Is Unreal MCP server safe?

The code turns strings into live code at runtime (eval / new Function / exec).

'import subprocess', 'subprocess.', 'os.system', 'exec(', 'eval(',

'os.system', 'exec(', 'eval(', '__import__', 'with open', 'open(',

Why it matters: If those strings aren't fixed and trusted, they become a way to run arbitrary code.

Fix: Avoid evaluating dynamically constructed code; if unavoidable, ensure the input is a trusted constant and never derived from external data.

An MCP tool exposes a powerful capability (files, shell, network, browser, or credentials).

"name": "control_actor",

"name": "control_editor",

"name": "inspect",

"name": "manage_pcg",

Why it matters: Wired into an agent, these grant it real access to your machine — confirm each is required.

Fix: Confirm each powerful tool is required and constrained; broad MCP tools (shell/filesystem/network) grant an agent significant host access.

The component can run operating-system commands or spawn processes.

import { spawnSync } from 'node:child_process';

? spawnSync('cmd.exe', ['/d', '/s', '/c', `"${[command, ...args].map((a) => `"${a}"`).join(' ')}"`],

: spawnSync(command, args, { stdio: 'inherit', env });

? spawnSync('zip', ['-qr', zipPath, basename(pluginDir)], { cwd: dirname(pluginDir), stdio: 'inherit' })

: spawnSync('tar', ['-a', '-c', '-f', zipPath, basename(pluginDir)], { cwd: dirname(pluginDir), stdio: 'inherit' });

Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.

Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.

The component reads files from disk.

content = fs.readFileSync(filePath, 'utf-8');

Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.

Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.

The component writes or deletes files on disk.

fs.rmSync(targetPath, { recursive: true, force: true });

Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.

Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.

package.json has a 'prepare' script (runs on git/local installs and before publishing).

"prepare": "node -e \"const fs=require('fs');(fs.existsSync('dist')&&fs.existsSync('dist/cli.js')&&fs.existsSync('dist/index.js'))||require('child_process').execSync('npm run build',{stdio:'inherit'})\"",

Why it matters: Usually a build step, but confirm it doesn't fetch or run remote code.

Fix: Usually a legitimate build step; confirm it only builds and does not fetch or execute remote code.

The component makes outbound network requests.

return (await this.ensureConnected()) ? jsonResource(uri, await fetch()) : disconnectedResource(uri);

Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.

Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.

An MCP tool surface (manifest or tool definitions) was found.

{

"tools": [

const server = new Server(

Why it matters: Just context — review which tools it offers and their permissions.

Fix: Review the declared MCP tools and their permissions.