Unrealmcp MCP Server
unrealmcp
PyPI
v1.3.0
Published by aadeshrao123 — no publish provenance, so origin is unverified, but the source is public: the repository link below is self-declared yet readable, so you can inspect the code before adopting it.
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 7 = 93. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −1 | publisher verification (public source) — no provenance, but the source is public and inspectable |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 8
high Tool "spawn_actor" exposes command/code executionMTC-CAP-001
Tool "spawn_actor" appears to run shell commands or evaluate code (keyword "spawn" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool spawn_actor
high Tool "spawn_blueprint_actor" exposes command/code executionMTC-CAP-001
Tool "spawn_blueprint_actor" appears to run shell commands or evaluate code (keyword "spawn" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool spawn_blueprint_actor
high Tool "spawn_actor_by_class" exposes command/code executionMTC-CAP-001
Tool "spawn_actor_by_class" appears to run shell commands or evaluate code (keyword "spawn" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool spawn_actor_by_class
high Tool "spawn_niagara_effect" exposes command/code executionMTC-CAP-001
Tool "spawn_niagara_effect" appears to run shell commands or evaluate code (keyword "spawn" in tool name). Arbitrary execution driven by model input is one of the most dangerous MCP capabilities; combined with any untrusted input it becomes RCE.
Fix: Sandbox execution, allowlist commands/arguments, and never pass model output to a shell unescaped.
Location: tool spawn_niagara_effect
low Mutating tool "spawn_actor" declares no destructiveHintMTC-CAP-005
Tool "spawn_actor" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool spawn_actor
low Mutating tool "spawn_blueprint_actor" declares no destructiveHintMTC-CAP-005
Tool "spawn_blueprint_actor" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool spawn_blueprint_actor
low Mutating tool "spawn_actor_by_class" declares no destructiveHintMTC-CAP-005
Tool "spawn_actor_by_class" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool spawn_actor_by_class
low Mutating tool "spawn_niagara_effect" declares no destructiveHintMTC-CAP-005
Tool "spawn_niagara_effect" can mutate/egress but declares no destructiveHint. Clients that don't default to spec-safe behavior may not prompt before running it.
Fix: Declare accurate annotations, and gate destructive tools on user confirmation regardless.
Location: tool spawn_niagara_effect
Tools 200
Each tool and what it can reach — statically extracted from the published source.
spawn_actorruns code / shellspawn_actor_by_classruns code / shellspawn_blueprint_actorruns code / shellspawn_niagara_effectruns code / shelladd_blueprint_nodeno sensitive capabilityadd_component_to_blueprintno sensitive capabilityadd_data_table_rowno sensitive capabilityadd_event_nodeno sensitive capabilityadd_function_inputno sensitive capabilityadd_function_outputno sensitive capability
Show 190 more tools ↓
add_input_action_modifierno sensitive capabilityadd_input_action_triggerno sensitive capabilityadd_key_mappingno sensitive capabilityadd_mapping_modifierno sensitive capabilityadd_mapping_triggerno sensitive capabilityadd_mass_config_traitno sensitive capabilityadd_material_commentsno sensitive capabilityadd_material_expressionno sensitive capabilityadd_material_function_inputno sensitive capabilityadd_material_function_outputno sensitive capabilityadd_niagara_componentno sensitive capabilityadd_niagara_emitterno sensitive capabilityadd_niagara_event_handlerno sensitive capabilityadd_niagara_moduleno sensitive capabilityadd_niagara_rendererno sensitive capabilityadd_niagara_simulation_stageno sensitive capabilityadd_niagara_user_parameterno sensitive capabilityanalyze_blueprint_graphno sensitive capabilityapply_material_to_actorno sensitive capabilityapply_material_to_blueprintno sensitive capabilitybuild_material_function_graphno sensitive capabilitybuild_material_graphno sensitive capabilitycleanup_material_functionno sensitive capabilitycleanup_material_graphno sensitive capabilitycompile_blueprintno sensitive capabilitycompile_niagara_systemno sensitive capabilityconnect_blueprint_nodesno sensitive capabilityconnect_material_expressionsno sensitive capabilitycontrol_niagara_effectno sensitive capabilitycreate_blueprintno sensitive capabilitycreate_blueprint_functionno sensitive capabilitycreate_blueprint_variableno sensitive capabilitycreate_data_assetno sensitive capabilitycreate_input_actionno sensitive capabilitycreate_input_mapping_contextno sensitive capabilitycreate_materialno sensitive capabilitycreate_material_functionno sensitive capabilitycreate_material_instanceno sensitive capabilitycreate_niagara_scratch_pad_moduleno sensitive capabilitycreate_niagara_systemno sensitive capabilitydelete_actorno sensitive capabilitydelete_assetno sensitive capabilitydelete_blueprint_functionno sensitive capabilitydelete_blueprint_nodeno sensitive capabilitydelete_data_table_rowno sensitive capabilitydelete_material_expressionno sensitive capabilitydelete_niagara_scratch_pad_moduleno sensitive capabilitydelete_niagara_systemno sensitive capabilitydisconnect_material_expressionno sensitive capabilityduplicate_assetno sensitive capabilityduplicate_data_table_rowno sensitive capabilityduplicate_material_expressionno sensitive capabilityduplicate_niagara_emitterno sensitive capabilityduplicate_niagara_scratch_pad_moduleno sensitive capabilityexecute_pythonno sensitive capabilityfind_actorsno sensitive capabilityfind_actors_by_nameno sensitive capabilityfind_assetsno sensitive capabilityfind_referencesno sensitive capabilityget_actor_material_infono sensitive capabilityget_actor_propertiesno sensitive capabilityget_actor_property_metadatano sensitive capabilityget_actors_in_levelno sensitive capabilityget_asset_infono sensitive capabilityget_asset_propertiesno sensitive capabilityget_available_material_pinsno sensitive capabilityget_available_materialsno sensitive capabilityget_blueprint_class_defaultsno sensitive capabilityget_blueprint_function_detailsno sensitive capabilityget_blueprint_material_infono sensitive capabilityget_blueprint_variable_detailsno sensitive capabilityget_data_asset_propertiesno sensitive capabilityget_data_table_rowno sensitive capabilityget_data_table_rowsno sensitive capabilityget_data_table_schemano sensitive capabilityget_expression_type_infono sensitive capabilityget_input_actionno sensitive capabilityget_input_mapping_contextno sensitive capabilityget_mass_config_traitsno sensitive capabilityget_material_errorsno sensitive capabilityget_material_expression_infono sensitive capabilityget_material_function_infono sensitive capabilityget_material_graph_nodesno sensitive capabilityget_material_infono sensitive capabilityget_material_instance_parametersno sensitive capabilityget_material_property_connectionsno sensitive capabilityget_mcp_token_statsno sensitive capabilityget_niagara_actorsno sensitive capabilityget_niagara_emitter_attributesno sensitive capabilityget_niagara_emittersno sensitive capabilityget_niagara_event_handlersno sensitive capabilityget_niagara_graph_nodesno sensitive capabilityget_niagara_module_inputsno sensitive capabilityget_niagara_module_versionsno sensitive capabilityget_niagara_modulesno sensitive capabilityget_niagara_node_infono sensitive capabilityget_niagara_particle_statsno sensitive capabilityget_niagara_playback_rangeno sensitive capabilityget_niagara_rapid_iteration_parametersno sensitive capabilityget_niagara_renderer_infono sensitive capabilityget_niagara_renderer_propertiesno sensitive capabilityget_niagara_system_errorsno sensitive capabilityget_niagara_system_infono sensitive capabilityget_niagara_user_parametersno sensitive capabilityget_property_valid_typesno sensitive capabilityget_selected_actorsno sensitive capabilityget_selected_assetsno sensitive capabilityget_world_infono sensitive capabilityhealth_checkno sensitive capabilityimport_assetno sensitive capabilityimport_assets_batchno sensitive capabilitylayout_material_expressionsno sensitive capabilitylink_niagara_parameterno sensitive capabilitylist_assetsno sensitive capabilitylist_data_asset_classesno sensitive capabilitylist_data_assetsno sensitive capabilitylist_input_actionsno sensitive capabilitylist_input_keysno sensitive capabilitylist_input_mapping_contextsno sensitive capabilitylist_material_expression_typesno sensitive capabilitylist_modifier_typesno sensitive capabilitylist_niagara_data_interfacesno sensitive capabilitylist_niagara_emitter_templatesno sensitive capabilitylist_niagara_modulesno sensitive capabilitylist_niagara_parameter_typesno sensitive capabilitylist_niagara_systemsno sensitive capabilitylist_trigger_typesno sensitive capabilitymove_material_expressionno sensitive capabilityopen_assetno sensitive capabilityread_blueprint_contentno sensitive capabilityrecompile_materialno sensitive capabilityremove_input_action_modifierno sensitive capabilityremove_input_action_triggerno sensitive capabilityremove_key_mappingno sensitive capabilityremove_mapping_modifierno sensitive capabilityremove_mapping_triggerno sensitive capabilityremove_mass_config_traitno sensitive capabilityremove_niagara_emitterno sensitive capabilityremove_niagara_moduleno sensitive capabilityremove_niagara_rendererno sensitive capabilityremove_niagara_user_parameterno sensitive capabilityrename_assetno sensitive capabilityrename_blueprint_functionno sensitive capabilityrename_data_table_rowno sensitive capabilityrename_niagara_scratch_pad_moduleno sensitive capabilityreorder_niagara_emitterno sensitive capabilityreorder_niagara_moduleno sensitive capabilitysave_allno sensitive capabilitysave_assetno sensitive capabilitysearch_class_pathsno sensitive capabilitysearch_material_functionsno sensitive capabilitysearch_parent_classesno sensitive capabilityset_actor_propertyno sensitive capabilityset_actor_transformno sensitive capabilityset_asset_propertyno sensitive capabilityset_blueprint_class_defaultsno sensitive capabilityset_blueprint_node_propertyno sensitive capabilityset_blueprint_variable_propertiesno sensitive capabilityset_data_asset_propertiesno sensitive capabilityset_data_asset_propertyno sensitive capabilityset_input_action_propertiesno sensitive capabilityset_key_mappingno sensitive capabilityset_mass_config_trait_propertyno sensitive capabilityset_material_expression_propertyno sensitive capabilityset_material_function_inputno sensitive capabilityset_material_function_outputno sensitive capabilityset_material_instance_parameterno sensitive capabilityset_material_propertiesno sensitive capabilityset_mcp_debugno sensitive capabilityset_mesh_material_colorno sensitive capabilityset_niagara_curveno sensitive capabilityset_niagara_dynamic_inputno sensitive capabilityset_niagara_emitter_propertyno sensitive capabilityset_niagara_module_enabledno sensitive capabilityset_niagara_module_inputno sensitive capabilityset_niagara_playback_rangeno sensitive capabilityset_niagara_rapid_iteration_parameterno sensitive capabilityset_niagara_renderer_bindingno sensitive capabilityset_niagara_renderer_propertyno sensitive capabilityset_niagara_system_propertyno sensitive capabilityset_niagara_user_parameterno sensitive capabilityset_physics_propertiesno sensitive capabilityset_static_mesh_propertiesno sensitive capabilitysync_browserno sensitive capabilitytake_screenshotno sensitive capabilitytrace_material_connectionno sensitive capabilitytrace_niagara_connectionno sensitive capabilityupdate_data_table_rowno sensitive capabilityvalidate_material_functionno sensitive capabilityvalidate_material_graphno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (200 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v1.3.0 latest |
A 93/100 | 8 | 1.9.0 | 2026-07-23 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan unrealmcp --online --registry pypiMore in Developer Tools
Security scan results for the 1stay MCP server.
Security scan results for the Adguard Home MCP server.
Security scan results for the Ado Browser MCP server.
Security scan results for the Adobe Experience Dev MCP server.
Security scan results for the Aemet MCP server.
Security scan results for the Affinity Mcp Bridge MCP server.