UnrealMotionGraphicsMCP

The server design relies on a trusted local execution environment, typically on a developer's machine, communicating with a local Unreal Engine instance. The system allows AI to create, modify, and delete UMG assets and Blueprint logic, which are powerful operations but are confined within the Unreal Engine context. Dynamic loading of tools and prompts from `prompts.json` could be a risk if the file is untrusted, allowing malicious tool descriptions or enabling risky tools. XML parsing in `UMGHTMLParser.py` uses `ElementTree`, which is generally safe against common XXE attacks by default. `subprocess.Popen` is used in wrapper scripts for server management, which is controlled. No hardcoded secrets were found. The primary security consideration is to only run this in a controlled development environment with trusted `prompts.json` configurations.