Meshy 3D — Generation + Printing

Use Meshy CLI 0.8 (0.8.3 or later) to turn the user's request into a delivered asset: the requested files in the requested location, an inspected preview when one exists, and — for prints — the intended size, analysis/repair results and a slicer handoff when asked. Login or task submission alone is not completion. Choose the shortest suitable pipeline and reuse existing assets for follow-ups.

SECURITY MANIFEST

Executables: the Meshy CLI — meshy, or the pinned temporary package npm exec --yes --package=meshy-cli@0.8.3 -- meshy — plus npm to install it, node --version to check the runtime, and the file manager when the user asks to see a delivered file. No Python, no curl, no bundled scripts.

Credentials: the CLI's own browser sign-in (OAuth device flow) stores and refreshes a session in ~/.config/meshy/credentials.v2.json (mode 0600), encrypted under a key the OS keeps. An existing MESHY_API_KEY, or an explicit --api-key-file, is honoured and takes precedence. The skill never reads, prints or copies a token, device code or key, and never asks for one in chat. MESHY_API_KEY is optional.

Network: the Meshy API (api.meshy.ai) and its sign-in page (www.meshy.ai), or api.meshy.cn and meshy.cn on the China site; the media hosts of assets being downloaded or input URLs being checked, without the credential; the npm registry when the CLI is installed or run as a temporary package.

Files: writes only inside one workspace per job — the directory the user named, or ./meshy_output — and the CLI refuses paths that escape it, including through symlinks. Existing files are not overwritten unless the user asked for it. Reads the input files the user pointed at and its own outputs in the workspace (previews, sidecars). Slicer handoff launches an already-installed slicer application.

Data leaving this machine: prompts, input images/models and task requests sent to Meshy.

Read what this request needs

Read the relevant section when needed; recipes are examples to adapt, not stages to run in full. An untextured model skips texturing; an existing GLB needs no conversion. Use command --help when parameters are uncertain.

Digital asset or physical print

Anything meant to be printed — a print, slicer, 3MF, STL, Bambu/Orca/Prusa/Cura, multicolor, a desk toy or a physical figure — follows Printing recipes from the first command, so generation parameters fit the print. Everything else follows Pipelines.

Colour routes differ: multicolor paints one object's surface for a multi-material printer; a split cuts it into parts, one filament each, and drops the texture (split before any repair; the two do not chain); the pixel fidget board is a product of its own.

A figurine alone does not imply Creative Lab. Ask about size, color or style only when the missing choice materially changes the result.

First use and sign-in on OpenClaw

Before the first command run meshy --version; no need to ask. When meshy is missing or older than 0.8.3, install the newest 0.8.x with npm install -g meshy-cli@0.8 and say so in one line; Setup covers a refused install and a CLI of 0.9 or newer. Local-only print work stops there. Everything else reuses a verified auth status session; only when there is none, sign in:

1. Start meshy auth login --device --format json --no-update-check (add --region cn for a user in mainland China: the same account and credits as the global site) with exec and a short yieldMs (about 3000) and timeoutSeconds: 900, so it keeps running in the background and returns a sessionId.
2. The CLI prints Enter code … at https://www.meshy.ai/device on stderr within seconds. If the first output holds only npm notices, process poll that same sessionId. Send the user the URL as a link and the code verbatim, plus what to do: open it, sign in to Meshy if asked, type the code, approve. Nothing needs to be sent back in chat.
3. Do not start a second login, kill the session, or poll HTTP yourself; the CLI waits for the approval. When it exits, OpenClaw wakes this session; collect the result with process poll (a subagent, which gets no wake, polls before yielding). Then verify auth status and continue the original request with the inputs, path and budget already given.

A background session must not be detached with & or nohup. An expired or denied code means running the same login again; it never justifies re-running a paid task. Long wait commands behave the same way: let exec background them and resume from the completion wake, rather than re-submitting or looping on sleep.

Only the CLI touches its config directory (~/.config/meshy by default): never read, copy, edit or delete a file there (an old credentials.json included), and never look for credentials anywhere else. When a sandboxed shell blocks the network (auth login fails with oauth_network or fetch failed), run the same command again with network access or outside the sandbox, asking the user to allow it if the host requires. Do not probe with curl or switch to --with-key (Setup, section 3).

Execution boundaries

• Run API, upload, download and mesh operations through the CLI. Local inputs have a 50 MiB limit, and a local model must be GLB or glTF (rigging, UV unwrap and multicolor: GLB); use the supported URL input route for anything else.
• Every command uses --format json --no-update-check and prints one meshy.cli/v1 envelope, auth included. Resolve WORKSPACE from the user's output path and pass it to every write.
• Know what the model is for before the first paid create: a game asset, a character to rig, a render, a 3D print. If the user hasn't said, ask once; the answer picks the route and the models (Pipelines). A game asset or a face-count budget means smart topology, not a standard model remeshed down.
• Submit once with create --async, keep the owning resource and task ID, then wait on that task. Timeouts and unknown submissions follow Troubleshooting; they never authorize another paid create.
• Work within the approved scope and budget; propose additional paid stages or reruns before spending. Local preparation and printability analysis are free; Delivery covers estimates.
• Repair changes geometry and drops textures: use the repaired geometry downstream and retexture before multicolor output. Prepare a Y-up OBJ once, as a new file; never apply that transform to STL, 3MF or relief product output.

Deliver

Download only the needed assets. Send the user an available rendered preview as an image; a missing preview is stated, never implied, and a rendered PNG is not a 3D viewer. Report file paths, task IDs for follow-ups, and the actual charge. For prints also report dimensions and analysis/repair status; launch a detected slicer only when requested, and note that launch_requested does not prove the model was imported. Mention relevant remaining checks, such as supports and wall thickness, without calling an untested model guaranteed printable.