godot-mcp
MCP server for interfacing with Godot game engine. Provides tools for launching the editor, running projects, and capturing debug output.
1 advisory on file
This tool gives Claude significant control over Godot and access to project files and debug data, so only use it on trusted game projects and never on untrusted code you're trying to analyze.
Based on public adoption and transparency signals as of Oct 24, 2026. Our opinion, not a code audit or security guarantee.
What it can access
- Local filesReads & writes local foldersREVIEW
- Command executionNo shell command runner notedLOW
- Network reachLocal or standard API callsLOW
- CredentialsNo API token requiredLOW
- Package sourcenpm (@coding-solo/godot-mcp)PUBLIC
Inferred from this listing’s public package details and description. Check the project’s source before installing.
Install
npx -y @coding-solo/godot-mcpEverything known
1 high advisory on record. The newest is from 2026-02-04. Every report lists a fix. Use 0.1.1 or later to get them all.
0 incidents · 1 advisory · 0 news articles · 0 community threads · checked 2026-10-30
Popularity grade: A (from public signals such as stars and downloads, not a code review). Graded 2026-10-24.
Showing all 1Showing 1 advisory of 1
Sources we read: OSV, GitHub Advisory Database, CISA Known Exploited Vulnerabilities, 44 security news feeds and our incident library. Last checked 2026-10-30.
About Godot MCP
This is an MCP server that connects Claude to the Godot game engine (a free, open-source tool for making games). It lets Claude launch the Godot editor, run game projects, and read back debug messages and output from the game.
Who it’s for
Game developers who want Claude to help them write or debug Godot games by controlling the engine directly. It's most useful for developers comfortable with both Godot and AI-assisted coding.
Alternatives
- Unreal Engine plugins or debug tools: Direct debugging for Unreal instead of Godot
- Unity debugging MCPs: Similar connectors for the Unity game engine
- Generic code-execution MCPs: General-purpose tools for running scripts or commands (broader but less game-specific)
Setup
Check these steps against the project’s own instructions before running anything.
Follow the project's README for installation instructions, as setup may depend on your Godot version and local environment.
Why this grade
Signal-based grade (6/7 points): very widely starred on GitHub, listed in several sources, public source code. This reflects adoption and transparency, not a code review.
Popularity and upkeep
- GitHub stars
- 6.4k
- Listing last refreshed
- 2026-10-29
These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.
Risks to watch for
- Godot engine access: Claude can launch and control Godot, potentially modifying or deleting game project files if the directory has write access
- Debug output leaking: Game debug logs may contain sensitive data (API keys, file paths, player data) that Claude receives and processes
- Arbitrary script execution: Godot projects can contain malicious scripts that run when the engine launches, which Claude cannot distinguish from legitimate code
- File system exposure: The tool accesses the project directory and debug output, so it can read any files Godot can reach on your machine
- Prompt injection via game state: If Claude analyzes game output or debug logs, attackers could embed instructions in game data to manipulate Claude's behavior
How to lower the risk
Least-privilege permissions
- Run Godot projects in isolated directories with no access to sensitive files or credentials
- Restrict Claude's use to your own game projects, never untrusted code
Network isolation
- Keep Godot projects offline or behind a firewall if they connect to external services
- Avoid storing API keys or secrets in project directories
Monitoring
- Log what debug output Claude receives and what actions it takes in Godot
- Review game project files before Claude interacts with them
Red flags to watch for
- Debug logs with unexpected commands or suspicious messages
- Claude trying to launch Godot with unusual project paths or arguments
- Unexplained file changes in your Godot project after Claude runs
Questions
How do I install Godot MCP?
Run npx -y @coding-solo/godot-mcp in your terminal, or add the server entry to your claude_desktop_config.json or .cursor/mcp.json as shown in the Setup section on this page. Full setup docs and environment variables are in github.com/Coding-Solo/godot-mcp.
Are there security reports about Godot MCP?
1 report was found for this package in our research. Titles and dates (OSV) are listed in the Reports section above. Godot MCP currently holds Grade A (Few risk signals) based on public adoption and transparency signals. Key risk areas to watch include godot engine access, debug output leaking, arbitrary script execution.
Is Godot MCP actively maintained?
Godot MCP has 6.4k GitHub stars. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/Coding-Solo/godot-mcp before pinning it in production.
What are alternatives to Godot MCP?
Notable alternatives to Godot MCP include Unreal Engine plugins or debug tools (Direct debugging for Unreal instead of Godot), Unity debugging MCPs (Similar connectors for the Unity game engine), Generic code-execution MCPs (General-purpose tools for running scripts or commands (broader but less game-specific)). You can also compare Godot MCP side by side with other MCP servers in the Related tools section on this page.
README badge and team notes
Maintain or use Godot MCP? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.
GitHub README Markdown:
[](https://agentarmorhq.com/skills/coding-solo-godot-mcp)HTML embed:
<a href="https://agentarmorhq.com/skills/coding-solo-godot-mcp"><img src="https://agentarmorhq.com/api/badge/coding-solo-godot-mcp" alt="AgentArmorHQ Risk Grade for Godot MCP" height="20" /></a>Terminal check:
curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "coding-solo-godot-mcp"Share with your security lead
Need sign-off to use godot-mcp? Copy this note for Slack, a ticket or a pull request.
### AgentArmorHQ Security Review Memo: godot-mcp
- **Listing URL:** https://agentarmorhq.com/skills/coding-solo-godot-mcp
- **Type:** App connector
- **Risk Grade:** Grade A (Few risk signals)
- **Outside Security Advisories on File:** 1
- **Public Adoption:** 6.4k GitHub stars
#### Permission & Blast-Radius Signals
- **Local files:** Reads & writes local folders
- **Command execution:** No shell command runner noted
- **Network reach:** Local or standard API calls
- **Credentials:** No API token required
- **Package source:** npm (@coding-solo/godot-mcp)
#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts @coding-solo/godot-mcp`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.
_Based on public adoption and transparency signals as of Oct 24, 2026. Our opinion, not a code audit or security guarantee._Key facts
- Type
- App connector
- Publisher
- Coding-Solo
- Source code
- github.com/Coding-Solo/godot-mcp
- Install command
- npm install @coding-solo/godot-mcp
- Est. context load
- ~850 tokens / turn (~5 tool schemas, 0.43% of 200k context)
- Popularity
- 6.4k GitHub stars
- Last updated
- 2026-10-29
- Last graded
- 2026-10-24
Community
Discussions for Godot MCP
Ask questions or share configuration tips. Governed by our Community Rules & Terms.
No posts match this filter yet.
Be the first to ask a question or share a working tip.
Check before you install, in Claude
Your assistant answers Block, Review or No known issues for any package before it installs it.
Get this check inside Claude