Atlas / MCP servers / prajwalshettydev / UnrealGenAI

UnrealGenAIBLOCK

mcp/prajwalshettydev/unrealgenai

Unreal Engine plugin for LLM/GenAI models & MCP UE5 server. OpenAI GPT-5, Deepseek R1, Claude Opus/Sonnet, Gemini 3, Grok 4, Alibaba Qwen, Kimi, ElevenLabs TTS, Inworld, OpenRouter, Groq, GLM, Ollama, Local, Meshy, Tripo, Hunyuan3D, Rodin, fal, Dashscope, Seedream. NPC AI, agentic, chat, 3D gen, TTS

Verdict
BLOCK
Grade
D
Trust score
69 /100
Exposed tools
29 12r · 16w · 1d
Transport
—
License
MIT
Stars
652
01

Overview

From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.

[](LICENSE) [](https://discord.com/invite/KBWmkCKv5U)

Usage Examples:

MCP Example:

Claude spawning scene objects and controlling their transformations and materials, generating blueprints, functions, variables, adding components, running python scripts etc.

API Example:

A project called become human, where NPCs are OpenAI agentic instances. Built using this plugin.

Every month, hundreds of new AI models are released by various organizations, making it hard to keep up with the latest advancements.

The "Unreal Engine Generative AI Support Plugin" allows you to focus on game development without worrying about the LLM/GenAI integration layer.

Current Progress:

This plugin will continue to get updates with the latest features and models. Contributions are welcome. For production-ready alternatives with 200+ AI models, guaranteed stability, automated testing, and UE 5.1-5.7+ support, check out the pro plugins below. **This free plugin covers man

Read from source at commit 452fb40729d5OBSERVED · 2026-09-28
02

Exposed tools (29)

12 read · 16 write · 1 destructive. Blast radius: 1 tool can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.

ToolRiskDescription
add_component_to_blueprintwrite
add_component_with_eventswrite
add_function_to_blueprintwrite
add_input_bindingwrite
add_node_to_blueprintwrite
add_variable_to_blueprintwrite
add_widget_to_user_widgetwrite
compile_blueprintread
connect_blueprint_nodesreadcommand = {
connect_blueprint_nodes_bulkread
create_blueprintwrite
create_game_modewriteCreate a game mode Blueprint, set its default pawn, and assign it as the current scene’s default game mode.
create_materialwrite
create_project_folderwrite
delete_node_from_blueprintdestructive
edit_component_propertywrite
edit_widget_propertywrite
execute_python_scriptwrite
execute_unreal_commandwrite
get_all_nodes_in_graphread
get_all_scene_objectsread
get_blueprint_node_guidread
get_files_in_folderread
get_node_suggestionsread
handshake_testwriteSend a handshake message to Unreal Engine
how_to_usereadHey LLM, this grabs the how_to_use.md from knowledge_base—it
spawn_blueprint_actorread
spawn_objectread
take_editor_screenshotread
03

Trust audit

BLOCKgrade D · trust 69/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.

LayerWhat it checksResult
L0Provenance & inventoryWARN
L1Static analysis of the codeFAIL
L2Instruction surface (what it tells the agent)WARN
L3Class-specific surfaceWARN
L4Behavioural (sandbox)SKIPPED

What the source does

Filesystem
UNDECLARED (6 observation(s))
Network
none-observed
Shell
UNDECLARED (1 observation(s))
Dependencies
pinned
Secrets in source
none-found

Findings (15)

HIGHCode injection · code.eval_exec · CWE-78, CWE-94, CWE-95
Content/Python/handlers/python_commands.py:26
exec(f.read())
Why it matters. evaluates text as code
Fix. remove; use a parser or a dispatch table
MEDIUMInventory / provenance · inv.binary · CWE-1104
Content/ExampleBlueprints/ChatAPIExamples.uasset
ChatAPIExamples.uasset
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
Content/Python/__pycache__/plugin_settings.cpython-311.pyc
plugin_settings.cpython-311.pyc
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
Content/Python/__pycache__/unreal_socket_server.cpython-311.pyc
unreal_socket_server.cpython-311.pyc
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
Content/Python/handlers/__pycache__/__init__.cpython-311.pyc
__init__.cpython-311.pyc
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMInventory / provenance · inv.binary · CWE-1104
Content/Python/handlers/__pycache__/actor_commands.cpython-311.pyc
actor_commands.cpython-311.pyc
Why it matters. a compiled or binary member cannot be reviewed from source
Fix. ship source, or explain the binary in the README
MEDIUMFilesystem / path · fs.destructive · CWE-22, CWE-59
Content/Python/handlers/basic_commands.py:134
os.remove(screenshot_path)
MEDIUMFilesystem / path · fs.destructive · CWE-22, CWE-59
Content/Python/handlers/python_commands.py:164
os.remove(file)
MEDIUMFilesystem / path · fs.destructive · CWE-22, CWE-59
Content/Python/handlers/python_commands.py:199
os.remove(file)
MEDIUMFilesystem / path · fs.destructive · CWE-22, CWE-59
Content/Python/mcp_server.py:33
os.remove(pid_path)
MEDIUMFilesystem / path · fs.destructive · CWE-22, CWE-59
Content/Python/mcp_server.py:414
os.remove(temp_path)
MEDIUMPrompt injection · scope.undeclared_shell · CWE-94, CWE-1427
<declared scope>
shell use found in code, not declared in the description
Why it matters. the description does not admit a capability the code has
Fix. declare shell use in the description, or remove it
MEDIUMFilesystem / path · mcp.destructive_tools · CWE-22, CWE-59
delete_node_from_blueprint
Why it matters. 1 tool(s) can delete or overwrite
Fix. prefer a read-only mode or scoped tokens; the page states the blast radius
INFOInventory / provenance · inv.oversize · CWE-1104
Docs/BHDemoGif.gif
Docs/BHDemoGif.gif
Why it matters. 3213346 bytes not read
INFOInventory / provenance · inv.oversize · CWE-1104
Docs/UnrealMcpDemo.gif
Docs/UnrealMcpDemo.gif
Why it matters. 4713390 bytes not read

Gates applied: no_behavioural_pass.

Audited 2026-09-28 · audit v0.4.1 · source sha 452fb40729d5full audit observations/trust-audit/mcp-server/prajwalshettydev__unrealgenai.json · Report an issue / request a re-scan
04

Audit history

Every audit this server has had. A grade with a past is a grade somebody is still checking.

DateSourceVerdictGradeScoreChange
2026-09-28452fb40729d5BLOCKD69first audit
05

Questions

What is the UnrealGenAI MCP server?

Unreal Engine plugin for LLM/GenAI models & MCP UE5 server. OpenAI GPT-5, Deepseek R1, Claude Opus/Sonnet, Gemini 3, Grok 4, Alibaba Qwen, Kimi, ElevenLabs TTS, Inworld, OpenRouter, Groq, GLM, Ollama, Local, Meshy, Tripo, Hunyuan3D, Rodin, fal, Dashscope, Seedream. NPC AI, agentic, chat, 3D gen, TTS

What tools does UnrealGenAI expose?

29 in total: 12 read-only, 16 that write, and 1 that can delete or overwrite (delete_node_from_blueprint). Every one is listed on this page with its risk.

Is UnrealGenAI safe to connect to an agent?

No — not without reading the findings first. The audit graded it D (69/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 1 of its tools can destroy data, so scope the token you give it to what you actually need.

What credentials does UnrealGenAI need?

No credential environment variables were found in its source, so it appears to need none.

How current is this page?

The grade is for one exact copy of the source (452fb40729d5), read on 2026-09-28. The repository is watched and re-audited when it changes.

Advertisement