Unreal Mcp

What was checked

Plain notes from the hygiene checks.

• Permissions

  Concern

  can delete files.

  PERMISSION_DELETE_FILES

  cli/src/lib/clean-plugin.ts, line 88

  fs.rmSync(intermediate, { recursive: true, force: true });

  cli/src/lib/clean-plugin.ts, line 104

  fs.rmSync(entryPath, { recursive: true, force: true });

  cli/src/lib/download-server.ts, line 203

  fs.rmSync(installDir, { recursive: true, force: true });

  Show more

  cli/src/lib/download-server.ts, line 211

  fs.rmSync(stagingDir, { recursive: true, force: true });

  cli/src/lib/download-server.ts, line 232

  fs.rmSync(installDir, { recursive: true, force: true });

  cli/src/lib/install-extension.ts, line 417

  fs.rmSync(staging, { recursive: true, force: true });

  cli/src/lib/install-extension.ts, line 456

  fs.rmSync(staging, { recursive: true, force: true });

  cli/src/lib/install-extension.ts, line 465

  fs.rmSync(installReal, { recursive: true, force: true });

  cli/src/lib/types.ts, line 166

  /** Test injection - spawn (defaults to detached `child_process.spawn`). */

  .github/scripts/chain_feed.py, line 1420

  completed = subprocess.run(

  .github/scripts/chain_feed.py, line 1488

  completed = subprocess.run( # noqa: S602 - manifest recipes carry `&&` and `cd`

  .github/workflows/release_extensions.yml, line 127

  subprocess.run(args, check=True)

  scripts/connection_smoke.py, line 443

  def start_server(server_bin: Path, port: int, logdir: Path) -> tuple[subprocess.Popen, Path]:

  scripts/connection_smoke.py, line 446

  proc = subprocess.Popen([str(server_bin), "--port", str(port), "--client-transport", "streamableHttp"],

  scripts/connection_smoke.py, line 470

  out = subprocess.run(["powershell", "-NoProfile", "-Command", ps], capture_output=True, text=True)

  scripts/connection_smoke.py, line 476

  subprocess.run(["taskkill", "/PID", str(pid), "/T", "/F"], capture_output=True, text=True)

• Install and update

  Pass

  No install-time script found, and dependencies are pinned or absent.

• Network

  Concern

  can reach a host that is not written as a fixed address.

  NETWORK_NO_FIXED_HOST

  cli/src/utils/probe.ts, line 44

  /** Injectable fetch (defaults to global `fetch`). */

  .github/scripts/chain_feed.py, line 3729

  A download whose length disagrees with the listing's `size` REFUSES the whole fetch (a

  .github/scripts/chain_fixture.py, line 556

  with urllib.request.urlopen(request, timeout=self.timeout) as response:

  Show more

  UnrealMCP/Source/UnrealMcpEditor/Private/Server/UnrealMcpServerManager.cpp, line 416

  // Bounded transient-retry config for the SHA256SUMS manifest fetch (mirrors Unity's

  UnrealMCP/Source/UnrealMcpEditor/Private/UnrealMcpEditorCoordinator.cpp, line 389

  // section (no separate window to find). Wire the catalog fetch (HTTP, on-demand), the install service

  scripts/connection_smoke.py, line 120

  with urllib.request.urlopen(req, timeout=timeout, context=ctx) as resp:

  scripts/connection_smoke.py, line 217

  with urllib.request.urlopen(req, timeout=timeout, context=ssl.create_default_context()) as resp:

  scripts/connection_smoke.py, line 399

  with urllib.request.urlopen(

• Secrets

  Concern

  reads a credential or environment file.

  SECRETS_PATH_CREDENTIAL SECRETS_PATH_DOTENV

  cli/src/commands/configure.ts, line 8

  rites UNREAL_MCP_* values into <project>/.env (§8).')

  cli/src/commands/configure.ts, line 29

  // legacy `.env` writer below.

  cli/src/commands/login.ts, line 9

  '(~/.ai-game-dev/credentials.json), never a project file.',

  Show more

  cli/src/commands/login.ts, line 11

  .option('-p, --path <dir>', 'Persist the credential into this project\'s .env (gitignored) instead of the shared machine store')

  cli/src/lib/configure.ts, line 1

  // `configure` - write `UNREAL_MCP_*` values into `<project>/.env` and

  cli/src/lib/configure.ts, line 2

  // guard the token-commit hazard by ensuring `.env` is gitignored

  cli/src/lib/configure.ts, line 14

  * Configure a project's `.env` for Unreal-MCP. Writes only the keys whose

  cli/src/lib/configure.ts, line 16

  * field, preserving the rest of the file). Appends `.env` to `.gitignore`

• Agent instructions

  Pass

  No instruction to ignore earlier instructions or to hide a step.

• Obfuscation

  Note

  the file cap was reached before every file was read.

  OBFUSCATION_FILE_CAP_REACHED

  cli/src/utils/repo.ts, line 1

  // Locate the Unreal-MCP repo root (and its `UnrealMCP/` plugin source) from

• Licence

  Pass

  A licence file is present (LICENSE).

• Maintainer activity

  Pass

  The latest commit is within the last 365 days.

Get the full report on this tool, £49

Note

Hygiene check of commit 4137ee8a1047. can delete files. can reach a host that is not written as a fixed address. reads a credential or environment file. the file cap was reached before every file was read.

Date and source

Date checked: 22 Oct 2026

Read how this letter is chosen