CET MCP (Y4rd13/cyber-engine-tweak-mcp) is an MCP server listed on the M8ven Trust Index. It scores 60 out of 100, grade C. It declares 37 tools. No publisher has claimed this listing.
MCP server that connects Claude Code to Cyber Engine Tweaks (CET) in Cyberpunk 2077, enabling Lua code execution, game state queries, TweakDB manipulation, inventory management, and event observation from the terminal while the game is running.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
Y4rd13
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
get_connection_statusCheck bridge connectivity status. Reports whether the CET Bridge Mod is running and responsive. This tool works locally — it does not require the game to be running to check.
read_logRead the CET scripting.log file. This reads directly from disk — no bridge connection needed. Useful for debugging CET mods and seeing game console output.
list_modsList all installed CET mods by scanning the mods directory. Reads directly from disk — no bridge connection needed.
execute_luaExecute Lua code in the CET console. The code runs in the game's Lua VM via loadstring(). Use for side effects (spawning entities, changing state, etc). Output from print() is captured and returned.
evaluate_expressionEvaluate a Lua expression and return its result as a string. Unlike execute_lua, this returns the value of the expression. Use for reading game state (e.g., 'Game.GetPlayer():GetLevel()').
batch_executeExecute multiple Lua statements sequentially in a single bridge round-trip. More efficient than multiple execute_lua calls. Each statement runs independently — a failure in one does not stop the rest.
get_player_infoGet current player information: level, street cred, health, stamina, position coordinates, and current equipped weapon. Requires the player to be spawned in-game.
get_game_stateGet current game state: in-game time, scene tier (gameplay/menu/cutscene), weather, and player zone type (safe/combat/restricted). Works from any game screen.
add_itemAdd an item to the player's inventory by TweakDB item ID. Example: 'Items.Preset_Katana_Saburo' for Satori katana. Quantity defaults to 1.
teleportTeleport the player to specific world coordinates. Use get_player_info first to see current position for reference.
get_inventoryList items in the player's inventory. Returns item names, quantities, TweakDB IDs, and quality. Can filter by item type (Weapon, Clothing, Consumable, etc).
remove_itemRemove an item from the player's inventory by TweakDB item ID. Removes specified quantity (default: all).
get_equippedGet the player's currently equipped items: weapons in slots, clothing, cyberware, and active quickslot items.
observe_eventsSubscribe to a game event via CET's Observe/ObserveAfter. Events are buffered in-game and can be retrieved with get_observations. Example: observe 'PlayerPuppet' / 'OnDamageReceived' to watch damage events.
get_observationsRead buffered event observations from a subscription created by observe_events. Returns and clears the buffer.
set_statModify a player stat value. Common stats: Health, Stamina, Armor, Level, StreetCred. Use dump_type with 'gamedataStatType' to discover all available stats.
apply_status_effectApply a status effect (buff/debuff) to the player. Examples: 'BaseStatusEffect.Berserk', 'BaseStatusEffect.Intoxicated'. Effects can be permanent or timed.
remove_status_effectRemove a status effect from the player by TweakDB ID.
get_active_effectsList all active status effects on the player. Shows effect IDs, remaining duration, and stack count.
toggle_god_modeToggle invulnerability on/off for the player. Useful for testing combat mods without dying.
set_levelSet the player's level and/or street cred directly.
get_appearance_infoGet the current visual appearance of the player or a target NPC (if scanned). Shows equipped appearance name and body customization state.
get_vehicle_listList all vehicles owned by the player (garage). Shows vehicle names and TweakDB IDs.
get_quest_factRead a quest fact (internal progression flag). Quest facts track game state like completed objectives, dialogue choices, and story progression. Example: 'q001_rogue_met'.
set_quest_factSet a quest fact value. Use with caution — changing quest facts can break quest progression or unlock content. Value is typically 1 (true/done) or 0 (false/not done).
get_tweakdb_valueRead a TweakDB flat or record by path. TweakDB is Cyberpunk's game data database containing items, stats, vehicles, NPCs, etc. Example paths: 'Items.Preset_Katana_Saburo', 'BaseStats.Health'.
set_tweakdb_valueWrite a TweakDB flat value. Changes persist until the game is restarted. Use with caution — wrong values can crash the game. Only works on flat values, not records.
dump_typeIntrospect a game RTTI type, showing its methods, properties, and inheritance. Useful for discovering available APIs on game classes like 'PlayerPuppet', 'vehicleBaseObject', etc.
search_tweakdbSearch TweakDB records by pattern. Returns matching record paths. Useful for finding item IDs, stat paths, etc. Example: search for 'Katana' to find all katana-related records.
spawn_vehicleSpawn a vehicle near the player. Examples: 'Vehicle.v_sport2_quadra_type66', 'Vehicle.v_sport1_rayfield_caliburn'. Use search_tweakdb with pattern 'Vehicle.' to find vehicle IDs.
get_nearby_entitiesScan for entities near the player within a given radius. Returns entity names, types, distances, and positions. Useful for finding NPCs, vehicles, items in the world.
set_timeSet the in-game time of day. Useful for testing lighting, NPC schedules, or triggering time-dependent events.
set_weatherChange the in-game weather. Available presets: Sunny, Cloudy, Rain, HeavyRain, Fog, Toxic, Sandstorm, Pollution. Changes take effect gradually.
kill_nearby_npcsKill all hostile NPCs within a radius. Useful for clearing combat encounters during testing. Only affects NPCs currently in combat with the player.
show_notificationShow an in-game UI notification/warning message to the player. Useful for testing UI or signaling events.
play_soundPlay a sound event in-game. Example events: 'ui_menu_hover', 'ui_menu_click', 'w_gun_reload'. Use search_tweakdb with pattern 'sound' to discover sound event names.
get_scanner_infoGet detailed info about the entity the player is currently looking at (as if scanning). Returns entity type, name, health, level, faction, and more.
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse
Anthropic's MCP TypeScript SDK has a ReDoS vulnerability
Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default
CET_BRIDGE_DIRe "=/path/to/cyber_engine_tweaks/mods/CETBridge" \CET_TCP_PORT27010 TCP server portCET_TRANSPORTe "=tcp" \Tool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
37/37 tools missing one or more hints — get_connection_status (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); read_log (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); list_mods (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +34 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Tool inputs are validated
20/37 tool handlers declare input schemas (54%)
Declare an inputSchema with zod/joi/yup on every tool definition.
Tests exist
No test files found
Add tests that exercise each declared tool.
Production dependencies are patched
0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.12.1 (high), @modelcontextprotocol/sdk@1.12.1 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/y4rd13/cyber-engine-tweak-mcp)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check