unity-mcp

The server listens on `0.0.0.0:8080` by default when using HTTP transport, making it publicly accessible if not behind a firewall. Telemetry data is sent to a third-party endpoint (`https://api-prod.coplay.dev/telemetry/events`) by default, though users can opt-out via environment variables. The use of `eval()` in `main.py` is an internal framework workaround for `typing` annotations, not directly for user input. Path sanitization is implemented for script operations to prevent traversal attacks. The server processes regular expressions from user input in tools like `script_apply_edits` and `find_in_file`; while Python-side compilation is used, complex or inefficient regex patterns could theoretically pose a ReDoS risk.