Atlas / MCP servers / kirchuvakov / UEFN Remote Control

UEFN Remote ControlBLOCK

Name: UEFN Remote Control
Author: kirchuvakov

mcp/kirchuvakov/uefn-remote-control

MCP server by kirchuvakov · Audited 2026-10-07

MCP server for controlling UEFN (Unreal Editor for Fortnite) from Claude Code — 22 tools for actors, assets, levels, viewport, and Python execution

Verdict

BLOCK

Grade

Trust score

66 /100

Exposed tools

103 53r · 42w · 8d

Transport

—

License

MIT

Stars

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

Control UEFN (Unreal Editor for Fortnite) from Claude Code via the Model Context Protocol.

Claude Code    MCP Server (mcp_server.py)    Listener (uefn_listener.py, inside UEFN)
|--TCP 127.0.0.1:1962-->  UEFN VerseWorkflowServer   (verse_compile / verse_status / verse_push)
|--stdio------------->  verse-lsp.exe                (verse_symbols / verse_hover / ...)
'--files / Win32 ---->  editor log, settings ini, processes   (uefn_status / uefn_launch_project / ...)

110 tools: actors, assets, levels, viewport, materials, Niagara, animations, static meshes, data tables, asset validation, device @editable wiring, Play-In-Editor control, StaticMeshActor scatter, Verse source introspection, Verse compile/push, Verse code navigation, UEFN session status / launch, and arbitrary Python execution
Zero C++ compilation — pure Python, works across UEFN versions
Main-thread safe — all unreal.* calls dispatched via editor tick callback
Autostart — the listener starts by itself when a project opens (see Auto-start)
Crash recovery — the UEFN session tools read the editor state and relaunch UEFN after a crash; see UEFN session and crash recovery
No input simulation — the server never sends mouse or keyboard input; tools that are hard to undo are tagged experimental

What's new in 0.5.0

UEFN session (uefn_session.py, 3 tools): uefn_status (read-only state from the editor log, processes and

ports), uefn_launch_project (start UEFN, open a project, wait for the listener; can stop a crash reporter left over from a crash), `u

Read from source at commit 7f5fa60e3d63OBSERVED · 2026-10-07

Exposed tools (103)

53 read · 42 write · 8 destructive. Blast radius: 8 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

Tool	Risk	Description
`anim_add_float_curve`	write	Create a new float curve on an animation.
`anim_add_float_curve_key`	write	Add a keyframe to a float curve on an animation.
`anim_add_notify`	write	Add a zero-duration typed notify event to a track.
`anim_add_notify_state`	write	Add a duration-based notify state event to a track.
`anim_add_notify_track`	write	Add a new notify track to an AnimSequence/Montage.
`anim_create_blendspace`	write	Create a BlendSpace (2D) or BlendSpace1D asset.
`anim_create_montage`	write	Create an AnimMontage asset from a source AnimSequence.
`anim_get_info`	read	Get basic info about an AnimSequence or AnimMontage (length, class, skeleton).
`anim_list_notifies`	read	List all notify events on an animation with name/time/duration/track/class.
`anim_list_notify_tracks`	read	List notify track names on an AnimSequence/Montage.
`anim_remove_all_notify_tracks`	destructive	Remove all notify tracks (and their events) from an animation.
`asset_find_dependencies`	read	List packages this asset depends on (i.e. what it uses).
`asset_find_referencers`	read	List packages that reference this asset (i.e. what uses it).
`asset_find_unused`	read	Find assets with no referencers in a directory.
`asset_get_metadata`	read	Read all metadata tags on an asset.
`asset_remove_metadata`	destructive	Remove a metadata tag from an asset.
`asset_set_metadata`	write	Set a metadata tag on an asset (e.g.
`datatable_export_csv`	read	Export the whole DataTable as a CSV string.
`datatable_export_json`	read	Export the whole DataTable as a JSON string.
`datatable_get_row`	read	Get a single row of a DataTable (parsed from JSON export).
`datatable_import_csv`	write	Replace all rows in a DataTable from a CSV string. Saves the asset.
`datatable_import_json`	write	Replace all rows in a DataTable from a JSON string. Saves the asset.
`datatable_info`	read	Get DataTable structure, row names, and column names.
`delete_actors`	destructive	Delete actors from the current level by path or label.
`device_list_editables`	read	List all Verse @editable fields on a creative_device actor in the level.
`device_set_editable`	write	Set a Verse @editable field on a creative_device actor.
`device_set_editables_bulk`	write	Set multiple Verse @editable fields on one actor in a single call.
`does_asset_exist`	read	Check if an asset exists at the given path.
`duplicate_asset`	read	Duplicate an asset to a new path.
`focus_selected`	write	Move the viewport camera to focus on the currently selected actors (like pressing F).
`get_actor_properties`	read	Read specific properties from an actor.
`get_all_actors`	read	List all actors in the current level.
`get_asset_info`	read	Get detailed info about an asset.
`get_editor_log`	read	Read recent lines from the Unreal Editor Output Log.
`get_level_info`	read	Get info about the current level (name, actor count).
`get_log`	read	Get recent MCP listener log entries from the UEFN editor.
`get_project_info`	read	Get the UEFN project name and content root path.
`get_selected_actors`	read	Get currently selected actors in the UEFN viewport.
`get_selected_assets`	read	Get assets currently selected in the Content Browser.
`get_viewport_camera`	read	Get the current viewport camera position and rotation.
`list_assets`	read	List assets in a directory.
`material_add_expression`	write	Add an expression node to a material. Returns the node_name to use in later calls.
`material_connect_expressions`	read	Connect an output pin of one expression to an input pin of another. Recompiles material.
`material_connect_property`	read	Connect an expression output to a material attribute (BaseColor, Metallic, etc). Recompiles material.
`material_create`	write	Create a new Material asset.
`material_create_instance`	write	Create a MaterialInstanceConstant from a parent Material.
`material_list_expressions`	read	List all expression nodes in a material with names and classes.
`material_recompile`	destructive	Force recompile of a material and save it.
`material_set_expression_property`	write	Set an editor property on a material expression node.
`material_set_scalar_param`	write	Set a scalar parameter value on a MaterialInstanceConstant.
`material_set_static_switch_param`	write	Set a static switch parameter on a MaterialInstanceConstant (triggers recompile).
`material_set_texture_param`	write	Set a texture parameter value on a MaterialInstanceConstant.
`material_set_vector_param`	write	Set a vector (LinearColor) parameter value on a MaterialInstanceConstant.
`mesh_scatter`	read	Scatter StaticMeshActor instances randomly inside an axis-aligned box.
`niagara_activate`	destructive	Activate the NiagaraComponent on an actor. If reset=True, restarts the simulation.
`niagara_deactivate`	read	Deactivate the NiagaraComponent on an actor.
`niagara_place_actor`	read	Spawn a NiagaraActor in the current level with the given NiagaraSystem asset.
`niagara_reset`	destructive	Reset the particle simulation on an actor
`niagara_set_bool_param`	write	Set a bool user parameter on a NiagaraComponent.
`niagara_set_color_param`	write	Set a LinearColor user parameter on a NiagaraComponent.
`niagara_set_float_param`	write	Set a float user parameter on a NiagaraComponent.
`niagara_set_int_param`	write	Set an int user parameter on a NiagaraComponent.
`niagara_set_system_asset`	write	Swap the NiagaraSystem asset on an actor
`niagara_set_texture_param`	write	Set a Texture user parameter on a NiagaraComponent.
`niagara_set_vec3_param`	write	Set a vec3 user parameter on a NiagaraComponent (position or direction).
`ping`	read	Check if the UEFN editor listener is running and responsive.
`playtest_start`	write	Start a Play-In-Editor session (equivalent to the UEFN Play button).
`playtest_status`	read	Report whether a Play-In-Editor session is currently running.
`playtest_stop`	write	End the current Play-In-Editor session.
`rename_asset`	write	Rename or move an asset.
`save_asset`	write	Save a modified asset.
`save_current_level`	write	Save the current level.
`screenshot_desktop`	read	Capture the whole desktop (or a specific monitor) as a PNG file.
`screenshot_viewport`	read	Capture the UEFN editor viewport as a PNG file.
`search_assets`	read	Search for assets using the Asset Registry.
`select_actors`	read	Select actors in the UEFN viewport.
`set_actor_properties`	write	Set properties on an actor via set_editor_property().
`set_actor_transform`	write	Set an actor
`set_viewport_camera`	write	Move the viewport camera to a position.
`spawn_actor`	read	Spawn an actor in the current level.
`staticmesh_add_collision`	write	Add a simple collision primitive.
`staticmesh_enable_nanite`	write	Enable/disable Nanite on a static mesh (saves it; the Nanite build takes seconds).
`staticmesh_generate_uv`	read	Generate a UV channel on a static mesh with a projection gizmo (saves it when it worked).
`staticmesh_get_info`	read	Get static mesh facts from reads that are safe in UEFN 42.20.
`staticmesh_remove_collisions`	destructive	Remove all simple collisions from a static mesh (saves it). Returns `removed`; read the new
`staticmesh_remove_lods`	destructive	Remove all LODs except LOD0 (saves the mesh). Returns `removed`; read the new LOD count with
`staticmesh_set_lods`	write	Set LODs by triangle reduction. First element = LOD0 (usually 1.0 = full).
`uefn_status`	read	Read-only snapshot of the local UEFN session, no listener needed: state (not_running \| starting
`validate_asset`	write	Run all registered editor validators on one asset. Returns valid/invalid counts.
`validate_folder`	read	Validate all assets under a directory. Good for CI-style content audits.
`validate_selected`	read	Validate assets currently selected in the UEFN Content Browser.
`verse_check_editable_coverage`	read	Source-side audit: find @editable fields of a config class that are
`verse_compile`	read	Compile the Verse project in the open UEFN editor and return errors/warnings.
`verse_definition`	read	Go-to-definition from a position in a .verse file (1-based line/col).
`verse_find_resource_usage`	read	Find usages of each variant of a Verse enum across all `.verse` files.
`verse_find_symbol`	read	Workspace-wide symbol search by name (verse-lsp workspace/symbol).
`verse_hover`	read	Type/signature info at a position in a .verse file (1-based line/col).
`verse_list_editables`	read	List ``@editable`` fields grouped by their enclosing Verse class.
`verse_list_services`	read	List all Verse classes implementing ``i_service`` across the project.
`verse_lsp_restart`	write	Restart the persistent verse-lsp session.
`verse_service_graph`	read	Parse the composition-root file and return the DI graph.
`verse_status`	write	Report current Verse build state & push-availability WITHOUT compiling.
`verse_symbols`	read	Outline a .verse file: classes, functions, vars with line numbers.

Trust audit

BLOCKgrade D · trust 66/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

Layer	What it checks	Result
L0	Provenance & inventory	PASS
L1	Static analysis of the code	FAIL
L2	Instruction surface (what it tells the agent)	WARN
L3	Class-specific surface	WARN
L4	Behavioural (sandbox)	SKIPPED

What the source does

Filesystem: declared (2 observation(s))
Network: declared (5 observation(s))
Shell: declared (1 observation(s))
Dependencies: not all pinned
Secrets in source: none-found

Findings (17)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

uefn_listener.py:422

exec(code, exec_globals)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table

MEDIUMPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250

setup.ps1:175

& schtasks.exe /Query /TN 'UEFN-MCP-hook' *> $null

MEDIUMPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250

setup.ps1:180

Would "schtasks /Create /F /SC HOURLY /TN UEFN-MCP-hook /TR '$tr'$(if ($taskExists) { '  (task exists; refreshed)' })"

MEDIUMPrivilege escalation / persistence · fs.persistence · CWE-269, CWE-250

setup.ps1:182

& schtasks.exe /Create /F /SC HOURLY /TN 'UEFN-MCP-hook' /TR $tr *> $null

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

uefn_session.py:272

for ln in text.lstrip("").splitlines():

MEDIUMObfuscation / stealth · obf.zero_width · CWE-506, CWE-94

uefn_session.py:331

self.scan.feed(raw.decode("utf-8", "replace").rstrip("\r").lstrip(""))

MEDIUMPrompt injection · scope.undeclared_system · CWE-94, CWE-1427

system use found in code, not declared in the description

Why it matters. the description does not admit a capability the code has

Fix. declare system use in the description, or remove it

MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59

anim_remove_all_notify_tracks, asset_remove_metadata, delete_actors, material_recompile, niagara_activate, niagara_reset, staticmesh_remove_collisions, staticmesh_remove_lods

Why it matters. 8 tool(s) can delete or overwrite

Fix. prefer a read-only mode or scoped tokens; the page states the blast radius

LOWCode injection · code.dynamic_import · CWE-78, CWE-94, CWE-95

tests/test_feasibility.py:93

__import__(mod_name)

LOWCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95

tests/_listener_ast.py:65

exec(code, ns)

Why it matters. evaluates text as code

Fix. remove; use a parser or a dispatch table