registry / funplay-cocos-mcp / 0.4.1

funplay-cocos-mcp@0.4.1

Embedded MCP server for Cocos Creator with scene script execution, project resources, prompts, and file/scene tools.

AI Security Review

scanned 8d ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.

Trigger

A user starts the extension/server and an MCP client invokes execution or configuration tools.

Impact

A connected local MCP client can execute privileged editor/scene code and mutate the Cocos project; explicit setup can modify supported AI-client configs.

Mechanism

Local MCP-controlled editor automation, script execution, and explicit AI-client configuration writes.

Rationale

No concrete malicious chain was found, but the package exposes high-impact MCP code execution and explicit multi-client AI-agent configuration mutation. Under the firewall policy, this warrants a warning rather than a block.

Evidence

package.jsonbrowser.jsscene.jslib/tool-registry.jslib/client-config.jslib/javascript-safety.jslib/update-checker.jslib/updater.js

Network endpoints2

api.github.com/repos/FunplayAI/funplay-cocos-mcp/releases/latest127.0.0.1:8765/

funplay-cocos-mcp@0.4.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code