gdharnessSAFE
A harness for driving a Godot 4 project from an agent: editor addons, a runtime bridge into the running game, an MCP server in front of them, and a CLI that installs and diagnoses the Godot side.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
[](https://github.com/Aureliolo/gdharness/actions/workflows/ci.yml) [](https://scorecard.dev/viewer/?uri=github.com/Aureliolo/gdharness) [](https://www.bestpractices.dev/projects/14619) [](https://www.bestpractices.dev/projects/14619) [](.github/release-process.md#slsa) [](.github/release-process.md#what-a-release-carries) [](.github/release-process.md#verifying-a-release) [](https://www.npmjs.com/package/gdharness) [](https://github.com/Aureliolo/gdharness/releases) [](https://modelcontextprotocol.io/introduction) [](https://godotengine.org) [](https://nodejs.org/) [](https://bun.sh/) [
17 read · 4 write · 0 destructive.
| Tool | Risk | Description |
|---|---|---|
debug_breakpoint | read | Sets or removes a breakpoint through the editor |
debug_control | read | Continues or steps the debugged game through the editor |
debug_state | read | Where the debugged game is stopped: the stack trace, what is in scope at a frame with the values, or the debug adapter |
editor_classes | read | The engine |
editor_output | read | What the project started by editor_run has printed, as entries with a severity: the errors and warnings the engine reported, each with where it happened, and everything else as info. For a run the editor plays the reports come from the game itself, through the runtime addon, since the editor |
project_dependencies | read | What a resource depends on, or what depends on it. |
project_export | read | Export presets and exports. |
project_import | write | The import pipeline: what needs importing, how a resource is imported, reimports, UIDs, and the global class list the editor and the engine read. |
project_info | read | What a project is: its name and main scene from project.godot, the Godot that answers, and how many scenes, scripts and assets it holds, with optional sections on top. |
project_test | read | Runs the project |
resource_edit | write | Resource files: create any ClassDB resource as .tres, change one, write a shader, build a TileSet, or set a Theme colour or font size. A material is a create with resourceType StandardMaterial3D, ShaderMaterial or CanvasItemMaterial. Needs the editor connected. |
runtime_capture | read | A picture of the running game: the whole screen, one region or node of it at full resolution, or one viewport, as an image. The whole screen includes the game |
runtime_inspect | read | Questions about the running game: what is written on the screen, the scene tree, the nodes matching a query, where one node is on screen, what one property reads, or the performance metrics. Needs the game running with the runtime addon. |
runtime_wait | read | Lets the running game get on with it and answers when something has happened: a number of frames, a signal, a property reaching a value, or words appearing on a screen. Needs the game running with the runtime addon. |
scene_animation | read | Animations in an AnimationPlayer and states in an AnimationTree state machine. Needs the editor connected. |
scene_create | write | Creates a scene file where none is, saves one, or saves a copy under a new path. A save of a scene open in the editor saves the editor |
scene_signal | read | Signal connections in a scene file. Needs the editor connected. |
scene_tree | read | The nodes of a scene file: names, classes and hierarchy, with properties when asked. Needs the editor connected. |
script_diagnostics | read | Errors and warnings for a script, or for several, from the editor |
script_edit | write | Creates a GDScript file, or adds functions, variables and signals to one. Every declaration written carries a type. Both load what they wrote under the project |
script_info | read | What a script contains: its structure from the file, or symbols, completions and hover text from the editor |
Trust audit
SAFEgrade B · trust 89/100 Nothing in the source contradicts what it says it does. Grade A is reserved for packages that have also passed the behavioural sandbox.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | PASS |
| L2 | Instruction surface (what it tells the agent) | PASS |
| L3 | Class-specific surface | PASS |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (3 observation(s))
- Network
- declared (4 observation(s))
- Shell
- declared (4 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (14)
.gdlintrc
.markdownlint-cli2.jsonc
.oxlintrc.json
.prettierignore
.prettierrc.json
const digest = createHash('md5').update(resourcePath).digest('hex');`plain.png-${createHash('md5').update('res://models/tex/plain.png').digest('hex')}.md5`,const md5 = (text: string): string => createHash('md5').update(text).digest('hex');sources: [{ texture: '../../outside.png', tileSize: { x: 4, y: 4 } }],const names = ['../x', 'a/../../x', '/x', '//host/share/x', '.', './', '', 'x/..', 'a\0b.txt'];
import { alive } from '../../src/alive.js';import { discard, type Surviving, untilDiscarded } from '../../src/scratch.js';for (const name of ['../escaped.txt', 'nested/../../escaped.txt']) {test/regressions.ts
Gates applied: no_behavioural_pass.
a4ad000bdd46full audit observations/trust-audit/mcp-server/aureliolo__gdharness.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-11 | a4ad000bdd46 | SAFE | B | 89 | first audit |
Questions
What is the gdharness MCP server?
A harness for driving a Godot 4 project from an agent: editor addons, a runtime bridge into the running game, an MCP server in front of them, and a CLI that installs and diagnoses the Godot side.
What tools does gdharness expose?
21 in total: 17 read-only, 4 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is gdharness safe to connect to an agent?
The audit found nothing in the source that contradicts what it says it does, and graded it B (89/100). Grade A is held back for packages that have also passed a sandboxed behavioural run, which is why a clean server reads B.
What credentials does gdharness need?
No credential environment variables were found in its source, so it appears to need none.
How does gdharness run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as gdharness at 1.2.10.
How current is this page?
The grade is for one exact copy of the source (a4ad000bdd46), read on 2026-10-11. The repository is watched and re-audited when it changes.