Godot (ChanceFlow) MCP Server
godot-mcp
PyPI
v0.1.1
Published by chanceflow — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
MCP server for interfacing with Godot game engine. Provides tools for launching the editor, running projects, and capturing debug output.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 7 = 93. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 3
high Shell/command execution in server code (godot_mcp/core.py)MTC-SRC-002
In the server's implementation (`godot_mcp/core.py:221`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: {cmd}") proc = subprocess.Popen( cmd, shell=True, stdout=subprocess.PIPE,
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server godot_mcp/core.py
high Shell/command execution in server code (godot_mcp/tools/project.py)MTC-SRC-002
In the server's implementation (`godot_mcp/tools/project.py:220`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: path}") proc = subprocess.Popen( cmd, shell=True, stdout=subprocess.PIPE,
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server godot_mcp/tools/project.py
low Shell/command execution in packaging/dev tooling (tests/conftest.py)MTC-SRC-002
In a packaging/dev/install script (shipped, but not the server runtime) (`tests/conftest.py:158`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: wnload result = subprocess.run( [ "git", "clone", "-
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server tests/conftest.py
Tools 84
Each tool and what it can reach — statically extracted from the published source.
animation_add_trackno sensitive capabilityanimation_createno sensitive capabilityanimation_get_infono sensitive capabilityanimation_listno sensitive capabilityanimation_set_keyframeno sensitive capabilityaudio_add_stream_playerno sensitive capabilityaudio_configure_busno sensitive capabilityaudio_set_streamno sensitive capabilityautoload_addno sensitive capabilityautoload_listno sensitive capability
Show 74 more tools ↓
autoload_removeno sensitive capabilitycamera_addno sensitive capabilitycamera_get_infono sensitive capabilitycamera_set_currentno sensitive capabilitycamera_set_propertiesno sensitive capabilitycanvas_layer_addno sensitive capabilitycanvas_layer_configureno sensitive capabilitycanvas_layer_set_orderno sensitive capabilitycollision_add_shapeno sensitive capabilitycollision_set_layersno sensitive capabilitycollision_set_shape_propertiesno sensitive capabilityeditor_launchno sensitive capabilityenvironment_setupno sensitive capabilitygodot_get_versionno sensitive capabilityinput_list_actionsno sensitive capabilityinput_setup_actionno sensitive capabilitylight_addno sensitive capabilitylight_set_propertiesno sensitive capabilitylight_set_shadowno sensitive capabilitynavigation_add_agentno sensitive capabilitynavigation_add_obstacleno sensitive capabilitynavigation_add_regionno sensitive capabilitynavigation_set_navmeshno sensitive capabilitynode_addno sensitive capabilitynode_add_to_groupno sensitive capabilitynode_deleteno sensitive capabilitynode_duplicateno sensitive capabilitynode_get_propertiesno sensitive capabilitynode_load_sprite_textureno sensitive capabilitynode_renameno sensitive capabilitynode_reparentno sensitive capabilitynode_set_propertyno sensitive capabilityparticle_add_systemno sensitive capabilityparticle_set_propertiesno sensitive capabilityparticle_start_emittingno sensitive capabilityphysics_set_body_propertiesno sensitive capabilityproject_exportno sensitive capabilityproject_get_debug_outputno sensitive capabilityproject_get_infono sensitive capabilityproject_listno sensitive capabilityproject_list_export_presetsno sensitive capabilityproject_runno sensitive capabilityproject_setting_getno sensitive capabilityproject_setting_setno sensitive capabilityproject_stopno sensitive capabilityproject_update_uidsno sensitive capabilityresource_create_materialno sensitive capabilityresource_export_mesh_libraryno sensitive capabilityresource_get_material_propertiesno sensitive capabilityresource_get_uidno sensitive capabilityresource_listno sensitive capabilityscene_createno sensitive capabilityscene_get_treeno sensitive capabilityscene_instantiateno sensitive capabilityscene_listno sensitive capabilityscene_saveno sensitive capabilityscript_attachno sensitive capabilityscript_createno sensitive capabilityscript_detachno sensitive capabilityscript_listno sensitive capabilitysignal_connectno sensitive capabilitysignal_disconnectno sensitive capabilitysignal_list_connectionsno sensitive capabilitysignal_list_node_signalsno sensitive capabilitytilemap_get_cellno sensitive capabilitytilemap_set_cellno sensitive capabilitytimer_addno sensitive capabilitytimer_configureno sensitive capabilityui_add_containerno sensitive capabilityui_add_controlno sensitive capabilityui_set_layoutno sensitive capabilityviewport_addno sensitive capabilityviewport_configureno sensitive capabilityviewport_set_sizeno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (84 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.1.1 latest |
A 93/100 | 3 | 1.13.0 | 2026-08-25 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan godot-mcp --online --registry pypiOther implementations of Godot 16
Independent packages implementing the same tool, scanned with the same engine. Compare all 17 side by side →
MCP server that connects AI coding assistants to the Godot 4.2+ editor (scenes, nodes, scripts, ClassDB, playtests) via the companion godot-mcp-toolkit plugin.
Model Context Protocol server for Godot 4.6.2+
MCP server for Godot 4 — docs lookup and project file analysis
MCP server that gives AI assistants eyes and hands in the Godot editor: scene editing, input injection, deterministic game-time control, and live runtime state for agent-driven playtesting
MCP server for Godot integration
Interfaces with the Godot game engine, with tools for launching the editor, running projects, and capturing debug output.
More in Developer Tools
Hotel booking MCP server — 300K+ properties, real confirmation numbers, loyalty programs. Builders monetize every booking via Stripe Connect. The first MCP server that completes real hotel reservations inside AI conversations.
Manage AdGuard Home through AI assistants
Read-only Azure DevOps for MCP clients using only your existing browser session — no PAT, no Azure CLI. Browse work items, pull requests, comments, attachments and Artifacts feeds across every project, repo and feed you can access.
MCP server for Adobe Experience Manager Assets integration development
Servidor MCP para el tiempo oficial de España (API pública OpenData de AEMET). Predicción, observación y avisos como herramientas MCP tipadas.
A standalone MCP stdio bridge for Affinity by Canva's local MCP SSE server.