io.github.n24q02m/better-godot-mcp

Manage Godot 4 scenes, scripts, and shaders faster during game development.

Source

Official Registry

Updated

2026-07-14

// securityCaution

Requires keys· GODOT_PROJECT_PATH, GODOT_PATH
Runs locally
Official / curated
Open source
Community-trusted

Summary

This MCP tool is primarily for local Godot 4.x project operations and declares no remote endpoints, with no clear high-risk red flags observed. The main security considerations are local process execution and read/write access to Godot project files; given its official registry listing, open-source code, and recent maintenance, the overall assessment is low to moderate concern.

CredentialsLow risk

The material only requires GODOT_PROJECT_PATH and GODOT_PATH, which are local path configurations rather than typical API secrets or access tokens. Their sensitivity is relatively low, though disclosure could reveal local directory structure and installation locations.

Network egressLow risk

No remote endpoint is declared, and the objective checks also indicate no host; based on the available material, there is no factual indication of user data being exfiltrated to third-party services.

Code executionCaution

The system checks explicitly mark executes-code, and the tool’s purpose is to operate the Godot engine and scenes/scripts/shaders, so it is reasonable to infer it may invoke Godot or related local processes. This is a normal MCP capability and warrants attention for local execution, but no evidence of overreach or suspicious execution behavior is present in the material.

Data accessCaution

From the description, the tool works with scenes, scripts, shaders, and a Godot project, so it is expected to access files under GODOT_PROJECT_PATH and may read/write related resources. This access scope appears broadly consistent with its stated functionality, with no clear sign of excessive authorization beyond that purpose.

Supply chainCaution

The source is an official registry entry and has an open-source repository with updates within the last year, which are positive signals that reduce risk; however, the lack of a README, unspecified license, and very low community adoption (0 stars) mean audit context and community validation remain limited, so cautious use is appropriate rather than a high-risk rating.

Recommendations

Use it only in an isolated development environment, and restrict GODOT_PROJECT_PATH to the minimum necessary project directory.
Review the open-source repository and its dependencies before installation, focusing on local process launches, file access paths, and potential subprocess calls.
Do not grant access to other workspaces or sensitive directories unless strictly necessary.
Prefer pinning to a reviewed version and keep monitoring the repository for updates and security issues.

Audited by: gpt-5.4 · 2026-06-16

// install

Copy the install command and let the AI configure it · recommended for beginners

Please install the "io.github.n24q02m/better-godot-mcp" MCP server from askskill:
Run: claude mcp add 'io-github-n24q02m-better-godot-mcp' -- npx -y @n24q02m/better-godot-mcp