houdini-bridge-mcp

New to this / not a coder? Start here.Plenty of Houdini users already live in code and a terminal — but you donotneed to. Getting running is: get one program, click a couple of buttons in its window, launch Houdini, and paste one small block of settings into your AI client. That's the whole job. The three steps below are the map; the numberedSteps 1–7further down walk each one in detail, and you only ever touch a command line if you choose to build the program from source instead of downloading it.

What you'll need on hand:Houdini 21.0.671(the freeApprenticeedition is fine), aWindowsPC, and an AI client that speaks MCP (Claude Desktop, Cursor, etc.). One folder on your disk becomes the project the AI is allowed to touch — pick it in Step 3.

Three steps to a working setup (full detail in Steps 1–7 below):
- Get the gateway(the one program that connects your AI to Houdini) — eitherdownloadthe prebuilthoudini-bridge-mcp.exefrom Releases (no coding), orbuildit from source (cd gateway && cargo build --release, needs the Rust toolchain). It's a single file with no runtime dependencies.
- Install & arm— run the gateway, which opens a small GUI window. In it: clickInstall Houdini package(wires Houdini to auto-connect), set yourworking directoryand clickApply(the one folder the AI may read and write), and toggleAuto-armon. Then launch Houdini — the status pill should readArmed. Before letting anything but this one machine reach it, run the firewall script (Step 4).
- Connect your AI client— tell your AI client (Claude Desktop, Cursor, …) where the gateway is by pasting one small JSON block into its config (copy-paste ready in Step 6), fully restart the client, then run the Step 7 check to confirm the AI can see your Houdini scene.

Other Houdini/Blender MCP servers exposearbitrary Python executionto the model — powerful, but it is remote-code-execution by design (across the surveyed field every comparable bridge ships anexecute_code-style tool, and one widely-used Blender bridge has a documented remote-code-execution issue). This one is the inverse:

-

Data-only by construction.The AI can only call a fixed registry of1,467typed, validated operations. There is deliberatelynoarbitrary-code tool,nogeneric node-parameter setter, andnoraw VEX/Python path — those simply do not exist in the catalog, so the boundary cannot be talked past. The set of things the server can doisthe enumerated tool list.

Validated authoring — the differentiator, not an escape hatch.The one code-carrying tool,set_attrib_expr(opt-in,default-off), takes a VEX attribute snippet andvalidates it against an allowlist before Houdini ever sees it: no file/host/network reach, allowlisted functions only, and provablytotal — it always halts.Control flow is conditionals,statically-bounded counted loops(for— a literal ormin()-clamped iteration ceiling), and aleaf-only, snapshot-finite array loop(foreach, whose iteration count VEX fixes at entry, and which may not nest inside or contain another loop);while/do/gatherstay banned, so no infinite-loop construct exists. Three capabilities layer on behind theirownindependent default-off consents: bounded loops (allow_attrib_loops),deletion topology edits(removepoint/removeprim,allow_attrib_geoedit), andconstruction/growth(addpoint/addprim/addvertex/removevertex,allow_attrib_geogrow) — all pinned to the input-0 working geometry, and each consent independent (enabling one never grants another). Most wrangle work is covered bytypedoperators anyway (field calculus, per-voxel math, CSG/advection viavdb_);vex_referencealso serves the offline function reference for hand-paste.

This is the line no other Houdini MCP holds: the AI can author a real, capable wrangle without ever handing you a remote shell.Every third-party bridge ships unvalidatedexecute_code/raw-VEX — RCE by design. SideFX's own upcoming official MCP validatesgeneratedcode for correctness after the fact, and only for rigging. This validates abounded subset of the input, before it runs, across the whole toolset— a stricter model, not a smaller door.

Learn Houdini with an AI — safely, not just drive it.Every action is a typed, sandboxed,explainableoperation, and the AI hands you the exact validated wrangle it proposes — so it doubles as a guided tutor: ask it to build something, watch how it wires the network, read thewhy. Nothing it does can run arbitrary code on your machine or touch work outside the project folder, which makes it as safe for a beginner's first scene as for a locked-down pipeline. The same rails that keep it secure make it a low-stakes place to learn how Houdini actually works.

Houdini is famously deep, and the blank-network moment is where most people bounce off. This bridge is a guided, low-stakes way to sit down and actuallylearnit — you describe what you want, the AI builds it in your live session, and you watch the network take shape.

The typed endpoints are the learning scaffold.Every capability is a fixed, typed, validated operation, so the AI can only reachreal Houdini operations— it cannot wander outside what the software actually does or invent a step that isn't there. The tool list itself mirrors how Houdini is organized (the SOP/COP/DOP/KineFX families, the Labs toolset), so the surface that bounds the AI also teaches you how the application is structured.

You watch it, you don't run it blind.Every operation streams live into the gateway GUI's audit log, so youseethe AI work step by step in a running Houdini session — the network gets built in front of you, node by node, rather than executed in a headless batch you never observe. That live, watched mode is the learning advantage. (Headless operation is still supported for power users who want it.)

Mistakes become teaching moments, not disasters.AI can be wrong — it may pick the wrong node or misjudge a parameter. The point isn't that it never errs; it's that the typed, sandboxed,inspectablesurface makes any mistake visible, easy to undo, and harmless. Nothing it does runs arbitrary code or touches files outside your project folder, so a bad step is something youcatch and correct while learning why, not something that can damage your machine or your work.

Honest coverage — what's in scope and what isn't.By raw count the catalog reaches a deliberateminorityof Houdini's non-deprecated node types — exposed as the1,467typed tools in the catalog (one node type is often reached by several tools, and whole families — VOP / SHOP / COP-internal / PDG — are excluded by design, not omission). But that raw numberunderstatesthe creative coverage, because it's weighted hard toward the workflows most people actually use and leaves some whole domains out on purpose:

- "Build the terrain around 46.5°N, 114.0°W at 10 m resolution and put a camera on it."
- "Fetch elevation for this bounding box and import it at true scale."
- "Loadscans/site.ply, clean out the speckle, and mesh it."
- "Erode this heightfield, then mask the gullies and the shadowed slopes."
- "Scatter rocks across the terrain with packed instancing so the viewport stays light."
- "Give me a sun light for late afternoon and frame the ridge."
- "Wire a Karma render aimed at that camera — I'll press the button."
- "Export the terrain mesh as USD into my project folder."
- "Build a KineFX skeleton for this mesh, capture it, and deform-test the bind."
- "Set up a crowd of agents walking a path across the terrain."
- "Splash a FLIP sim into that basin and cache it wire-only."
- "What's in the scene right now, and how much memory is Houdini using?"

AI / MCP client ──stdio──▶ houdini-bridge-mcp (one binary: config + GUI + gateway) │ loopback HTTP ▼ a data-only executor running inside your live Houdini session

"import_heightfieldfromterrain.npy, name itterrain, and display it."

- Tool catalog— the enumerated list of every typed operation (reference/catalog.json, the authoritative count), surfaced as the tables above; per-parameter detail comes from thenode_referenceMCP tool andreference/NODE_REFERENCE.md. Thisisthe security boundary: if it isn't in the catalog, the server can't do it.
- Node reference— thenode_referenceMCP tool answers "what params does node X take?" from live-probed ground truth; the human-readable archive isreference/NODE_REFERENCE.md(SOP / OBJ / LOP / Driver / COP), annotated with which tool exposes each node.
- VEX reference— thevex_referenceMCP tool looks up validated safe-VEX functions; the curated guide isreference/VEX_REFERENCE.md.
- Offline Houdini help server— SideFX's full node/VEX/HOM documentation, served locally and launched alongside the bridge. It has no MCP tool; thecapabilitiesoutput prints its URL.

- Data-only by construction.No arbitrary code, no generic node driver, no raw VEX or Python ever reaches Houdini. The catalog is the attack surface, and the catalog is data-shaped operations. A regression test asserts the RCE primitives (exec/node_op/wrangle) can never appear in the catalog.
- realpath-confined working directory.Every file operation resolves and re-checks against one root, with symlink/junction escapes closed. Reads must exist under the root; writes may create a new leaf but never escape.
- Fail-closed arming.The executor refuses to arm unless a firewall rule blocks inbound connections to its loopback port (see Step 4).
- Renders are wire-only.setup_karmaandbake_texturebuild graphs but never execute — you fire them in Houdini.
- batchgrants no privilege.Thebatchmeta-tool runs up to 64 ops in one call to cut latency, but each op is dispatched through theexact samepath as a direct call — schema-validated, numerics clamped, filesystem pathsrealpath-confined, and audited in order. A batch can only invoke real catalog tools (no arbitrary code, no non-catalog names) and cannot nest (an op namedbatchis rejected). It is a latency envelope, not a way around the boundary.
- Optional action throttle.HMCP_MIN_ACTION_INTERVAL_MS(default off) paces destructive tools (delete_node,save_scene,delete_keyframes) with a short sleep so a runaway/injection can't rapid-fire scene destruction. It slows, never blocks; ordinary tools are unaffected (see Configuration).
- Houdini's embedded Python is unsandboxed, so the guarantee iswhat the AI can ask for*, validated at the gateway — not process isolation. Treat the AI as semi-trusted input.
- Intended posture: loopback, single trusted user, trusted machine.This is a local tool. The transport is meant to stay on the local host.