unity-mcp-server
Unity MCP Server — 268 tools for AI-assisted game development. Connect Claude, Cursor, or any MCP client to Unity Editor & Unity Hub. Scene management, GameObjects, components, builds, profiling, Shader Graph, Amplify, terrain, physics, NavMesh, animation, MPPM multiplayer & more. Free & open source by AnkleBreaker Studio.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
AnkleBreaker-Studio
Source: github_topic · also listed on Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
LOG_LEVELUNITY_BRIDGE_HOST127.0.0.1 Editor bridge hostUNITY_BRIDGE_PORT"": "7890"UNITY_BRIDGE_TIMEOUT60000 Request timeout in msUNITY_EDITOR_PATHUNITY_HUB_PATH"": "C:\\Program Files\\Unity Hub\\Unity Hub.exe",UNITY_INSTANCE_REGISTRYUNITY_MCP_COMPACT_TOOLSUNITY_MCP_DEBUGunset Set to 1 to append diagnostics to UnityMCP/mcp-debug.log (5MB rotation)UNITY_MCP_PRETTY_JSONunset Set to 1 to pretty-print tool responses (default is compact JSON — 20-50% fewer tokens)UNITY_PORT_RANGE_END7899 End of port scan rangeUNITY_PORT_RANGE_START7890 Start of port scan range for multi-instance discoveryUNITY_QUEUE_POLL_INTERVALUNITY_QUEUE_POLL_MAXUNITY_QUEUE_POLL_TIMEOUTUNITY_REGISTRY_STALENESS_TIMEOUT300000 Registry entry staleness timeout in ms (crash detection)UNITY_RESPONSE_HARD_LIMIT4194304 Response size hard limit in bytes (truncation)UNITY_RESPONSE_SOFT_LIMIT2097152 Response size soft limit in bytes (warning)Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
356/356 tools missing one or more hints — unity_list_instances (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); unity_select_instance (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); unity_hub_list_editors (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +353 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 1 high severity in production deps — @modelcontextprotocol/sdk@1.0.0 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Your fixes are re-checked automatically. Claim the listing and we tell you when the grade moves, and reach you directly if we find anything urgent.
[](https://m8ven.ai/mcp/anklebreaker-studio-unity-mcp-server-40ndc3)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check