UnrealMotionGraphicsMCP

The server exposes powerful Unreal Engine Editor functionalities (e.g., asset creation, widget manipulation, blueprint compilation, actor spawning, and arbitrary JSON-to-UMG application). By default, it binds to 127.0.0.1 (localhost), which safely contains these operations to the local machine. However, if the UNREAL_HOST configuration is changed to 0.0.0.0 or another public IP, these powerful actions could be exposed over the network, potentially allowing unauthorized modifications or malicious activities within the Unreal project. No direct use of 'eval' or similar functions with arbitrary user input was found in the Python server code. JSON parsing/serialization is handled by standard libraries, and C++ property setting uses Unreal's FJsonObjectConverter, which is generally safe for UPROPERTY reflection.