Unity-MCP

Security Hardening Guide for Unity-MCP

Least-privilege permissions

• Restrict AI agent access to read-only mode where possible; disable the ability to modify, delete, or execute C# methods unless absolutely necessary for your workflow.
• Use separate Unity projects for AI testing rather than connecting agents directly to production game code; this prevents accidental changes to live assets or gameplay logic.
• Create a dedicated service account with minimal permissions (no admin access, limited folder access) specifically for the AI agent to use instead of your personal developer credentials.
• Disable automatic credential storage in project configuration files; store API keys and passwords in a separate secure vault (e.g., environment variables or password manager) that the AI agent cannot read.

Network isolation

• Run Unity-MCP on an offline or air-gapped machine if handling sensitive game code or proprietary assets; disable internet connectivity except when explicitly syncing to your development server.
• Use a firewall to block outbound connections from the AI agent to unknown IP addresses; whitelist only the specific cloud services (Claude, Gemini, Copilot) you intend to use.
• Never expose the MCP connector directly to the internet; only access it through a VPN or local network connection on trusted machines.

Monitoring

• Log all C# methods executed by the AI agent with timestamps and inputs; review logs daily for suspicious or unexpected method calls that could indicate prompt injection attacks.
• Set up alerts for file access patterns, especially reads of configuration files, .env files, or folders containing credentials (e.g., Library/, Assets/).
• Track token usage and API calls to the external AI services; sudden spikes may indicate the agent is being exploited to process unexpected data or run unauthorized operations.

Red flags to watch for

• Prompts that ask the agent to "ignore instructions" or "bypass restrictions" — these are common attack techniques; reject or sandbox such requests immediately.
• Requests to expose or execute methods you did not explicitly approve — legitimate workflows should only use whitelisted C# functions; unexpected method calls are a sign of compromise.
• Changes to project files outside your expected workflow, such as modifications to build scripts, package dependencies, or configuration files that the AI should never touch.
• Early-stage or unverified maintenance status — verify the GitHub project is actively maintained and has recent security reviews before using it with sensitive projects.