godot-devtool (wangdiandao/godot-devtool) is an MCP server listed on the M8ven Trust Index. It scores 60 out of 100, grade C. It declares 101 tools. No publisher has claimed this listing.

C
Caution
60/100

godot-devtool

Godot 4 MCP server for AI-assisted project inspection, editing, validation, and runtime automation.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

wangdiandao

Source: github_topic · also listed on Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 14 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
// tools this server exposes101 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

launch_editor

Reuse an already connected Godot editor for a project, launch one only when no bridge is connected, and refuse to open a replacement editor when the configured bridge port is occupied by another listener

run_project

Run the Godot project and capture output

get_debug_output

Get the current debug output and errors

clear_debug_output

Clear buffered output for the currently running Godot project

stop_project

Stop the currently running Godot project

get_godot_version

Get the installed Godot version

list_projects

List Godot projects in a directory

get_capabilities

Return a lightweight godot-devtool tool catalog by default, with optional filtered input schemas by route group, transport, risk level, tool name, or query

broker_status

Read the shared godot-devtool 3.0 WebSocket broker status, connected clients, pending commands, and leases

list_bridge_sessions

List connected editor/runtime bridge sessions with sessionId, runId, project path, context, and last-seen time

list_run_instances

List Godot game/editor run instances managed by this MCP server

stop_run_instance

Stop one Godot run instance by runId

resolve_bridge_target

Resolve the editor/runtime bridge target for a project and report ambiguity candidates without sending a command

broker_cleanup_idle

Stop the transient shared broker listener only when no clients, runs, or pending commands require it

browser_visualizer_start

Start a local read-only browser dashboard for Godot editor/runtime bridge status and live-route guidance

browser_visualizer_status

Read the local Browser visualizer URL, project filter, and connected editor/runtime bridge clients

browser_visualizer_stop

Stop the local Browser visualizer HTTP dashboard

plugin_install

Install the godot-devtool WebSocket editor/runtime plugin into a Godot project

plugin_status

Read godot-devtool plugin installation status, WebSocket bridge configuration, connected clients, and occupied-port diagnostics

plugin_cleanup_port

Explicitly inspect and optionally stop stale godot-devtool WebSocket bridge listeners on a local port

plugin_reload

Reload the godot-devtool editor plugin through the WebSocket bridge

plugin_dock_status

Return machine-readable godot-devtool Dock labels, tooltips, status dots, buttons, visibility, and bridge diagnostics from the live editor

scene_open

Open a scene in the MCP session using headless/file-based scene access

scene_get_current

Return the current scene tracked by this MCP session, if one was opened

editor_get_selection

Return the current editor selection when a live editor bridge is available

editor_select_node

Select a node in the live Godot editor when an editor bridge is available

editor_undo_redo

Perform undo or redo in the live Godot editor when an editor bridge is available

editor_inspector_get_properties

Read Inspector properties from the selected or addressed node through the live editor bridge

editor_inspector_set_properties

Write Inspector properties on the selected or addressed node through the live editor bridge

editor_add_node

Add a node to the currently open editor scene through UndoRedo without externally rewriting the scene file

editor_delete_node

Delete a non-root node from the currently open editor scene through UndoRedo

editor_rename_node

Rename a node in the currently open editor scene through UndoRedo

editor_move_node

Move or reparent a node in the currently open editor scene through UndoRedo

editor_duplicate_node

Duplicate a node in the currently open editor scene through UndoRedo

editor_save_scene

Save the currently open editor scene through the live editor bridge

filesystem_list

List files and directories inside a Godot project

filesystem_read

Read a UTF-8 text file inside a Godot project

filesystem_write

Write a UTF-8 text file inside a Godot project

filesystem_delete

Delete a project-local file or directory with explicit confirmation

filesystem_preview_delete

Preview a project-local delete operation without deleting files

node_get

Get node information from a Godot scene

node_move

Move a node by setting its position or reparenting it in a Godot scene

node_duplicate

Duplicate a node in a Godot scene

node_find

Find nodes in a scene by name, type, or path substring

get_node_properties

Read selected properties from a node in a Godot scene

update_node_properties

Update properties on a node in a Godot scene

rename_node

Rename a node in a Godot scene

delete_node

Delete a non-root node from a Godot scene

add_node

Add a node to an existing scene

get_project_info

Retrieve metadata about a Godot project

project_get_settings

Read Godot project.godot settings by section or section/key list

project_set_setting

Update Godot project.godot settings with dry-run preview and audit logging

project_input_action

List or update project InputMap actions in project.godot

get_resource_index

Return a categorized resource index for a Godot project

resource_dependency_graph

Build a resource dependency graph and identify orphan resources

get_script_index

Return GDScript files with class, base class, exported variables, and functions

get_export_presets

Read configured Godot export presets

check_export_presets

Inspect Godot export presets and report pre-export issues

export_matrix

Summarize export targets, platform families, signing/template status, and CI steps

generate_ci_snippet

Generate GitHub Actions or GitLab CI snippets for Godot headless checks, export preflight, release export, and artifact archiving

update_export_preset

Update fields or options for a configured Godot export preset

export_project

Run a controlled Godot export for a configured preset

create_gameplay_prototype

Create a high-level block-based gameplay prototype scaffold in a Godot project

create_workflow_test_scene

Create a small Godot scene for validating MCP scene/script/check workflows

get_audit_log

Read godot-devtool project audit log entries

get_safety_policy

Read the project-local godot-devtool safety policy and default enforcement state

set_safety_policy

Configure project write allowlists and blocked paths in .godot-devtool/safety.json

preview_write_safety

Preview safety policy and diff summary metadata for proposed writes or deletes

get_audit_replay

Summarize godot-devtool audit log entries into replay steps, counters, and risk highlights

get_rollback_suggestions

Return honest rollback guidance for an operation, audit entry, or changed paths

run_project_checks

Run stable project checks for CI, review, and release workflows

update_project_uids

Update UID references in a Godot project by resaving resources (for Godot 4.4+)

resource_load

Load a text-based Godot resource from the project

resource_create

Create a simple structured Godot resource file

resource_save

Save text-based Godot resource content with overwrite protection

create_scene

Create a new Godot scene file

get_scene_tree

Return the node tree for a Godot scene

load_sprite

Load a sprite into a Sprite2D node

export_mesh_library

Export a scene as a MeshLibrary resource

save_scene

Save changes to a scene file

get_uid

Get the UID for a specific file in a Godot project (for Godot 4.4+)

script_create

Create a GDScript file inside a Godot project

script_write

Write full GDScript content with overwrite protection

script_attach

Attach a GDScript resource to a node in a scene

read_script_file

Read a GDScript file from a Godot project

analyze_script_references

Analyze a GDScript file for class, functions, exports, node paths, and resource references

check_gdscript_syntax

Run Godot --check-only against a GDScript file and return diagnostics

animation

Create, inspect, remove, and edit AnimationPlayer tracks and keyframes

animation_state_machine

Create, inspect, and configure AnimationTree state machines

signal

List, connect, or disconnect node signals in a scene

group

List, add, or remove node groups

ui

Create Control nodes, reusable UI templates, themes, and automatic signal wiring

material

Create, read, update, and apply Godot material resources

shader

Create, read, inspect, and configure ShaderMaterial parameters

lighting

Create and list basic Godot light and environment nodes

particle

Create and list basic Godot particle emitter nodes

tilemap

Create, list, and edit TileMapLayer or legacy TileMap nodes

geometry

Create and list basic 2D geometry/debug drawing nodes

physics

Create, inspect, configure, template, and analyze physics bodies, areas, collision layers, and shapes

navigation

Create, inspect, configure, bake, query, and debug NavigationRegion and NavigationAgent nodes

1 further tool is not listed here. The complete surface is in the source.

// known CVEs in dependencies14 high5 medium11 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@0.6.0GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

highaxios@1.7.9GHSA-35jp-ww65-95wh

axios Vulnerable to Full Man-in-the-Middle via Prototype Pollution Gadget in `config.proxy`

highaxios@1.7.9GHSA-3g43-6gmg-66jw

axios Vulnerable to Credential Theft and Response Hijacking via Prototype Pollution Gadget in Config Merge

highaxios@1.7.9GHSA-43fc-jf86-j433

Axios is Vulnerable to Denial of Service via __proto__ Key in mergeConfig

highaxios@1.7.9GHSA-4hjh-wcwx-xvwj

Axios is vulnerable to DoS attack through lack of data size check

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configALLOW_RELEASE_BRANCH
configALLOW_RELEASE_CLOBBER
configCODEX_HOME
configComSpec
configGITHUB_REPOSITORY
configGODOT_DEVTOOL_DEBUG_MAX_LINES
configGODOT_DEVTOOL_GODOT_TIMEOUT_MS
configGODOT_DEVTOOL_HEADLESS_LOG_DIR
configGODOT_DEVTOOL_PROCESS_STARTUP_GRACE_MS
configGODOT_DEVTOOL_SCAN_MAX_DEPTH
configGODOT_DEVTOOL_SCAN_MAX_FILES
configGODOT_DEVTOOL_SECURITY_WS_PORT
configGODOT_DEVTOOL_TOOLS_LIST_MODE
configGODOT_DEVTOOL_VERIFY_PLUGIN_WS_PORT
configGODOT_DEVTOOL_VERIFY_ROADMAP_WS_PORT
configGODOT_DEVTOOL_WS_PORT"": "8766"
configGODOT_DEVTOOL_WS_RECONNECT_WAIT_MS
configGODOT_PATHGodot 4.x. Set unless godot is already on PATH.
configProgramFiles
configProgramFiles(x86)
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

101/101 tools missing one or more hints — launch_editor (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); run_project (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); get_debug_output (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +98 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tests exist

No test files found

Add tests that exercise each declared tool.

Shell command execution

1 child_process call — runs shell commands

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Production dependencies are patched

0 critical, 14 high severity in production deps — @modelcontextprotocol/sdk@0.6.0 (high), axios@1.7.9 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/wangdiandao/godot-devtool?variant=verified)](https://m8ven.ai/mcp/wangdiandao/godot-devtool)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: f216a3d8d6e39ecd7d7b3ce1b006953ac0fa8263
code hash: 23612ffbe512847927dbd685c2b5bd5e770172477a037d475e0a07e4ec4296d3
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client