registry / godot-mcp-enhanced / 0.23.0

godot-mcp-enhanced@0.23.0

Enhanced MCP server for Godot game engine - closed-loop AI development with dynamic GDScript execution, scene tree query, node inspection, and more

AI Security Review

scanned 19h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User starts the MCP server, invokes an MCP execution tool, or runs `godot-mcp-enhanced setup`.

Impact

An authorized MCP client can cause project-scoped Godot/GDScript actions; double opt-in can disable the GDScript safety filter.

Mechanism

Godot subprocess execution, local editor IPC, and explicit client configuration.

Rationale

No concrete malicious chain was found, but the package intentionally grants an AI client powerful project execution and configuration capabilities. Treat it as a warned dangerous capability rather than malware.

Evidence

package.jsonbuild/index.jsbuild/cli/router.jsbuild/cli/setup.jsbuild/cli/clients/codex.jsbuild/gdscript-executor.jsbuild/core/EditorConnection.jsscripts/install-plugin.js/tmp/godot-mcp-exec<project>/addons/godot_mcp_server<project>/.claude/settings.json<project>/.cursor/mcp.json<project>/opencode.json

Network endpoints

godot-mcp-enhanced@0.23.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code