Back to Browse

3D AR Studio MCP Server

Developer ToolsUse Caution4.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Put 3D models in someone's real room: generate, arrange, and hand back one AR link.

About

Put 3D models in someone's real room: generate, arrange, and hand back one AR link.

Security Report

4.2
Use Caution4.2High Risk

This is a legitimate 3D AR web component with an MCP server for generating and arranging 3D models. The codebase is well-structured with proper authentication patterns (keyless/free services), no malicious code, and appropriate permissions scoped to its purpose. Minor code quality issues and the broad bundled dependencies in the minified output prevent a higher score, but security posture is solid. Supply chain analysis found 3 known vulnerabilities in dependencies (0 critical, 1 high severity). Package verification found 1 issue (1 critical, 0 high severity).

4 files analyzed · 8 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

clipboard

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

Unverified package source

We couldn't verify that the installable package matches the reviewed source code. Proceed with caution.

What You'll Need

Set these up before or after installing:

The page that composed AR scenes link to. Defaults to the hosted demo; set it to your own deployment of the studio.Optional

Environment variable: AR_STUDIO_PAGE_URL

Catalogue URL that search_models searches. Defaults to the free CC0 model library.Optional

Environment variable: AR_STUDIO_ASSETS

MCP endpoint used for text-to-3D generation. Defaults to the free, keyless three.ws 3D Studio connector.Optional

Environment variable: AR_STUDIO_MCP_ENDPOINT

Origin serving the hosted 'View in your space' launcher and the 3D viewer. Defaults to https://three.ws.Optional

Environment variable: AR_STUDIO_ORIGIN

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-nirholas-3d-ar-studio": {
      "env": {
        "AR_STUDIO_ASSETS": "your-ar-studio-assets-here",
        "AR_STUDIO_ORIGIN": "your-ar-studio-origin-here",
        "AR_STUDIO_PAGE_URL": "your-ar-studio-page-url-here",
        "AR_STUDIO_MCP_ENDPOINT": "your-ar-studio-mcp-endpoint-here"
      },
      "args": [
        "-y",
        "3d-ar-studio"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

3D AR Studio

Drop a full augmented-reality studio into any web page.

Place as many 3D models as you like in your real room through the camera, describe a new one and watch it appear, arrange everything by hand, then share the whole scene as a link, a QR code, or a live room someone else can build in with you.

Live demo · npm · MCP server

<script type="module" src="https://unpkg.com/3d-ar-studio/dist/ar-studio.min.js"></script>
<ar-studio></ar-studio>

That is a working AR studio. No build step, no API key, no account. It comes wired to a free library of a few hundred public-domain models and a free, keyless text-to-3D lane; point it at your own catalogue with one option when you are ready.


Why this exists

Every web-AR drop-in places exactly one model and then hands off to a native viewer, which ends the session. This one keeps the whole scene in your page:

  • Many models, one room. Place, drag, pinch-resize, twist-rotate and duplicate as many models as you want in a single live camera view.
  • Generate without leaving the camera. Type "a brass desk lamp" into the dock. The generation runs behind the live view and the finished model drops into the room.
  • Real WebXR where it exists. An always-armed hit-test reticle, one XRAnchor per placed model, real-world light estimation, and depth occlusion so models hide behind your furniture.
  • Real ARKit and ARCore everywhere else. iPhones have no WebXR, so tapping Place in your space opens Apple's AR Quick Look for real: true plane detection, true scale, true occlusion, the system's own "View in AR" sheet. The model is converted to USDZ on the device (a real conversion via three.js's USDZExporter, no server involved) and, because it is exported from the copy already standing in your scene, it arrives at the size you pinched it to and in the pose it was in. Android without WebXR gets Scene Viewer. Desktop gets a grid preview and a QR hand-off to a phone.
  • Scenes are links. Models, positions, rotations and scales round-trip through the URL. Compose on a laptop, scan the QR, it reopens exactly on your phone.
  • Build together, live. Open a room, share a six-character code, and every add and move syncs to everyone in it.
  • Characters actually move. Any humanoid GLB with no baked animation gets an idle clip retargeted onto its own skeleton. No rig allow-list, no T-poses.
  • Agents can drive it. A bundled MCP server lets Claude, ChatGPT or your own agent generate a model, compose an arrangement, and hand a person one link that opens it in their room.

The rendering ladder, anchor lifecycle, retargeting pipeline, scene format and shared-room protocol are extracted from the AR surfaces running in production on three.ws, and generalized so they work on your site with your models.


Install

npm i 3d-ar-studio three

three is a peer dependency, so you keep one copy of it and pick the version. The CDN bundle (dist/ar-studio.min.js) has three.js inside it and needs nothing else.

import { createArStudio } from '3d-ar-studio'

const studio = createArStudio('#stage', {
  branding: { title: 'Acme AR', accent: '#00b894' },
})

studio.on('add', ({ placement }) => console.log('placed', placement.title))

The studio fills its host element absolutely, so give the host a height (any positioned box with a real height works; a <div> with no height gets a sensible 70vh default rather than rendering invisibly).

Scaffold a deployable page

npx 3d-ar-studio create my-ar-site     # a folder you can publish as-is
cd my-ar-site
npx 3d-ar-studio dev                   # look at it locally
npx 3d-ar-studio deploy                # push it and turn on GitHub Pages

deploy prints every git and gh command before it runs it. It needs git and the GitHub CLI; without them it tells you the three manual steps instead of failing silently.

Templates: static (one HTML file, no build), vite, react.

Both 3d-ar-studio and ar-studio run the CLI. The MCP server is a separate binary in its own package, so npx 3d-ar-studio-mcp resolves cleanly: see MCP server.


Your own models

The tray is filled from three.ws by default: a few hundred public-domain (CC0) props, free for commercial use, served with open CORS. Swap in your own with the assets option.

A JSON file anywhere. Five common shapes are read without reshaping:

createArStudio(el, { assets: 'https://cdn.acme.com/models.json' })
// Any of these work:
[ { "url": "https://cdn.acme.com/chair.glb", "name": "Aero chair" } ]
{ "items":     [ … ] }
{ "objects":   [ … ] }   // three.ws object library
{ "creations": [ … ] }   // three.ws forge gallery
{ "models":    [ … ] }

Per entry, the model URL is read from the first present of src, url, glb, glb_url, glbUrl, file or model; the label from title, label, name or prompt; and the thumbnail from poster, thumb, thumbnail, image or preview_image_url. Anything that is not an https (or site-relative) URL is dropped rather than handed to the loader.

A list you hold in code:

import { staticSource } from '3d-ar-studio/sources'

createArStudio(el, {
  assets: staticSource({
    label: 'Our furniture',
    items: [{ src: 'https://cdn.acme.com/chair.glb', title: 'Aero chair', poster: '…' }],
  }),
})

Several tabs at once, in the order you want them:

createArStudio(el, { assets: ['recent', myCatalogue, 'objects', 'link'] })

Built-in keys: 'three.ws' (the default set), 'recent', 'objects', 'community', 'link'.

Anything else. A source is an object with a list():

createArStudio(el, {
  assets: {
    id: 'search',
    label: 'Search',
    searchable: true,
    async list() {
      const rows = await fetch('/api/models').then((r) => r.json())
      return rows.map((m) => ({ src: m.glb, title: m.name, poster: m.thumb }))
    },
  },
})

Throwing from list() is fine: the tray renders a designed error state with a Retry button.

Your users can retarget it too, without touching your code: ?assets=https://…/manifest.json on the page URL. Only https URLs are accepted, and every model source is re-validated before it reaches the loader, so a hostile link can add a catalogue but can never smuggle a javascript: or data: model into the scene. Set allowUrlOverride: false to switch that off.

CORS

Models are loaded by the browser, so the host serving your .glb files has to allow cross-origin requests (access-control-allow-origin). If a model fails to load, that is almost always why, and the studio says so in the status line rather than failing silently.


Options

OptionDefaultWhat it does
assets'three.ws'Where models come from: a preset key, a manifest URL, a source object, or an array of them.
generateenabled{ enabled, endpoint, kind, tier, timeoutMs, pollMs }. endpoint is any MCP server exposing a compatible generate tool.
roomsenabled{ enabled, server }. Point server at your own Colyseus deployment to host shared rooms yourself.
animationsthree.ws idle clip{ enabled, manifestUrl, clip }. The clip retargeted onto humanoid models that ship no animation.
lighting'studio' HDRI{ preset, urls }. preset: null uses procedural lighting only and downloads no HDRI.
branding:{ title, accent, backHref, backLabel }.
shareBaseUrlthis pageWhere share links and QR codes point.
originhttps://three.wsOrigin for the hosted "View in your space" launcher and viewer links.
persistKey'ar-studio:scene:v1'localStorage key for the saved scene. Change it to run two studios on one origin.
persisttrueRestore the last scene on load.
maxPlacements20Cap on simultaneous models. Keeps low-end phones interactive.
fullscreenautoRender as a fixed full-screen layer. Defaults to true only when mounted on document.body.
allowUrlOverridetrueHonour ?assets=, ?src=, ?room= and ?forge= on the hosting page's URL.
onEventnullCalled with (event, detail) for every notable action. Wire it to your analytics.

URL parameters

ParameterEffect
?assets=<https url>Swap the catalogue.
?src=<glb>&title=<name>Load models into the scene. Repeatable.
#s=<payload>Reopen a full arrangement, transforms included. Written by shareUrl().
?room=<code>Join a shared room.
?forge=<prompt>Start a generation on load.

Methods

await studio.addModel({ src, title })        // place a model
studio.clear()                               // remove everything; returns what was there
studio.getScene()                            // [{ src, title, x, z, yaw, scale }]
await studio.setScene(items)                 // replace the arrangement
studio.shareUrl()                            // a link that reopens it exactly
await studio.generate('a brass desk lamp')   // text to 3D, into the room
studio.viewInYourSpace(src, title)           // open the hosted launch page for one model
await studio.startCamera()                   // needs a user gesture on iOS
await studio.enterAR()                       // best AR path for this device
studio.openArSheet()                         // the "Place in your space" hand-off sheet
studio.closeArSheet()
await studio.placeInYourSpace()              // straight to the native viewer, no sheet
await studio.toggleImmersive()               // enter or leave WebXR specifically
await studio.openRoom()                      // returns the room code
studio.destroy()                             // releases camera, socket and GPU context

Events

studio.on(name, fn) returns an unsubscribe function. The same events also fire as ar-studio:<name> DOM events on the mounted element.

EventDetail
add{ placement, remote }
remove{ src, title }
select{ placement } (null when deselected)
clear{ items }
generate{ model }
generate-error{ error, prompt }
camera{ active }
xr{ active }
native-ar{ src, title, viewer } where viewer is quicklook, sceneviewer or none
native-ar-error{ error, src }
ar-sheet{ open } when the hand-off sheet opens or closes
room{ status, code }
share{ url }

Web component

<ar-studio
  assets="https://cdn.acme.com/models.json"
  title="Acme AR"
  accent="#00b894"
  generate="true"
  rooms="true"
></ar-studio>

element.studio is the live instance. Importing 3d-ar-studio/auto (what the CDN bundle does) registers the element for you.


Keyboard and accessibility

Every control is a real button with an accessible name, the source tabs implement the full ARIA tablist contract, and each dialog takes and returns focus.

KeyAction
ArrowsNudge the selected model, camera-relative. Hold Shift for fine steps.
RRotate 45°.
DDuplicate.
Delete / BackspaceRemove, with an undo in the status line.
EscapeClose the open panel, or deselect.

prefers-reduced-motion removes the spawn-in animation and every transition.


MCP server

npx 3d-ar-studio-mcp
{
  "mcpServers": {
    "3d-ar-studio": {
      "command": "npx",
      "args": ["-y", "3d-ar-studio-mcp"]
    }
  }
}

No API key. Every tool is free and keyless.

ToolWhat it does
generate_3d_modelTurn a text prompt into a textured GLB. Returns the model plus links that open it in AR.
check_generationCollect a generation that was still rendering when the first call returned.
search_modelsSearch the free CC0 library (or any catalogue you configure) by name, category and tag.
compose_ar_sceneArrange several models into one scene and return a single link that reopens it exactly.
export_arTurn any GLB URL into a device-aware "View in your space" link.
create_ar_pageEmit a complete, self-contained HTML page embedding the studio, ready to commit.
Environment variableDefaultWhat it changes
AR_STUDIO_PAGE_URLthe hosted demoThe page compose_ar_scene links to. Set it to your own deployment.
AR_STUDIO_ASSETSthe free CC0 libraryCatalogue search_models searches.
AR_STUDIO_MCP_ENDPOINTthree.ws 3D StudioThe MCP endpoint used for generation.
AR_STUDIO_ORIGINhttps://three.wsOrigin for hosted AR launch and viewer links.

A session looks like this:

> Put a mid-century lamp and a potted fern in my living room.

  generate_3d_model  { prompt: "a brass mid-century desk lamp" }   → lamp.glb
  search_models      { query: "potted plant" }                     → fern.glb
  compose_ar_scene   { models: [{ src: lamp.glb, x: 0,   z: -1.4 },
                                { src: fern.glb, x: 0.9, z: -1.2 }] }

  → one link; open it on a phone and both objects stand in the room.

Device support

DevicePathWhat you get
Android ChromeWebXR immersive-arThe whole scene in the room: hit-test placement, per-model anchors, light estimation, depth occlusion.
iOS SafariAR Quick LookOne model at a time in Apple's own viewer, with real ARKit tracking, scale and occlusion. The model is converted to USDZ on the device. Camera passthrough with gyro world-lock composes the multi-model scene in-page alongside it.
Android without WebXRScene ViewerOne model at a time through ARCore, with a browser fallback if ARCore is missing.
DesktopPreviewGrid floor, drag-look, QR hand-off to a phone.
HeadsetsWebXRSame as Android Chrome.

The AR button in the top bar always takes the best path the device has, labels itself so it never promises the wrong one, and acts on the selected model (or the last one placed).

Camera and WebXR both need a secure context: https:// or localhost.

Placing one model in someone's real room

On a device with WebXR the AR button goes straight into an immersive session. Everywhere else it opens the hand-off sheet: which model is going, a picker when the scene holds more than one, and a single primary button that opens the device's own AR viewer.

The sheet exists for one specific reason, and it is worth knowing about if you are building your own UI on top of this package:

iOS opens AR Quick Look only while the page still holds the user gesture that asked for it. Converting a GLB to USDZ takes a second or two. Start the conversion inside the tap handler and by the time the <a rel="ar"> is clicked the gesture has expired, Safari silently declines, and the button looks broken. That is the single most common reason a "View in AR" button does nothing on an iPhone.

There is a second trap right behind it, and it is worse because the failure looks like success:

Safari decides whether a URL is an AR asset from its file extension. A blob: URL has no path, so it has no extension. Hand one to <a rel="ar"> with no filename and Safari still opens Quick Look, but as a generic 3D preview: the viewer comes up in Object mode with AR unavailable. Setting download="something.usdz" on the anchor gives Safari the name it sniffs, and Quick Look enters AR. openQuickLook() does this for you.

So the package splits preparing from opening, and never does them in one tap:

import { prepareNativeAr, isQuickLookReady } from '3d-ar-studio';

// Ahead of the tap: convert, cache, and keep the result.
const handoff = await prepareNativeAr({
  src: 'https://example.com/chair.glb',
  title: 'Chair',
  key: 'chair@1.0',            // cache identity; include the scale if you bake one in
});

// Inside the tap, synchronously. No await between the click and open().
button.addEventListener('click', () => handoff?.open());

prepareNativeAr resolves to null on a device with no native AR viewer, { viewer: 'quicklook' } on iOS with a blob: USDZ ready to open, and { viewer: 'sceneviewer' } on Android, where nothing needs converting at all. Conversions are cached (four at a time, least-recently-used, object URLs revoked on eviction); isQuickLookReady(key), releaseQuickLook(key) and clearQuickLookCache() let you drive that cache yourself.

The studio warms the cache in the background for whichever model the button would send, which is why the second tap of the day is instant. placeInYourSpace() still exists and still does both halves in one call: reach for it when the USDZ is already cached, or when you are calling it from your own already-prepared button.

Exporting from the live scene rather than refetching the GLB is deliberate too: no second download, no second CORS round trip, and the person gets the pose and the size they are looking at. objectToUsdzBlob(object3D) is exported if you want that for your own three.js scene.


Development

npm install
npm test                 # 55 unit tests, no browser needed
npm run build            # dist/ bundles
npm run build:site       # docs/ (the GitHub Pages site)
npm run test:browser     # 18 end-to-end checks in a real browser (needs Playwright)
npm run inspect          # MCP Inspector against the local server

The published site is committed under docs/ and served by GitHub Pages from the main branch. There is no CI workflow: npm run build && npm run build:site, commit, push.


Licence and credits

Apache-2.0.

The bundle includes three.js (MIT) and colyseus.js (MIT). The default model library is CC0 content from Poly Haven, and the default generation and animation lanes are hosted by three.ws. None of them is required: every one is a URL you can change.

Reviews

No reviews yet

Be the first to review this server!