UEFN ToolbeltBLOCK
UEFN Toolbelt: 362 Python automation tools across 55 categories, with a PySide6 dashboard and an experimental, authenticated same-user loopback bridge for local AI control. Complements Epic's official UEFN MCP; Toolbelt is not exposed through Epic's MCP server.
Overview
From the repository's own README, as read at the audited commit. Badges and raw HTML are left out.
362 Professional Tools for UEFN Python Integration.
Built by Ocean Bennett — 2026
[](https://github.com/undergroundrap/UEFN-TOOLBELT/actions/workflows/ci.yml) [](LICENSE) [](docs/CHANGELOG.md) [](https://github.com/undergroundrap/UEFN-TOOLBELT/discussions)
Historic Discovery — March 22, 2026 On this date, Ocean Bennett became the first person to programmatically catalogue the complete Fortnite Creative device palette using UEFN Python's Asset Registry — 4,698 Creative device Blueprints across 35 categories, extracted from 24,926 total Blueprint assets in the sandboxed UEFN environment. Prior to this, no public tool, script, or documentation existed that mapped the full set of placeable Creative devices accessible from Python. Epic's own documentation covers individual devices. This is the first machine-readable index of the entire palette. The scan also uncovered a critical silent failure pattern in UEFN 40.00's Asset Registry API: deprecatedAssetDataproperties (object_path,asset_class) silently throw inside atry/exceptblock, causing every asset to be skipped with no error message — a bug that would defeat any developer who didn't know to split the exception handling. The full technical breakdown, the category table, and the discovery story are in docs/AI_AUTONOMY.md.
Automate the tedious, script the impossible, and bridge the gap between Python and Verse. UEFN Toolbelt is a master utility designed to leverage the 2026 UEFN Python 3.11 Update, allowing creators to manipulate actors,
d43fba5dd3a0OBSERVED · 2026-10-08Exposed tools (34)
21 read · 11 write · 2 destructive. Blast radius: 2 tools can delete or overwrite — an agent that can be talked into calling a tool can be talked into calling this one.
| Tool | Risk | Description |
|---|---|---|
batch_exec | write | Execute multiple bridge commands in a single UEFN editor tick. |
create_material_instance | write | Create a new MaterialInstanceConstant from a parent material. |
delete_actors | destructive | Delete actors by path name or label. |
delete_asset | destructive | Delete an asset permanently. |
describe_toolbelt_tool | read | Get the full parameter schema for a single UEFN Toolbelt tool. |
does_asset_exist | read | Check if an asset exists at the given path. |
duplicate_asset | read | Duplicate an asset to a new path. |
get_actor_properties | read | Read specific editor properties from an actor. |
get_all_actors | read | List all actors in the current UEFN level. |
get_asset_info | read | Get detailed info (class, package, path) about an asset. |
get_history | read | Get recent command history with per-command timing (elapsed_ms). |
get_level_info | read | Get info about the current level: world name and actor count. |
get_selected_actors | read | Get the actors currently selected in the UEFN viewport. |
get_selected_assets | read | Get assets currently selected in the Content Browser. |
get_viewport_camera | read | Get the current editor viewport camera location and rotation. |
import_asset | write | Import an external file (FBX, PNG, WAV, etc.) into the Content Browser. |
list_assets | read | List assets in a Content Browser directory. |
list_toolbelt_tools | read | List all registered UEFN Toolbelt tools. |
mcp_get_log | read | Get the last N lines from the MCP listener |
ping | read | Check if the UEFN Toolbelt listener is running and get its status. |
redo | read | Redo the last undone action in the UEFN editor. |
rename_asset | write | Rename or move an asset. |
run_toolbelt_tool | write | Run any registered UEFN Toolbelt tool by name. |
save_asset | write | Save a modified asset to disk. |
save_current_level | write | Save the current level to disk. |
search_assets | read | Search for assets using the Asset Registry. |
set_actor_property | write | Set a single editor property on an actor. |
set_actor_transform | write | Set an actor |
set_viewport_camera | write | Move the editor viewport camera. |
spawn_actor | read | Spawn an actor in the current level. |
undo | read | Undo the last action in the UEFN editor. |
verse_book_chapter | read | Fetch a complete chapter from the Verse language spec by topic. |
verse_book_search | read | Search the authoritative Verse language spec for a keyword or concept. |
verse_book_update | write | Pull the latest Verse spec from upstream (git pull on verse-book/). |
Trust audit
BLOCKgrade D · trust 65/100 Do not install this without reading the findings. The audit found something that could harm you or your machine.
| Layer | What it checks | Result |
|---|---|---|
| L0 | Provenance & inventory | PASS |
| L1 | Static analysis of the code | WARN |
| L2 | Instruction surface (what it tells the agent) | FAIL |
| L3 | Class-specific surface | WARN |
| L4 | Behavioural (sandbox) | SKIPPED |
What the source does
- Filesystem
- declared (4 observation(s))
- Network
- declared (11 observation(s))
- Shell
- declared (2 observation(s))
- Dependencies
- pinned
- Secrets in source
- none-found
Findings (25)
L:1 Log file open, 09/28/26 16:02:00
importlib.import_module(module_name)
_mod = importlib.import_module(_name)
"Mutator", "Beacon", "Guard", "Ammo", "Chest",
"Beacon", "Trigger", "Timer", "SpawnPad", "Zone", "Tracker",
"beacon": "capture_area_device",
_log(f"Listener started on http://127.0.0.1:{port}")"url": f"http://127.0.0.1:{_bound_port}" if _bound_port else None,f"[MCP] ✓ Listener running on http://127.0.0.1:{p}\n"h_zmov.addWidget(QLabel("ΔX:")); h_zmov.addWidget(zone_dx_s)h_zmov.addWidget(QLabel("ΔY:")); h_zmov.addWidget(zone_dy_s)h_zmov.addWidget(QLabel("ΔZ:")); h_zmov.addWidget(zone_dz_s); h_zmov.addStretch()delete_actors, delete_asset
.claudeignore
.mcp.json.template
__import__(mod)
__import__(mod)
"../../audits/2026-09-28-wo004-session-c-live-acceptance.md",
dict(os.environ) ... urllib.request
│ HTTP POST to http://127.0.0.1:8765
# Output Log: [MCP] ✓ Listener running on http://127.0.0.1:8765
docs/uefn_reference_schema.json
docs/uefn_tutorial_schema.json
docs/unreal_key_classes.pyi
> Python editor scripts run with full access to your project — treat them like executable code.
Gates applied: no_behavioural_pass.
d43fba5dd3a0full audit observations/trust-audit/mcp-server/undergroundrap__uefn-toolbelt.json · Report an issue / request a re-scanAudit history
Every audit this server has had. A grade with a past is a grade somebody is still checking.
| Date | Source | Verdict | Grade | Score | Change |
|---|---|---|---|---|---|
| 2026-10-08 | d43fba5dd3a0 | BLOCK | D | 65 | first audit |
Questions
What is the UEFN Toolbelt MCP server?
UEFN Toolbelt: 362 Python automation tools across 55 categories, with a PySide6 dashboard and an experimental, authenticated same-user loopback bridge for local AI control. Complements Epic's official UEFN MCP; Toolbelt is not exposed through Epic's MCP server.
What tools does UEFN Toolbelt expose?
34 in total: 21 read-only, 11 that write, and 2 that can delete or overwrite (delete_actors, delete_asset). Every one is listed on this page with its risk.
Is UEFN Toolbelt safe to connect to an agent?
No — not without reading the findings first. The audit graded it D (65/100) and found 1 critical or high issue in the source. Each one is listed on this page with the file and line it is on. Separately from the audit: 2 of its tools can destroy data, so scope the token you give it to what you actually need.
What credentials does UEFN Toolbelt need?
It reads UEFN_MCP_TOKEN_FILE from the environment. Give it a token scoped to the least it needs — an agent that can be talked into calling a tool can be talked into calling it with your credentials.
How current is this page?
The grade is for one exact copy of the source (d43fba5dd3a0), read on 2026-10-08. The repository is watched and re-audited when it changes.