mcp-server-godot

The server executes external Godot binaries and performs file system operations (read, write, list files) based on configured paths and parameters provided by the AI client. Specifically, the `run_project` tool allows specifying an optional `projectPath` and `args` which are directly passed to `child_process.spawn`. If an untrusted AI agent provides malicious paths or arguments, this could lead to arbitrary code execution or unauthorized file access on the host system. Similarly, file resource handlers and `search_scenes` operate within the configured `projectPath` or client-provided paths. The `execSync` call for Godot version detection also executes an external binary (`godotPath`), which is a risk if `godotPath` is misconfigured. Due to these capabilities, the server should be run in a secure, sandboxed environment with strict input validation for AI agents.