registry / ue-mcp / 1.1.8

ue-mcp@1.1.8

⚠ Under review

Unreal Engine MCP server - 23 tools, 631+ actions for AI-driven editor control

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 86 file(s), 652 KB of source, external domains: api.github.com, cli.github.com, github.com, registry.npmjs.org, ue-mcp.com

Source & flagged code

7 flagged

dist/editor-control.jsView file

Lines 1-22javascript

1import * as fs from "node:fs";

2import * as path from "node:path";

3import { spawn, execSync } from "child_process";

4import * as net from "net";

High

Child Process

Package source references child process execution.

dist/editor-control.jsView on unpkg · L2

5import { findEngineInstall } from "./deployer.js";

6// editor-control relies on Windows-only tools (tasklist/taskkill, Build.bat).

7// The MCP server itself is cross-platform; only process control is gated.

8const IS_WINDOWS = process.platform === "win32";

9const WINDOWS_ONLY_MSG = "editor start/stop/restart is Windows-only. On macOS/Linux, start and stop the Unreal Editor manually; ue-mcp will reconnect when the bridge is reachable.";

10function findUEBuildTool() {

11 const envPath = process.env.UE_BUILD_TOOL_PATH;

12 if (envPath)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/editor-control.jsView on unpkg · L2

13 return envPath;

14 const versions = ["5.8", "5.7", "5.6", "5.5", "5.4", "5.3"];

15 const scriptName = IS_WINDOWS ? "Build.bat" : "Build.sh";

16 const searchRoots = IS_WINDOWS

17 ? [

18 "C:/Program Files/Epic Games",

19 "D:/Program Files/Epic Games",

20 "E:/Program Files/Epic Games",

21 "C:/Epic Games",

22 "D:/Epic Games",

Lines 234-274javascript

234 const buildTool = findUEBuildTool();

235 if (!buildTool) {

236 return {

237 success: false,

238 exitCode: null,

239 message: "Unreal Engine build tool not found. Set UE_BUILD_TOOL_PATH or install UE5.3+ to a default location.",

240 };

241 }

dist/update.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import { execSync } from "node:child_process";

3import { createRequire } from "node:module";

4import * as path from "node:path";

5import { fileURLToPath } from "node:url";

6import { collectDoctor, formatDoctor }

dist/resolve.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2/**

3 * npx ue-mcp resolve <issue-number>

4 *

5 * Fetches a GitHub issue, creates a branch, launches Claude Code to

6 * implement the fix, then pushes and opens a PR. Never merges to main.

7 */

8import { execSync, spawn } from "node:child_process";

9import * as fs from "node:fs"

dist/index.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = ue-mcp@1.0.86 matchedIdentity = npm:dWUtbWNw:1.0.86 similarity = 0.923 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/editor-control.jsView file

2import * as path from "node:path"; L3: import { spawn, execSync } from "child_process"; L4: import * as net from "net";

High

Child Process

Package source references child process execution.

dist/editor-control.jsView on unpkg · L2

254const fullCommand = `cmd /c "${quotedCommand} ${buildArgs.join(" ")}"`; L255: proc = spawn(fullCommand, [], { shell: true, stdio: "pipe" }); L256: }

High

Shell

Package source references shell execution.

dist/editor-control.jsView on unpkg · L254

2import * as path from "node:path"; L3: import { spawn, execSync } from "child_process"; L4: import * as net from "net"; L5: import { findEngineInstall } from "./deployer.js"; ... L10: function findUEBuildTool() { L11: const envPath = process.env.UE_BUILD_TOOL_PATH; L12: if (envPath)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/editor-control.jsView on unpkg · L2

dist/update.jsView file

74console.log(""); L75: const cmd = isGlobalInstall() ? `npm install -g ue-mcp@${latest}` : `npm install ue-mcp@${latest}`; L76: try { L77: execSync(cmd, { stdio: "inherit" }); L78: console.log("");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/update.jsView on unpkg · L74

17function getInstalledVersion() { L18: const require = createRequire(import.meta.url); L19: return require("../package.json").version;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/update.jsView on unpkg · L17

dist/resolve.jsView file

7*/ L8: import { execSync, spawn } from "node:child_process"; L9: import * as fs from "node:fs"; ... L41: const args = process.argv.slice(3); L42: const ciMode = args.includes("--ci") || !!process.env.CI; L43: const issueArg = args.find((a) => !a.startsWith("-")); ... L54: if (!hasCommand("gh")) L55: fail("gh CLI is required. Install: https://cli.github.com"); L56: if (!hasCommand("claude")) ... L90: const raw = run(`gh issue view ${issueNum} --repo db-lyon/ue-mcp --json title,body,labels`); L91: issue = JSON.parse(raw); L92: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/resolve.jsView on unpkg · L7

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Findings

1 Critical5 High4 Medium5 Low

CriticalPrevious Version Dangerous Deltadist/index.js

HighChild Processdist/editor-control.js

HighShelldist/editor-control.js

HighSame File Env Network Executiondist/editor-control.js

HighSandbox Evasion Gated Capabilitydist/resolve.js

HighRuntime Package Installdist/update.js

MediumDynamic Requiredist/update.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/editor-control.jsView file

Lines 1-22javascript

1import * as fs from "node:fs";

2import * as path from "node:path";

3import { spawn, execSync } from "child_process";

4import * as net from "net";

High

Child Process

Package source references child process execution.

dist/editor-control.jsView on unpkg · L2

5import { findEngineInstall } from "./deployer.js";

6// editor-control relies on Windows-only tools (tasklist/taskkill, Build.bat).

7// The MCP server itself is cross-platform; only process control is gated.

8const IS_WINDOWS = process.platform === "win32";

9const WINDOWS_ONLY_MSG = "editor start/stop/restart is Windows-only. On macOS/Linux, start and stop the Unreal Editor manually; ue-mcp will reconnect when the bridge is reachable.";

10function findUEBuildTool() {

11 const envPath = process.env.UE_BUILD_TOOL_PATH;

12 if (envPath)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/editor-control.jsView on unpkg · L2

13 return envPath;

14 const versions = ["5.8", "5.7", "5.6", "5.5", "5.4", "5.3"];

15 const scriptName = IS_WINDOWS ? "Build.bat" : "Build.sh";

16 const searchRoots = IS_WINDOWS

17 ? [

18 "C:/Program Files/Epic Games",

19 "D:/Program Files/Epic Games",

20 "E:/Program Files/Epic Games",

21 "C:/Epic Games",

22 "D:/Epic Games",

Lines 234-274javascript

234 const buildTool = findUEBuildTool();

235 if (!buildTool) {

236 return {

237 success: false,

238 exitCode: null,

239 message: "Unreal Engine build tool not found. Set UE_BUILD_TOOL_PATH or install UE5.3+ to a default location.",

240 };

241 }

dist/update.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import { execSync } from "node:child_process";

3import { createRequire } from "node:module";

4import * as path from "node:path";

5import { fileURLToPath } from "node:url";

6import { collectDoctor, formatDoctor }

dist/resolve.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2/**

3 * npx ue-mcp resolve <issue-number>

4 *

5 * Fetches a GitHub issue, creates a branch, launches Claude Code to

6 * implement the fix, then pushes and opens a PR. Never merges to main.

7 */

8import { execSync, spawn } from "node:child_process";

9import * as fs from "node:fs"

dist/index.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/index.jsView on unpkg

Lines 54-94javascript

54 const shouldDeploy = shouldBuild || args.includes("--deploy");

55 const projectArg = args.find((a) => !a.startsWith("-"));

56 console.log("");

57 console.log(` ${BOLD}${CYAN}UE-MCP Update${shouldBuild ? " --build" : ""}${RESET}`);

58 console.log("");

59 const installed = getInstalledVersion();

60 console.log(` Installed: ${BOLD}${installed}${RESET}`);

61 const latest = getLatestVersion();

62 if (!latest) {

63 fail("Could not reach npm registry. Check your network connection.");

64 process.exit(1);

65 }

66 console.log(` Latest: ${BOLD}${latest}${RESET}`);

67 console.log("");

68 // 1. Update the package this CLI lives in (global or local).

69 if (installed === latest) {

70 ok("Package already up to date");

71 }

72 else {

73 console.log(` ${YELLOW}Updating ue-mcp ${installed} -> ${latest}...${RESET}`);

74 console.log("");

75 const cmd = isGlobalInstall() ? `npm install -g ue-mcp@${latest}` : `npm install ue-mcp@${latest}`;

76 try {

77 execSync(cmd, { stdio: "inherit" });

78 console.log("");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/update.jsView on unpkg · L74

79 ok(`Updated to ${latest}`);

80 }

81 catch {

82 console.log("");

83 fail(`npm install failed. Try manually: ${cmd}`);

84 process.exit(1);

85 }

86 }

87 // 2. Detect a project-local node_modules/ue-mcp that would shadow the global

88 // install (npx prefers it). If it is behind, align it to latest so the

89 // server actually runs the new version. (#550)

90 const preDoctor = collectDoctor(projectArg);

91 if (preDoctor.localShadow && preDoctor.localShadow.version !== latest) {

92 const shadowProjectRoot = path.dirname(path.dirname(preDoctor.localShadow.dir));

93 console.log("");

94 console.log(` ${YELLOW}Local shadow detected: node_modules/ue-mcp@${preDoctor.localShadow.version} (npx runs this, not the global).${RESET}`);