Funplay Cocos MCP

It requires FUNPLAY_COCOS_MCP_URL and FUNPLAY_COCOS_MCP_TIMEOUT_SECONDS. These appear to be connection/configuration parameters rather than highly sensitive secrets, but the URL may expose an internal service address or be misconfigured to an unintended target, so it should still be handled as sensitive configuration.

No external remote host is declared, and the description points to a stdio bridge for a 'local Cocos Creator Editor MCP server'. Based on the provided material, there is no clear evidence of user data being exfiltrated to unknown third-party endpoints; however, the actual URL should still be verified to ensure it only targets a local service.

The objective checks explicitly mark it as executes-code, meaning it can run or invoke code/processes on the local machine. This is a normal MCP tool risk surface, and the current material does not show abnormal system permission requests beyond its stated role of bridging to a local editor service.

As a bridge to a local Cocos Creator Editor MCP service, it can reasonably be expected to indirectly access project resources and local project data exposed within the editor session. The lack of a README leaves the exact read/write scope unclear, but the available material does not show obvious overbroad or unrelated data access claims.

The source is an official registry entry with an auditable open-source repository and updates within the last year, which are strong risk-reducing signals. Points to note are the missing license declaration and low star count, meaning transparency is decent but ecosystem maturity appears limited.