ModelsAtlas
Explore
Atlas / MCP servers / codingriver / upilot

upilotCAUTION

mcp/codingriver/upilot
MCP server by codingriver · ai agent · claude · codex · Audited 2026-10-11
⚑ Report / re-scanSource ↗

upilot Unity Editor automation bridge for AI agents and MCP clients

Verdict
CAUTION
Grade
F
Trust score
59 /100
Exposed tools
167 117r · 40w · 10d
Transport
stdio · streamable-http
License
MIT
Stars
0
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

让 Codex、Claude Code、Cursor、OpenCode 等 AI Agent 直接操作 Unity Editor。

UPilot 会在 Unity 中启动本地 MCP 服务,并为常见 Agent 自动写入项目级连接配置。配置完成后,你可以直接让 Agent 查看场景、检查编译错误、读取 Console、修改 GameObject、管理资源、运行测试或构建任务。

Unity:2022.3 或更高 正式版使用独立 MCP Server,由 UPilot 下载并管理,无需另外安装运行环境。 默认 MCP 地址:http://127.0.0.1:8011/mcp
教程截图来自 Windows 上的 Unity 2022.3。不同 Unity 版本或编辑器主题下,界面外观可能略有差异,请以实际界面提示为准。

2 分钟上手

安装 Unity 包 → 安装推荐服务并配置 Agent → 验证连接,即可开始使用。首次下载和 Unity 编译的耗时取决于网络与项目规模。

1. 安装 Unity 包

在 Unity 中打开:

Window > Package Manager

点击左上角 +,选择 Add package from git URL...,输入:

https://github.com/codingriver/upilot.git#v0.3.44

点击 Add,等待 Unity 完成包导入和脚本编译。这里以固定发布版本 v0.3.44 为例;安装其他正式版本时,将链接末尾的标签替换为对应的 vMAJOR.MINOR.PATCH。

输入 UPilot Git URL 后点击右侧 Add。

2. 在 Unity 中安装服务并配置 Agent

包导入完成后,Unity 会自动打开 UPilot 设置界面。如果没有自动打开,请选择:

UPilot > 打开 UPilot

然后:

  1. 在设置向导的 网络端口 步骤使用推荐端口,点击 下一步。
  2. 在服务设置中选择 由 UPilot 管理服务,点击 安装推荐服务,等待独立服务下载完成后进入下一步。
  3. 选择你正在使用的 Agent:Codex、Claude Code、Cursor 或 OpenCode,支持多选。
  4. 保持启动选项勾选,点击 写入配置并启动,等待主界面显示 已就绪。

按设置向导安装推荐服务、选择常用 Agent,再写入配置并启动。

UPilot 会自动选择可用端口、写入所选 Agent 的 MCP 配置,并同步所需的 Skill/规则。

3. 重启 Agent 并验证

首次写入配置后,请重新启动 Agent 客户端,或重新加载当前项目窗口,使 MCP 工具列表刷新。

然后对 Agent 说:

请调用 unity_mcp_status,确认 UPilot 已连接,并检查当前 Unity 工程路径。

成功时应满足:

  • connected: true
  • serverReady: true
  • 返回的 Unity 工程路径与当前项目一致

现在可以开始使用 UPilot。

UPilot 能做什么

UPilot 是 AI Agent 与 Unity Editor 之间的桥梁:Agent 通过 MCP 工具读取真实的 Unity 状态,并在授权后执行修改,而不只是生成一段代码供你手动粘贴。

Read from source at commit cd31b88679bbOBSERVED · 2026-10-11
02

Connect

Built from this server's own package name, version and transport as found in its source — not copied from anyone's documentation, so it cannot drift against a page we do not control.

claude-code
claude mcp add io.github.codingriver.upilot -- npx -y [email protected]
claude-desktop
{
  "mcpServers": {
    "io.github.codingriver.upilot": {
      "command": "npx",
      "args": [
        "-y",
        "[email protected]"
      ]
    }
  }
}
03

Exposed tools (167)

117 read · 40 write · 10 destructive. Blast radius: 10 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
unity_agent_integrations_checkread_log_tool_call(
unity_agent_integrations_syncwrite_log_tool_call(
unity_agent_rules_checkread_log_tool_call(
unity_agent_rules_installwrite_log_tool_call(
unity_animator_controller_inspectread_log_tool_call(
unity_asset_copyread_log_tool_call(
unity_asset_create_folderwrite_log_tool_call(
unity_asset_deletedestructive_log_tool_call(
unity_asset_findread_log_tool_call(
unity_asset_find_built_inread_log_tool_call(
unity_asset_get_dataread_log_tool_call(
unity_asset_get_inforead_log_tool_call(
unity_asset_modify_datawrite_log_tool_call(
unity_asset_movewrite_log_tool_call(
unity_asset_refreshread_log_tool_call(
unity_asset_reimportread_log_tool_call(
unity_asset_subresources_listread_log_tool_call(
unity_auto_fix_startwrite_log_tool_call(
unity_auto_fix_statusread_log_tool_call(
unity_auto_fix_stopwrite_log_tool_call(
unity_avatar_mask_inspectread_log_tool_call(
unity_batch_cancelread_log_tool_call(
unity_batch_diagnosticsread_log_tool_call(
unity_batch_executewrite_log_tool_call(
unity_batch_resultsread_log_tool_call(
unity_build_cancelread_log_tool_call(
unity_build_startwrite_log_tool_call(
unity_build_statusread_log_tool_call(
unity_build_targetsread_log_tool_call(
unity_camera_listread_log_tool_call(
unity_capabilities_getread_log_tool_call(
unity_client_config_diagnoseread_log_tool_call(
unity_compile_errorsread_log_tool_call(
unity_compile_errors_getread_log_tool_call(
unity_compile_statusread_log_tool_call(
unity_component_addwrite_log_tool_call(
unity_component_getread_log_tool_call(
unity_component_listread_log_tool_call(
unity_component_modifywrite_log_tool_call(
unity_component_removedestructive_log_tool_call(
unity_console_capture_attachread_log_tool_call(
unity_console_capture_detachread_log_tool_call(
unity_console_capture_listread_log_tool_call(
unity_console_capture_statusread_log_tool_call(
unity_console_capture_stopwrite_log_tool_call(
unity_console_cleardestructive_log_tool_call(
unity_console_mark_logsread_log_tool_call(
unity_drag_dropdestructive_log_tool_call(
unity_editor_execute_commandwrite_log_tool_call(
unity_editor_redoread_log_tool_call(
unity_editor_stateread_log_tool_call(
unity_editor_undoread_log_tool_call(
unity_editor_window_focusread_log_tool_call(
unity_editor_window_openread_log_tool_call(
unity_ensure_readyread_log_tool_call(
unity_gameobject_createwrite_log_tool_call(
unity_gameobject_deletedestructive_log_tool_call(
unity_gameobject_duplicateread_log_tool_call(
unity_gameobject_findread_log_tool_call(
unity_gameobject_modifywrite_log_tool_call(
unity_gameobject_movewrite_log_tool_call(
unity_hang_captureread_log_tool_call(
unity_hang_capture_statusread_log_tool_call(
unity_hang_statusread_log_tool_call(
unity_material_assignread_log_tool_call(
unity_material_createwrite_log_tool_call(
unity_material_getread_log_tool_call(
unity_material_modifywrite_log_tool_call(
unity_menu_executewrite_log_tool_call(
unity_menu_listread_log_tool_call(
unity_model_importer_inspectread_log_tool_call(
unity_monohook_tracing_configurereadargs = {
unity_monohook_tracing_eventsreadargs = {
unity_monohook_tracing_statusread_log_tool_call(
unity_mouse_eventread_log_tool_call(
unity_navmesh_samplereadargs = {
unity_navmesh_statusreadargs = {
unity_navmesh_triangulation_summaryread_log_tool_call(
unity_open_editorread_log_tool_call(
unity_operation_cancelread_log_tool_call(
unity_operation_collect_artifactsread_log_tool_call(
unity_operation_getread_log_tool_call(
unity_operation_listread_log_tool_call(
unity_operation_startwrite_log_tool_call(
unity_operation_statusread_log_tool_call(
unity_operation_validateread_log_tool_call(
unity_package_addwrite_log_tool_call(
unity_package_listread_log_tool_call(
unity_package_removedestructive_log_tool_call(
unity_package_searchread_log_tool_call(
unity_playmode_pauseread_log_tool_call(
unity_playmode_resumeread_log_tool_call(
unity_playmode_startwrite_log_tool_call(
unity_playmode_stopwrite_log_tool_call(
unity_prefab_closeread_log_tool_call(
unity_prefab_createwrite_log_tool_call(
unity_prefab_instantiateread_log_tool_call(
unity_prefab_openread_log_tool_call(
unity_prefab_patchwriter = await _get_facade().prefab_patch(
unity_prefab_savewrite_log_tool_call(
unity_profiler_capture_startwriteargs = {
unity_profiler_capture_statusread_log_tool_call(
unity_profiler_capture_stopwrite_log_tool_call(
unity_project_stack_detectread_log_tool_call(
unity_queue_cleanupreadr = await _get_facade().queue_cleanup(target_type=targetType, target_id=targetId, action=action,
unity_reflection_operation_cancelreadr = await _get_facade().reflection_operation_cancel(operation_id=operationId)
unity_reflection_operation_statusreadr = await _get_facade().reflection_operation_status(operation_id=operationId)
unity_reflection_operation_waitreadr = await _get_facade().reflection_operation_wait(
unity_scene_createwrite_log_tool_call(
unity_scene_listread_log_tool_call(
unity_scene_loadread_log_tool_call(
unity_scene_openread_log_tool_call(
unity_scene_savewrite_log_tool_call(
unity_scene_set_activewrite_log_tool_call(
unity_scene_unloadread_log_tool_call(
unity_sceneview_command_statusread_log_tool_call(
unity_sceneview_navigateread_log_tool_call(
unity_screenshot_cameraread_log_tool_call(
unity_screenshot_comparereadargs = {
unity_screenshot_editor_windowread_log_tool_call(
unity_screenshot_game_viewread_log_tool_call(
unity_screenshot_pixel_statsreadargs = {
unity_screenshot_savewrite_log_tool_call(
unity_screenshot_scene_viewread_log_tool_call(
unity_script_analyzeread_log_tool_call(
unity_script_dependency_graphread_log_tool_call(
unity_script_readread_log_tool_call(
unity_selection_cleardestructive_log_tool_call(
unity_selection_getread_log_tool_call(
unity_selection_setwrite_log_tool_call(
unity_shader_check_errorsread_log_tool_call(
unity_shader_inspectread_log_tool_call(
unity_shader_listread_log_tool_call(
unity_snapshot_baseline_comparereadargs = {
unity_snapshot_baseline_listreadargs = {
unity_snapshot_baseline_updatewriteargs = {
unity_snapshot_cancelread_log_tool_call(
unity_snapshot_capturereadtry:
unity_snapshot_collect_artifactsread_log_tool_call(
unity_snapshot_statusreadargs = {
unity_task_cancelread_log_tool_call(
unity_task_startwrite_log_tool_call(
unity_task_statusread_log_tool_call(
unity_test_cancelread_log_tool_call(
unity_test_force_cleanupdestructive_log_tool_call(
unity_test_force_resetdestructive_log_tool_call(
unity_test_listread_log_tool_call(
unity_test_runwrite_log_tool_call(
unity_test_statusread_log_tool_call(
unity_texture_importer_getread_log_tool_call(
unity_texture_importer_patchwriteargs = {
unity_tool_callread_log_tool_call(
unity_tools_findread_log_tool_call(
unity_type_existsread_log_tool_call(
unity_upilot_acceptance_runwriteargs = {
unity_upilot_flow_cancelread_log_tool_call(
unity_upilot_flow_executionsread_log_tool_call(
unity_upilot_flow_force_resetdestructive_log_tool_call(
unity_upilot_flow_listread_log_tool_call(
unity_upilot_flow_migrateread_log_tool_call(
unity_upilot_flow_pauseread_log_tool_call(
unity_upilot_flow_resumeread_log_tool_call(
unity_upilot_flow_statusread_log_tool_call(
unity_upilot_flow_stopwrite_log_tool_call(
unity_upilot_flow_validateread_log_tool_call(
unity_verify_windowread_log_tool_call(
unity_write_batch_statuswrite_log_tool_call(
04

Trust audit

CAUTIONgrade F · trust 59/100 Install with care. The audit found things worth knowing before you trust its output.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeWARN
L2Instruction surface (what it tells the agent)PASS
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
declared (9 observation(s))
Network
declared (5 observation(s))
Shell
declared (2 observation(s))
Dependencies
not all pinned
Secrets in source
found

Findings (25)

MEDIUMInventory / provenance · inv.binary · CWE-1104
Editor/Optional/Flow/Driver/Plugins/YamlDotNet.dll
YamlDotNet.dll
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
Editor/Plugins/MonoHook/Plugins/libMonoHookUtils_OSX.dylib
libMonoHookUtils_OSX.dylib
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
Tests~/UPilotTest/ProjectSettings/DynamicsManager.asset:20
m_LayerCollisionMatrix: ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
Tests~/UPilotTest/ProjectSettings/Physics2DSettings.asset:56
m_LayerCollisionMatrix: ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
Tests~/UPilotTest2022/ProjectSettings/DynamicsManager.asset:21
m_LayerCollisionMatrix: ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
MEDIUMObfuscation / stealth · obf.base64_blob · CWE-506, CWE-94
Tests~/UPilotTest2022/ProjectSettings/Physics2DSettings.asset:48
m_LayerCollisionMatrix: ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
Tests~/UPilotTest/.upilot/validation/writebatch-rounds-20261010/head-baseline/upilotserver~/tests/test_capture_evidence_client.py:86
self.token = "opaque-private-owner-credential"
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
Tests~/UPilotTest/.upilot/validation/writebatch-rounds-20261010/head-baseline/upilotserver~/tests/test_request_origin_evidence_client.py:259
self.token = "private-owned-capture-token"
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
upilotserver~/tests/test_capture_evidence_client.py:86
self.token = "opaque-private-owner-credential"
MEDIUMHard-coded secrets · secret.generic · CWE-798, CWE-321
upilotserver~/tests/test_request_origin_evidence_client.py:259
self.token = "private-owned-capture-token"
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
unity_asset_delete, unity_component_remove, unity_console_clear, unity_drag_drop, unity_gameobject_delete, unity_package_remove, unity_selection_clear, unity_test_force_cleanup, unity_test_force_reset
Why it matters. 10 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
LOWInventory / provenance · inv.hidden_file · CWE-1104
.upilot-flow.json
.upilot-flow.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
Tests~/UPilotTest/.agents/skills/upilot-unity-mcp/.upilot-install.json
.upilot-install.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
Tests~/UPilotTest/.claude/skills/upilot-unity-mcp/.upilot-install.json
.upilot-install.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
Tests~/UPilotTest/.upilot-flow.json
.upilot-flow.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWInventory / provenance · inv.hidden_file · CWE-1104
Tests~/UPilotTest/.upilot/backups/agent-integrations/20260920T081335347630Z-d0729022/.agents/skills/upilot-unity-mcp/.upilot-install.json
.upilot-install.json
Why it matters. hidden member outside the usual dotfiles
Fix. review its purpose
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
Tests~/UPilotTest/.upilot/validation/writebatch-rounds-20261010/head-baseline/upilotserver~/tests/test_loaded_source_evidence.py:16
exec(compile(text, str(path), "exec", dont_inherit=True), vars(module))
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
upilotserver~/tests/test_loaded_source_evidence.py:16
exec(compile(text, str(path), "exec", dont_inherit=True), vars(module))
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
Tests~/UPilotTest/.agents/skills/upilot-unity-mcp/scripts/check_skill_pack.py:231
"repository skill entry": (repo_entry, "../../../skills/upilot-unity-mcp/SKILL.md"),
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
Tests~/UPilotTest/.claude/skills/upilot-unity-mcp/scripts/check_skill_pack.py:231
"repository skill entry": (repo_entry, "../../../skills/upilot-unity-mcp/SKILL.md"),
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
Tests~/UPilotTest/.upilot/backups/agent-integrations/20260920T081335347630Z-d0729022/.agents/skills/upilot-unity-mcp/scripts/check_skill_pack.py:195
"repository skill entry": (repo_entry, "../../../skills/upilot-unity-mcp/SKILL.md"),
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
Tests~/UPilotTest/.upilot/validation/writebatch-rounds-20261010/head-baseline/upilotserver~/tests/test_acceptance_evidence_client.py:175
endpoint.argv[-1] = "../../../../outside.json"
LOWFilesystem / path · fs.traversal · CWE-22, CWE-59
Tests~/UPilotTest/.upilot/validation/writebatch-rounds-20261010/head-baseline/upilotserver~/tests/test_install_upilot.py:122
b'    "io.github.codingriver.upilot": "file:../../.."\r\n'
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
Documentation~/AgentRules/AGENTS.upilot.md:41
- Streamable HTTP: `http://127.0.0.1:8011/mcp`
LOWNetwork egress · net.raw_ip · CWE-200, CWE-319
Documentation~/AgentRules/AGENTS.upilot.md:42
- Health check: `http://127.0.0.1:8011/health`

Gates applied: no_behavioural_pass.

Audited 2026-10-11 · audit v0.4.1 · source sha cd31b88679bbfull audit observations/trust-audit/mcp-server/codingriver__upilot.json · Report an issue / request a re-scan
05

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-10-11cd31b88679bbCAUTIONF59first audit
06

Questions

What is the upilot MCP server?

upilot Unity Editor automation bridge for AI agents and MCP clients

What tools does upilot expose?

167 in total: 117 read-only, 40 that write, and 10 that can delete or overwrite (unity_asset_delete, unity_component_remove, unity_console_clear, unity_drag_drop, unity_gameobject_delete). Every one is listed on this page with its risk.

Is upilot safe to connect to an agent?

With care. The audit graded it F (59/100) and found 25 things worth knowing before you trust this server, listed below with the exact line each was found on. Separately from the audit: 10 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does upilot need?

No credential environment variables were found in its source, so it appears to need none.

How does upilot run?

It speaks stdio and streamable-http, so it runs as a local process your client starts. It is published on npm as io.github.codingriver.upilot at 0.3.46.

How current is this page?

The grade is for one exact copy of the source (cd31b88679bb), read on 2026-10-11. The repository is watched and re-audited when it changes.

Advertisement