registry / funplay-cocos-mcp / 0.4.2

funplay-cocos-mcp@0.4.2

Embedded MCP server for Cocos Creator with scene script execution, project resources, prompts, and file/scene tools.

AI Security Review

scanned 21h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

Loading the Cocos extension starts the server by default; an MCP client must invoke its tools or explicit client-configuration action.

Impact

A connected MCP client can modify the Cocos project and execute code in the editor context; safety checks can be disabled per request.

Mechanism

localhost MCP agent automation with arbitrary editor/scene JavaScript execution

Rationale

No install-time execution or covert malicious behavior was found. The package warrants a warning because its intentional MCP surface enables arbitrary editor-side code execution and explicit AI-client configuration writes.

Evidence

package.jsonbrowser.jsscene.jslib/config.jslib/tool-registry.jslib/client-config.jslib/project-instructions.jsfunplay-cocos-mcp.config.json.claude.json.cursor/mcp.json.codex/config.toml.codex/skills/{skillName}/SKILL.md

Network endpoints2

funplay-cocos-mcp@0.4.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code