LLMs are good at writing Three.js. That’s settled. What Google decided was that this code should never run directly in front of your users. So they built a compiler. Three-Live is an open-source Apache 2.0 library that takes AI-generated Three.js scripts, compiles them into static GLB or USDZ files inside a Rust sandbox in 2–5 milliseconds, and renders the result natively on web, Android, and iOS — without the AI-written JavaScript ever executing in front of your users.
Google Does Not Trust AI-Generated Code #
That’s the foundational design decision here. Three-Live’s sandbox is not a performance optimization — it’s a security boundary. Before any script runs, the sandbox strips fetch, XMLHttpRequest, WebSocket, and dynamic import. It enforces CPU instruction fuel limits and geometry quotas on max vertices, triangles, and meshes. The compiled output is a static binary. It cannot phone home, loop forever, or consume unbounded memory.
Google’s own framing: “Runtime AI-generated code is not trusted, and requires security sandboxing for safe execution.” This is a direct acknowledgment that the standard pattern — have an LLM generate JavaScript, run the JavaScript — is not the right approach for 3D content delivered to users at scale.
Compilation runs in an embedded Rust/Boa ECMAScript engine on mobile and CLI targets, and in a sandboxed Web Worker (or opaque-origin iframe) on the web. The output is binary glTF 2.0 (.glb) or Apple USDZ (.usdz) — a static artifact that can be safely handed off to a renderer.
One Three.js Script, Three Native Targets #
Once compiled, Three-Live renders with platform-native engines. On web, it uses a custom WebGL2 PBR renderer with SSAO, bloom, and shadow mapping (the full package is roughly 78 KB gzipped; viewer-only is 31 KB). On Android, it integrates with Google Filament via zero-copy JNI bindings and supports Jetpack XR SceneCore. On iOS and visionOS, it outputs USDZ for Apple RealityKit and AR Quick Look.
That iOS path matters. As of 2026, Safari on iPhone and iPad still has no WebXR AR support. Any web-based AR for iOS must go through AR Quick Look with a USDZ file. Three-Live generates that USDZ automatically from your Three.js source. Write the scene once; it reaches Android WebXR users, iOS AR Quick Look users, and desktop browser users from the same codebase.
A developer building Vision Pro client work on the Three.js forum described the USDZ spec as “unforgiving — stored-only zip entries, 64-byte alignment, single animation track.” Hand-crafting conformant USDZ is tedious. Having a compiler enforce it automatically is the right abstraction.
Getting Started #
Installation is a single line:
npm install three-live
The web component is minimal. Drop a <three-live> element on the page, write a Three.js script inside a text/three script tag, and Three-Live handles compilation and rendering:
<script src="https://cdn.jsdelivr.net/npm/three-live/dist/three-live.min.js"></script>
<three-live>
<script type="text/three">
const mesh = new THREE.Mesh(
new THREE.TorusKnotGeometry(0.4, 0.14),
new THREE.MeshStandardMaterial({ color: 0x38bdf8 })
);
scene.add(mesh);
</script>
</three-live>
The CLI handles batch compilation and rendering:
npx three-live-cli convert scene.js -o model.glb
npx three-live-cli render scene.js --view=quad --grid -o contact_sheet.png
npx three-live-cli from-image photo.jpg -o scene.js --visual-turns 2
An AI-First Workflow With an MCP Server Built In #
Three-Live ships with a built-in Model Context Protocol server for AI agent integration:
claude mcp add three-live -- npx -y -p three-live three-live-cli mcp
Once added, an AI agent — Claude, Gemini CLI, or any MCP-compatible client — can generate a Three.js scene, compile it, render a quad-view contact sheet to verify geometry, and deploy, all within a single session. The from-image command turns a photo, sketch, or blueprint into a live Three.js scene. Combined with the sandbox, this creates a closed loop where the AI both generates and verifies 3D content without ever running arbitrary code in a user context.
For spatial computing, the companion xr-live package adds declarative 6DoF traits (grab, scale, billboard, anchor), 25-joint hand gesture classification, real-world plane detection, and voice editing. It targets WebXR, Android XR, and Apple Vision Pro.
The Bottom Line #
Three-Live is currently in Developer Preview — v1.4.0 is live on GitHub, though the launch post referenced a v1.0.0 that never appeared on npm. It is early. But the design decision at its core — compile AI-generated code into static artifacts before it touches users — is a pattern that will outlast any particular implementation. Google has effectively said: the right way to ship LLM-generated 3D content is the same way you ship any untrusted code. You compile it first.