Minecraft Server MCP
Provides comprehensive administrator-level control for Minecraft Java Edition servers, allowing AI to manage world generation, server configuration, and player moderation. It enables remote execution of RCON commands, NBT data parsing, and automated backup management through the Model Context Protocol.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
tamo2918
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
create_backupCreate a compressed backup (tar.gz) of a world. Safe to use while the server is running (uses save-off/save-on).
list_backupsList all available world backups, optionally filtered by world name.
restore_backupRestore a world from a backup. Creates a safety backup of the current world before overwriting. The server MUST be stopped first.
delete_backupDelete a backup file.
execute_commandExecute a Minecraft server command via RCON. Send any command without the leading '/'. Examples: 'time set 0', 'weather clear', 'give @a diamond 64', 'tp @a 0 64 0', 'setblock 0 64 0 diamond_block'.
execute_commandsExecute multiple Minecraft commands sequentially via RCON. Useful for batch operations like building structures or setting up game scenarios.
set_timeSet the world time. Presets: 'day' (1000), 'noon' (6000), 'sunset' (12000), 'night' (13000), 'midnight' (18000), 'sunrise' (23000). Or use a tick value.
set_weatherSet the weather. Options: clear, rain, thunder.
set_blockPlace a block at a specific position. Uses the /setblock command.
fill_blocksFill a region with blocks. Uses the /fill command. Max 32,768 blocks per operation.
summon_entitySummon an entity at a position. Examples: 'zombie', 'skeleton', 'villager', 'item_frame', 'armor_stand'.
teleportTeleport a player or entity to coordinates or another entity.
give_itemGive items to a player. Examples: 'diamond', 'diamond_sword', 'golden_apple'.
get_server_propertiesRead all server.properties settings. Returns key-value pairs with descriptions for known settings.
set_server_propertySet a server.properties value. The server must be restarted for changes to take effect. Common properties: gamemode, difficulty, level-seed, level-type, max-players, view-distance, motd, online-mode, pvp, spawn-protection.
set_server_properties_bulkSet multiple server.properties values at once. Useful for configuring a new server or changing world generation settings.
get_game_rulesGet all game rules for the current world via RCON. Server must be running.
set_game_ruleSet a game rule value via RCON. Common rules: doDaylightCycle, doWeatherCycle, doMobSpawning, keepInventory, mobGriefing, doFireTick, randomTickSpeed, playersSleepingPercentage.
setup_worldConfigure server.properties for generating a new world. Sets the level name, seed, world type, and other generation options. The server must be restarted (with the old world deleted or renamed) to generate the new world.
list_playersList all online players and the server's max player count.
op_playerGrant operator status to a player.
deop_playerRevoke operator status from a player.
kick_playerKick a player from the server with an optional reason.
ban_playerBan a player from the server.
pardon_playerRemove a ban from a player.
whitelist_manageManage the server whitelist.
set_gamemodeChange a player's game mode.
apply_effectApply a status effect to a player. Examples: speed, strength, regeneration, night_vision, invisibility, resistance.
list_opsList all server operators from ops.json.
start_serverStart the Minecraft Java Edition server. Ensures RCON is enabled and waits for startup completion.
stop_serverGracefully stop the Minecraft server. Uses RCON 'stop' command, falls back to stdin, then SIGKILL after 30s.
restart_serverRestart the Minecraft server (stop then start). Useful after configuration changes.
server_statusGet the current server status including running state, uptime, online players, and MOTD.
server_logsGet recent server console output. Useful for debugging startup issues or monitoring activity.
validate_serverCheck if the server directory, JAR file, and EULA are properly configured.
configure_mcpUpdate the MCP server configuration (server directory, JAR path, RCON settings, Java path, JVM args).
list_worldsList all Minecraft worlds in the server directory with their sizes.
get_world_infoGet detailed information about a world from its level.dat file, including seed, spawn point, game type, and version.
delete_worldDelete a world folder. WARNING: This is irreversible! Consider creating a backup first. The server must be stopped.
set_world_spawnSet the world spawn point by modifying level.dat. The server must be stopped.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
MC_BACKUP_DIRexport ="/path/to/backups"MC_JAVA_PATHMC_JVM_ARGSMC_RCON_HOSTMC_RCON_PASSWORDexport ="your_secure_password"MC_RCON_PORTMC_SERVER_DIRexport ="/path/to/minecraft-server"MC_SERVER_JARTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
40/40 tools missing one or more hints — create_backup (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_backups (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); restore_backup (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +37 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
22/40 tool handlers declare input schemas (55%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tool handlers catch errors
24/40 tool handlers wrap calls in try/catch (60%)
Wrap each tool handler body in try/catch and return a structured error response.
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/tamo2918/minecraft-server-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check