/blender_mcp/server.py)
- server.get_polyhaven_categories (cognitive 21) (src/blender_mcp/server.py)
- server.search_polyhaven_assets (cognitive 36) (src/blender_mcp/server.py)
- server.search_polyhaven_assets (cyclomatic 22) (src/blender_mcp/server.py)
- server.search_polypizza_models (cognitive 28) (src/blender_mcp/server.py)
- server.search_polypizza_models (cyclomatic 24) (src/blender_mcp/server.py)
- server.search_sketchfab_models (cognitive 17) (src/blender_mcp/server.py)
- server.set_texture (cognitive 19) (src/blender_mcp/server.py)

## New (40)

- Duplicated block (12 lines × 2) (addon.py)
- Duplicated block (13 lines × 2) (addon.py)
- Duplicated block (14 lines × 2) (addon.py)
- Duplicated block (14 lines × 2) (addon.py)
- Duplicated block (15 lines × 2) (addon.py)
- Duplicated block (19 lines × 2) (addon.py)
- Duplicated block (26 lines × 2) (addon.py)
- Duplicated block (29 lines × 2) (addon.py)
- Duplicated block (31 lines × 2) (addon.py)
- Duplicated block (32 lines × 2) (addon.py)
- Duplicated block (5 lines × 2) (addon.py)
- Duplicated block (6 lines × 2) (src/blender_mcp/context_log.py)
- Hotspot: src/blender_mcp/generation.py (src/blender_mcp/generation.py)
- Medium CVE: [GHSA redacted] (uv.lock)
- Medium: security finding (details withheld)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (addon.py)
- Members sharing a duplicated core (4 members, 50+ identical tokens) (addon.py)
- Members sharing a duplicated core (8 members, 50+ identical tokens) (addon.py)
- Off-boarding risk: anonymized user #1
- addon_manager.update_installed_addons (cognitive 16) (src/blender_mcp/addon_manager.py)
- …and 20 more

## Changes since last survey

- 16 commits — 12 feature/other, 4 fixes

## By area

- (root) — 8 commits
- src/blender_mcp — 7 commits
- tests/test_addon_updater.py — 1 commit

## Notable commits

- fix: Fix setup crash on non-English Windows (tasklist output is OEM code page) (#381)
- fix: fix: accept explicit null for optional tool arguments
- fix: fix: link url to Premium was missing
- fix: fix: resume generations after client timeouts
- change: docs: Windows install without ExecutionPolicy bypass, add winget path (#401)
- change: docs: update README
- change: docs: update README.md
- change: feat: add Meshy with users' API keys (#398)
- change: feat: add update command to easily update the mcp
- change: feat: run Meshy through Premium (#402)
- change: feat: separation of concerns in tool calls + local logging
- change: hygiene: version bump
- change: hygiene: version bump
- change: hygiene: version bump
- change: hygiene: version bump
- change: test: give addon-source parametrizations short ids (#379)

## Architecture

- 0 containers · 1 bounded contexts · 0 dependency edges (baseline)