Getting it into your agent
One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.
npx skills add dcc-mcp/dcc-mcp-maya --skill maya-scriptinggit clone --depth 1 https://github.com/dcc-mcp/dcc-mcp-mayaWrote this? Show the measurements
A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.
[](https://agentmods.dev/skills/dcc-mcp/dcc-mcp-maya/maya-scripting)<a href="https://agentmods.dev/skills/dcc-mcp/dcc-mcp-maya/maya-scripting"><img src="https://agentmods.dev/badge/skills/dcc-mcp/dcc-mcp-maya/maya-scripting.svg" alt="Measured on agentmods" height="20"></a>- NVIDIA SkillSpector pass
What it costs to keep this loaded
Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.
| Model | Per session | Once invoked |
|---|---|---|
| Fable 5.1 | $0.00100 | $0.02278 |
| Opus 5 | $0.00050 | $0.01139 |
| Sonnet 5 | $0.00020 | $0.00456 |
| Haiku 4.5 | $0.00010 | $0.00228 |
Grade A, and why
maya-scripting scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 8d ago.
A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.
Nothing flagged
None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.
How it starts
The opening of the file, as written. The whole thing — 149 lines — stays where its author put it; the contents beside it link to each section on GitHub.
maya-scripting (Bootstrap stage)
Skills-first default: search_skills / dcc_capability_manifest → load_skill("<domain>") → call the concrete tool from tools.yaml (validated inputSchema, safety hints). Reserve execute_python / execute_mel for escape hatches: no matching skill, intentional bulk work inside one Maya payload, OpenMaya-only gaps, or introspection-only passes.
Studios can hard-block arbitrary execution with DCC_MCP_MAYA_DISABLE_EXECUTE_PYTHON=1, DCC_MCP_MAYA_DISABLE_EXECUTE_MEL=1, or DCC_MCP_MAYA_DISABLE_ARBITRARY_SCRIPT=1 (blocks both).
Decision tree
Intent matches a Pipeline-stage skill (shot-export, render-farm, pipeline)?
→ load that skill instead.
Intent matches an Interchange skill (FBX/OBJ/preset import or export)?
→ load maya-geometry / maya-export-preset.
Intent matches an Authoring skill (mesh, uv, material, rig, anim, light)?
→ load that domain skill — its tools.yaml has full inputSchema and safety hints.
Only need cmds / OpenMaya discovery (no mutation)?
→ activate introspect group; prefer introspect_* over execute_python.
Need to load, unload, or inspect a Maya plug-in?
→ call list_plugins / load_plugin / unload_plugin instead of raw MEL/Python.
Genuine gap, bulk loop, or one-off not worth a new skill yet?
→ load maya-scripting, read RECIPES.md if helpful, call execute_python / execute_mel.
Unsure of flag name or method signature while authoring a script?
→ activate the introspect group, call introspect_signature / introspect_search.
Concurrency model (agent guidance)
execute_python is thread-safe under bursty load. Every off-main-thread call is funneled through a single-writer FIFO queue and marshaled to Maya's UI thread with maya.utils.executeInMainThreadWithResult — so an agent issuing many concurrent /v1/call POSTs gets:
- Strict serialisation at the Maya boundary: exactly one user script runs at a time on the UI thread (the only thread that can safely call
cmds.*, load native plug-ins, mutate the scene graph). No interleaving, no torn state. - No drops: jobs sit in a bounded queue (default depth 64, configurable via
DCC_MCP_MAYA_EXEC_QUEUE_DEPTH) until the pump can hand them to Maya. - Clean backpressure: when the queue is full, the call returns a
QueueFullErrorenvelope with"back off and retry"instead of stalling the connection. Wait and retry — do not open more concurrent connections to work around it. - Single in-flight marshalling call at a time: avoids thrashing Maya's deferred queue when N agents target the same instance.
What ships with it
16 files beside SKILL.md in the same directory: the scripts, references and assets a skill reads on demand. Not counted in the per-session cost; read them before you install if any of them is executable.
- groups.yaml 613 B
- references/INTROSPECTION.md 5.1 KB
- references/openmaya_signatures/maya_2024.json 14 KB
- references/openmaya_signatures/schema.json 3.9 KB
- references/RECIPES.md 21 KB
- scripts/execute_mel.py 7.8 KB runs code
- scripts/execute_python.py 23 KB runs code
- scripts/get_script_node.py 3.1 KB runs code
- scripts/introspect.py 17 KB runs code
- scripts/io.py 8.9 KB runs code
- scripts/list_mel_procedures.py 1.9 KB runs code
- scripts/list_plugins.py 2.8 KB runs code
- scripts/load_plugin.py 3.1 KB runs code
- scripts/unload_plugin.py 3.2 KB runs code
- scripts/write_module.py 6.6 KB runs code
- tools.yaml 9.0 KB
What this file has done since we first saw it
Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.
- 8d ago First seen · 149 lines · 100 tokens per session scan A a4bff3141138
maya-scripting is a skill published in the GitHub repository dcc-mcp/dcc-mcp-maya (53 stars, last pushed today), licensed MIT. It adds 100 tokens to every session and 2,278 once invoked, about $0.0005 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-30.
Other skills, from other repositories
dcc-mcp-3dsmax-setup
Set up dcc-mcp-3dsmax for an agent or operator: install 3ds Max Python dependencies with 3dsmaxpy, generate MCP host configuration, guide the user through starting the runtime inside 3ds Max, and run a first live-tool smoke prompt.
3dsmax-asset-source
Domain skill — search and resolve assets into validated AssetDescriptor contracts for cross-DCC asset import pipelines. Returns static catalog entries; production sources can layer download helpers or remote resolution without changing the contract.
3dsmax-lookdev
Domain skill - configure OCIO color management, HDR environment lighting, preview materials, and assign renderer-specific materials (Arnold, V-Ray, Scanline) in 3ds Max.
3dsmax-scene
Domain skill - open, save, merge, inspect, and manage scenes and objects in the current Autodesk 3ds Max session. Use for typed scene lifecycle, nodes, cameras, selection, visibility, parenting, grouping, pivots, transforms, scene metadata, or object cleanup.
3dsmax-animation
Domain skill - inspect timeline settings, batch and verify transform keys, exchange anim-curves v1 data, bake simple animation curves, and control viewport playback in 3ds Max.
3dsmax-asset-import
Domain skill - import 3D assets (FBX, OBJ, 3DS, USD) into the current 3ds Max scene via the AssetDescriptor or MAXtoA USD procedural contracts. Use when the user wants external geometry or a renderable USD stage in the scene.