godot-mcp (tugcantopaloglu/godot-mcp) is an MCP server listed on the M8ven Trust Index. It scores 60 out of 100, grade C. It declares 154 tools. No publisher has claimed this listing.
MCP server for full Godot 4.x engine control: 157 tools for AI-driven game development (GDScript and C#/.NET). Tested with Godot 4.7.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
tugcantopaloglu
Source: Glama · also listed on github_topic
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
launch_editorLaunch Godot editor for a specific project
run_projectRun the Godot project and capture output
get_debug_outputGet the current debug output and errors
stop_projectStop the currently running Godot project
get_godot_versionGet the installed Godot version
list_projectsList Godot projects in a directory
get_project_infoRetrieve metadata about a Godot project
create_sceneCreate a new Godot scene file
add_nodeAdd a node to an existing scene
load_spriteLoad a sprite into a Sprite2D node
export_mesh_libraryExport a scene as a MeshLibrary resource
save_sceneSave changes to a scene file
get_uidGet the UID for a specific file in a Godot project (for Godot 4.4+)
update_project_uidsUpdate UID references by resaving resources (4.4+)
game_screenshotScreenshot the running game (returns base64 PNG)
game_clickClick at a position in the running Godot game window
game_key_pressSend a key press or input action to the running game
game_mouse_moveMove the mouse in the running Godot game
game_get_uiGet visible UI elements from the running game
game_get_scene_treeGet scene tree structure of the running game
game_evalExecute GDScript in the running game. Use "return" for values.
game_get_propertyGet a property value from any node in the running game by its path
game_set_propertySet a property on a node in the running game
game_call_methodCall a method on any node in the running game with optional arguments
game_get_node_infoGet node info: class, properties, signals, methods, children
game_instantiate_sceneLoad a PackedScene and add it as a child of a node in the running game
game_remove_nodeRemove and free a node from the running game's scene tree
game_change_sceneSwitch to a different scene file in the running game
game_pausePause or unpause the running game
game_performanceGet performance metrics (FPS, memory, draw calls)
game_waitWait N frames in the running game
read_sceneRead scene file as JSON node tree (headless)
modify_scene_nodeModify node properties in a scene file (headless)
remove_scene_nodeRemove a node from a scene file (headless)
read_project_settingsRead project.godot as structured JSON
modify_project_settingsModify a project.godot setting
list_project_filesList project files, optionally filtered by extension
game_connect_signalConnect a signal from one node to a method on another node in the running game
game_disconnect_signalDisconnect a signal connection in the running game
game_emit_signalEmit a signal on a node in the running game, optionally with arguments
game_play_animationControl an AnimationPlayer node: play, stop, pause, or list animations
game_tween_propertyTween a node property in the running game
game_get_nodes_in_groupGet all nodes belonging to a specific group in the running game
game_find_nodes_by_classFind all nodes of a specific class type in the running game
game_reparent_nodeMove a node to a new parent in the running game's scene tree
attach_scriptAttach a GDScript to a scene node (headless)
create_resourceCreate a .tres resource file (headless)
read_fileRead a text file from a Godot project
write_fileCreate or overwrite a text file in a Godot project
delete_fileDelete a file from a Godot project
create_directoryCreate a directory inside a Godot project
game_get_errorsGet new push_error/push_warning messages since last call
game_get_logsGet new print output from the running game since last call
game_key_holdHold a key down without auto-releasing
game_key_releaseRelease a previously held key
game_scrollSend mouse scroll wheel event at position
game_mouse_dragDrag mouse between two points over N frames
game_gamepadSend gamepad button or axis input event
create_projectCreate a new Godot project from scratch
manage_autoloadsAdd, remove, or list autoloads in a Godot project
manage_input_mapAdd, remove, or list input actions and bindings
manage_export_presetsCreate or modify export preset configuration
game_get_cameraGet active camera position, rotation, and size
game_set_cameraMove or rotate the active camera
game_raycastCast a ray and return collision results
game_get_audioGet audio bus layout and playing streams
game_spawn_nodeCreate a new node of any type at runtime
game_set_shader_paramSet a shader parameter on a node's material
game_audio_playPlay, stop, or pause an AudioStreamPlayer node
game_audio_busSet volume, mute, or solo on an audio bus
game_navigate_pathQuery a navigation path between two points
game_tilemapGet or set cells in a TileMapLayer node
game_add_collisionAdd a collision shape to a physics body node
game_environmentGet or set environment and post-processing settings
game_manage_groupAdd or remove a node from a group, or list groups
game_create_timerCreate a Timer node with configuration
game_set_particlesConfigure GPUParticles2D/3D node properties
game_create_animationCreate an animation with tracks and keyframes
export_projectExport a Godot project using a preset
game_serialize_stateSave or load node tree state as JSON
game_physics_bodyConfigure physics body properties (mass, velocity, etc.)
game_create_jointCreate a physics joint between two bodies
game_bone_poseGet or set bone poses on a Skeleton3D node
game_ui_themeApply theme overrides to a Control node
game_viewportCreate or configure a SubViewport node
game_debug_drawDraw debug lines, spheres, or boxes in 3D
game_http_requestHTTP GET/POST/PUT/DELETE with headers and body
game_websocketWebSocket client connect/disconnect/send messages
game_multiplayerENet multiplayer create server/client/disconnect
game_rpcCall or configure RPC methods on nodes
game_touchSimulate touch press/release/drag and gestures
game_input_stateQuery pressed keys, mouse position, connected pads
game_input_actionManage runtime InputMap actions and strength
game_list_signalsList all signals on a node with connections
game_await_signalAwait a signal with timeout and return args
game_scriptAttach, detach, or get source of node scripts
game_windowGet/set window size, fullscreen, title, position
game_os_infoGet platform, locale, screen, adapter, memory info
game_time_scaleGet/set Engine.time_scale and timing info
game_process_modeSet node process mode (pausable/always/disabled)
54 further tools are not listed here. The complete surface is in the source.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
Vitest allows Remote Code Execution when accessing a malicious website while Vitest API server is listening
axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`
axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge
Axios: Header Injection via Prototype Pollution
GODOT_PATH"": "/path/to/godot",Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
154/154 tools missing one or more hints — launch_editor (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); run_project (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_debug_output (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +151 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Shell command execution
2 child_process calls — runs shell commands
Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.
Production dependencies are patched
0 critical, 11 high severity in production deps — axios@1.13.5 (high), axios@1.13.5 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
2 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/tugcantopaloglu/godot-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check