Live survey286 models · 13 providers · 19,992 auditsAudited verification-before-completion · SAFE →What changedHow we verifyllms.txt

MCP server · Audited from source

Unreal_mcp MCP server

by chir24/Unreal_mcpMIT licenceAudited 24 Oct 2026 · source 2652681fef03

npm unreal-engine-mcp-server 0.6.0-beta-fstdio★ 975
✕BLOCKGrade F · 56/100 · 24 Oct 2026 · 2652681
Safer alternativesView source on GitHub ↗

Is it safe? No — BLOCK, grade F (56/100). It exposes 16 tools: 13 read, 3 write and 0 destructive. The audit recorded 29 findings (0 critical, 3 high, 5 medium, 18 low). Maintainer's description: A comprehensive Model Context Protocol (MCP) server that enables AI assistants to control Unreal Engine through the native C++ Automation Bridge plugin. Built with TypeScript and C++.

Ask an AI about this pageGChatGPTCClaudePPerplexityGeGeminiXGrok
More
CoCopilotAIGoogle AI Mode
Cite

Cite this page

ModelsAtlas. “Unreal_mcp MCP server (ChiR24/Unreal_mcp)”. Retrieved 24 Oct 2026. https://modelsatlas.com/mcp/chir24/unreal-mcp

Why this is BLOCK. The audit found 0 critical and 3 high findings; the most severe is Code injection at src/utils/commands/console-command-policy-rules.ts:129. Each finding is listed below with its file and line.

Why this page is still public. People search for this server by name. Hiding it would leave them with the README's word alone; here they see what the code does. We list it so you can decide, and we do not show connect commands for BLOCK servers.

2 MCP servers are called Unreal-MCP. You are viewing ChiR24/Unreal_mcp. Compare all 2 →

Trust audit

Audit 0.4.1 · full source read 24 Oct 2026

Trust score56/100✕BLOCK F
0 critical3 high5 medium18 low3 info

29 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.

What the source does

  • FilesystemDeclared7 observations
  • NetworkDeclared6 observations
  • ShellDeclared6 observations
  • DependenciesNot pinnedSome ranges float
  • SecretsFoundSee the findings

Findings (29)

Sorted by severity · the 25 most severe of 29 are listed

HIGHCode injectioncode.eval_exec · src/utils/commands/console-command-policy-rules.ts:129
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
'import subprocess', 'subprocess.', 'os.system', 'exec(', 'eval(',
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHCode injectioncode.eval_exec · src/utils/commands/console-command-policy-rules.ts:225
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
'os.system', 'exec(', 'eval(', '__import__', 'with open', 'open(',
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
HIGHPrompt injectionprompt.zero_width · CHANGELOG.md:1
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
# 📋 Changelog
Why
invisible characters in instruction text
Fix
strip non-printing characters
MEDIUMHard-coded secretssecret.generic · src/tools/catalog/capabilities/semantic/receipt-contract.test.ts:225
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · src/tools/catalog/capabilities/semantic/receipt-contract.test.ts:284
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · src/tools/catalog/capabilities/semantic/receipt-contract.test.ts:356
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · src/tools/catalog/capabilities/semantic/receipt-contract.test.ts:476
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
MEDIUMHard-coded secretssecret.generic · src/tools/catalog/capabilities/semantic/receipt-contract.test.ts:526
F-03 Hard-coded secretsCWE-798 · CWE-321Layer L1

Excerpt withheld: it is a secret, and we never print one.

Why
No further detail recorded for this rule.
Fix
—
LOWInventory / provenanceinv.hidden_file · plugins/EngineWire/Content/.keep
F-13 Inventory / provenanceCWE-1104Layer L0
.keep
Why
hidden member outside the usual dotfiles
Fix
review its purpose
LOWInventory / provenanceinv.suspicious_name · tests/unit/cross-transport/execute-payload-location.test.ts
F-13 Inventory / provenanceCWE-1104Layer L0
execute-payload-location.test.ts
Why
member named after an attack tool
Fix
remove or justify
LOWInventory / provenanceinv.suspicious_name · tests/unit/tools/todo17-image-payload-budget.test.ts
F-13 Inventory / provenanceCWE-1104Layer L0
todo17-image-payload-budget.test.ts
Why
member named after an attack tool
Fix
remove or justify
LOWCode injectioncode.eval_exec · src/utils/commands/command-validator.test.ts:22
F-02 Code injectionCWE-78 · CWE-94 · CWE-95Layer L1
['exec call', 'exec ('],
Why
evaluates text as code
Fix
remove; use a parser or a dispatch table
LOWInsecure cryptocrypto.weak_hash · src/tools/catalog/capabilities/semantic/envelope.ts:55
F-09 Insecure cryptoCWE-327 · CWE-338Layer L1
return 'sha1:' + createHash('sha1').update(stableJsonStringify(data)).digest('hex');
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · scripts/canonical-registry/cpp-registry.ts:9
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { compareAscii } from '../../src/utils/serialization/ordering.js';
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · scripts/canonical-registry/cpp-registry.ts:11
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import type { ToolDefinition } from '../../src/tools/definitions/shared/tool-definition.js';
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · scripts/canonical-registry/docs-reference.ts:11
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import type { CapabilityRecord } from '../../src/tools/catalog/capabilities/model.js';
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · scripts/canonical-registry/docs-reference.ts:12
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import { sortById as byId } from '../../src/utils/serialization/ordering.js';
Why
No further detail recorded for this rule.
Fix
—
LOWFilesystem / pathfs.traversal · scripts/canonical-registry/native-shards.ts:30
F-05 Filesystem / pathCWE-22 · CWE-59Layer L1
import type { CapabilityRecord } from '../../src/tools/catalog/capabilities/model.js';
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · CHANGELOG.md:331
F-04 Network egressCWE-200 · CWE-319Layer L1
- **`unreal-engine-mcp-server proxy` keeps a native session across editor restarts.** A stdio server in front of the plugin's `/mcp` (`UNREAL_MCP_URL`, default `http://127.0.0.1:3000/mcp`): while the
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · README.md:104
F-04 Network egressCWE-200 · CWE-319Layer L1
| **Path** | Client → the plugin's Streamable HTTP server at `http://127.0.0.1:3000/mcp` | Client → `unreal-engine-mcp-server` (Node.js, stdio) → the plugin's WebSocket on `127.0.0.1:8090` |
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · README.md:156
F-04 Network egressCWE-200 · CWE-319Layer L1
claude mcp add --transport http unreal-engine http://127.0.0.1:3000/mcp --header "X-MCP-Capability-Token: <token>"
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · README.md:166
F-04 Network egressCWE-200 · CWE-319Layer L1
"url": "http://127.0.0.1:3000/mcp",
Why
No further detail recorded for this rule.
Fix
—
LOWNetwork egressnet.raw_ip · README.md:198
F-04 Network egressCWE-200 · CWE-319Layer L1
The token is found the same way as on Route B (`MCP_AUTOMATION_CAPABILITY_TOKEN`, else the project's token file). `UNREAL_MCP_URL` points it at another endpoint (default `http://127.0.0.1:3000/mcp`).
Why
No further detail recorded for this rule.
Fix
—
LOWSupply chainsupply.unpinned · package.json
F-08 Supply chainCWE-829 · CWE-1357Layer L1
ws, zod, @types/node, @types/ws, @vitest/coverage-v8, ajv, eslint-plugin-n, ts-node
Why
9 dependency range(s) float
Fix
pin exact versions or ship a lockfile
LOWPrompt injectionprompt.transfer_instruction · CHANGELOG.md:1291
F-01 Prompt injectionCWE-94 · CWE-1427Layer L2
- **Native MCP Streamable HTTP endpoint** — added an opt-in in-plugin `/mcp` server with JSON-RPC 2.0 initialize/tools/list/tools/call handling, POST/GET/DELETE routing, `Mcp-Session-Id` session track
Why
an instruction to move sensitive data to an outside destination
Fix
remove; a skill never needs the user's secrets off the machine

Tools it exposes

16 declared in source · 0 destructive

13 read3 write0 destructive
ToolWhat it doesRisk
destinationPathContent folder to import intowrite
newValueValue you intend to set, for your referencewrite
variableNameName of a variable to addwrite
ActorsActors in the current levelread
AssetsProject assetsread
ProjectRedacted project name, engine version, and content rootread
SelectionBounded list of selected actor handlesread
assetPathContent path of an asset to focus onread
blueprintPathContent path of the Blueprintread
levelPathContent path for the levelread
objectPathContent path of the object to inspectread
outputFormatRender output image formatread
propertyNameName of the property to reviewread
sequencePathContent path of the level sequenceread
sourceFormatSource file formatread
unrealFAKE TOOLread

Safer alternatives

Unreal✓SAFE

chongdashu/unreal-mcp

Enable AI assistant clients like Cursor, Windsurf and Claude Desktop to control Unreal Engine through natural language using the Model Context Protocol (MCP).

1 destructiveGrade B
Unreal✓SAFE

runeape-sats/unreal-mcp

pure python Unreal Engine MCP server

3 destructiveGrade B

Audit history

  1. ✕BLOCK F 56 / 100

    First audit · 2652681fef03

README badge

Badges show the current verdict, BLOCK included

ModelsAtlas: BLOCK FMODELSATLASBLOCK · F

A badge cannot be hidden by the maintainer while the verdict is BLOCK. Fix the findings, push, and the re-audit updates it.

Questions about Unreal_mcp MCP server

What is the Unreal_mcp MCP server?
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to control Unreal Engine through the native C++ Automation Bridge plugin. Built with TypeScript and C++.
What tools does Unreal_mcp expose?
16 in total: 13 read-only, 3 that write, and 0 that can delete or overwrite. Every one is listed on this page with its risk.
Is Unreal_mcp safe to connect to an agent?
No — not without reading the findings first. The audit graded it F (56/100) and found 3 critical or high issues in the source. Each one is listed on this page with the file and line it is on.
What credentials does Unreal_mcp need?
It reads MCP_AUTOMATION_CAPABILITY_TOKEN from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How does Unreal_mcp run?
It speaks stdio, so it runs as a local process your client starts. It is published on npm as unreal-engine-mcp-server at 0.6.0-beta-f.
How current is this page?
The grade is for one exact copy of the source (2652681fef03), read on 2026-10-24. The repository is watched and re-audited when it changes.
Which Unreal-MCP MCP server is the right one?
IvanMurzak/Unreal-MCP. 2 servers share the name; see the side-by-side comparison.
I already installed Unreal_mcp. What should I do?
Remove it from your client's MCP configuration, then rotate any API keys and tokens that were in your environment while it ran.
Can the verdict change?
Yes. The repository is watched and re-audited when its source changes. If the findings are removed the verdict updates, and the history on this page shows it.

Sources

  • ChiR24/Unreal_mcp on GitHub — the source we read, its licence, stars and activityObserved · 24 Oct 2026
  • ModelsAtlas trust audit — BLOCK verdict for commit 2652681fef03Observed · 24 Oct 2026

Spotted something wrong? Report a correction · Methodology

Keep going in your AI

Opens with this page as the source. We add nothing else to the prompt.