.claude — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited .claude (MCP Server) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for controlling CNC machines via Universal GCode Sender.
Lets Claude (or any MCP-compatible AI assistant) connect to a CNC machine, inspect G-code, and issue motion commands — all through the UGS Pendant REST API.
This software controls machines that can damage equipment, destroy parts, and injure or kill people.
CNC machines move fast and don't know where your hands are. Before you use this:
If you skim the safety docs and something goes wrong, that's on you. We warned you.
Every motion command uses a two-step token protocol: Claude generates a token, shows it to you, and the machine only moves when you read the token back. Claude cannot bypass this — tokens are generated and validated server-side.
http://localhost:8080 (default)pip install ugs-mcpgit clone https://github.com/zackpeters93/ugs-mcp.git
cd ugs-mcp
pip install -e .claude mcp add ugs-cnc ugs-mcpOr from source (without pip install):
claude mcp add ugs-cnc /path/to/ugs-mcp/ugs_mcp/run_server.shIn ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"ugs-cnc": {
"command": "ugs-mcp"
}
}
}Or from source:
{
"mcpServers": {
"ugs-cnc": {
"command": "/opt/homebrew/opt/[email protected]/libexec/bin/python3",
"args": ["-m", "ugs_mcp.server"],
"cwd": "/path/to/ugs-mcp"
}
}
}Environment variables (all optional):
| Variable | Default | Description |
|---|---|---|
UGS_HOST | localhost | UGS Pendant host |
UGS_PORT | 8080 | UGS Pendant port |
MACROS_DIR | ugs_mcp/macros/ | Directory for saved G-code macros |
RAPID_SPEED_MM_MIN | 5000 | Rapid speed used in return-to-zero |
Copy .env.example to .env to customize.
Every motion tool uses a mandatory two-step confirmation:
Step 1 — Call the tool without a token. Claude shows you a preview (axis, distance, resulting position, safety warnings) and a token like [A3F8B2C1].
Step 2 — Read the preview. If you agree, tell Claude the token. Claude calls the tool again with confirmation_token="A3F8B2C1". The machine moves.
Tokens are generated server-side via uuid4(), expire in 2 minutes, and are single-use. Claude cannot predict, fabricate, or reuse them. The only way movement happens is if you type the token back.
See USER_GUIDE.md for the full tool reference with parameters, examples, and typical workflows.
| Category | Tools |
|---|---|
| Connection | ugs_connect, ugs_disconnect, ugs_troubleshoot_connection |
| Status | ugs_get_status, ugs_get_job_status |
| Job | ugs_run_file, ugs_pause_job, ugs_cancel_job |
| Motion | ugs_jog, ugs_home, ugs_return_to_zero, ugs_set_work_zero |
| G-code | gcode_safety_check, gcode_estimate_time, gcode_translate, gcode_list_tools, gcode_save_macro, gcode_list_macros, gcode_run_macro |
Likely works with any GRBL-based machine. TinyG/FluidNC/Smoothieware untested.
MIT — see LICENSE.
No warranty. No liability. Read [SAFETY.md](SAFETY.md).
<!-- mcp-name: io.github.zackpeters93/ugs-mcp -->
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.