Claude Code Workbench

[jacquesh82]

🔌 𝗥𝗲𝗽𝗼𝘀𝗶𝘁𝗼𝗿𝘆

https://github.com/jacquesh82/FreeCAD-ClaudeCode

📑 𝗡𝗼𝘁𝗲𝘀

Claude Code Workbench adds a dockable chat panel that lets an AI agent (Claude Code) drive FreeCAD on the user's behalf: it inspects the scene, executes FreeCAD Python in small steps, and verifies its work with screenshots of the 3D view.

Transparency about external connections (per the Index Qualities):

• The addon itself makes no network connections except to 127.0.0.1 (a local RPC bridge between the panel and the agent process).
• It launches the user's locally installed claude CLI (Claude Code by Anthropic), which connects to Anthropic's services using the user's own subscription login. Nothing is sent anywhere unless the user types a prompt; this is stated in the panel and in the README.
• No API keys are stored or handled by the addon; no user data is collected.

Technical notes:

• Requires FreeCAD >= 1.1; uses the FreeCAD-provided PySide (Qt6) wrappers; no sys.path manipulation.
• The MCP bridge subprocess uses only the Python standard library — no third-party dependencies.
• By default the agent is restricted to three FreeCAD tools (exec_python, get_scene, screenshot) via Claude Code's --allowedTools; broader access requires an explicit opt-in checkbox.
• Tagged release: v0.1.0. Valid package.xml manifest, MIT license (LICENSE file included), icon, README with screenshot.

External dependency (documented in the README): the user must have Claude Code installed and logged in with their own Claude subscription. The addon degrades gracefully with a clear message if the CLI is absent.

[chennes]

Considering the nature of this addon, it seemed appropriate to ask Claude to do the first round of review 😁. I am going to paste in the comments here since they are substantially what I'd say, using three times as many words, 100% more em-dashes, and I'm frankly shocked that it doesn't include the phrase "load bearing" someplace...

---

Blockers

1. Unauthenticated local RPC = code execution for any local process. The server listens on 127.0.0.1 with a random port and no token or auth of any kind; the exec op runs whatever Python arrives. Any process on the machine — including other users, since localhost sockets aren't user-scoped — can execute code as the FreeCAD user. The fix is easy: a shared secret passed through the MCP config's env block (the port already travels that way), checked per request.
2. Data-flow disclosure is incomplete. "Nothing is sent unless the user types a prompt" is technically true, but once prompted, get_scene output (file paths, object labels) and full screenshots of the user's design go to Anthropic as tool results. For users with proprietary geometry that's the disclosure that matters, and it's missing. Worse, the in-panel consent text — and the entire UI, including a system prompt forcing French responses — is French-only, while the README is English.
3. Naming/branding. The addon is named verbatim "Claude Code" with a speech-bubble icon in Anthropic's Claude orange (#D97757). In the Addon Manager listing this reads as an official Anthropic product. It should carry a clearly third-party name ("…Connector (unofficial)" or similar).
4. freecadmin says 1.0 while the README, submission notes, and Qt6 assumptions all require ≥ 1.1.
5. Windows is broken: find_claude() searches Unix paths only, and the bridge is launched via shutil.which("python3") or "python3" — which typically doesn't resolve on Windows, and a claude.cmd shim can't be started directly by QProcess. Fix it or declare the platform limitation.

---

Also, beyond Claude's concerns, I think you're underselling the risks here with this "safe default" framing. Your "safe default" includes exec_python ... which is to say, Claude can literally run any Python it wants to, with this user's permissions. I'm not saying you have to change the code here, but I would definitely not describe anything that allows completely arbitrary code execution as "safe". So at least reword the description. To a certain extent Claude users know what they are getting themselves into, but let's not soft-pedal it.