From a52393a3b6590ace81f28d162f588347b24cc500 Mon Sep 17 00:00:00 2001
From: Teknium <127238744+teknium1@users.noreply.github.com>
Date: Tue, 14 Jul 2026 21:59:20 -0700
Subject: [PATCH] fix(mcp): pin blender-mcp to 1.6.4 per catalog dependency
 policy

MCP catalog entries follow the same supply-chain rules as pyproject
dependencies: exact version pin, and the pinned release must be at
least 2 weeks old. blender-mcp 1.6.4 released 2026-06-11 (~5 weeks
old, also the latest release). uvx now resolves the exact version
instead of latest-at-launch.
---
 optional-mcps/blender/manifest.yaml | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/optional-mcps/blender/manifest.yaml b/optional-mcps/blender/manifest.yaml
index e897a0778b5a..ad170d0e336b 100644
--- a/optional-mcps/blender/manifest.yaml
+++ b/optional-mcps/blender/manifest.yaml
@@ -20,8 +20,13 @@ source: https://github.com/ahujasid/blender-mcp
 transport:
   type: stdio
   command: "uvx"
+  # Pinned per catalog dependency policy: exact version, and the release must
+  # be at least 2 weeks old at pin time (supply-chain cooldown — same rule as
+  # pyproject.toml dependencies). 1.6.4 released 2026-06-11. The catalog never
+  # auto-updates; bumping the pin is a PR to this manifest.
   args:
-    - "blender-mcp"
+    - "blender-mcp==1.6.4"
+  version: "1.6.4"
   env:
     # Upstream ships anonymous telemetry, on by default. Hermes policy is
     # no outbound telemetry without explicit opt-in, so the catalog entry