godot-mcp-setup
Pass
Audited by Gen Agent Trust Hub on Aug 1, 2026
Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSREMOTE_CODE_EXECUTION
Full Analysis
- [UNVERIFIABLE_DEPENDENCIES_AND_REMOTE_CODE_EXECUTION]: The skill installs the
@modelcontextprotocol/server-godotpackage from the official NPM registry and utilizesnpxfor on-demand execution of the server code. - [DATA_EXPOSURE_AND_EXFILTRATION]: The skill accesses and modifies the local
claude_desktop_config.jsonfile to register the Godot MCP server, which is a necessary step for the tool to function within the Claude Desktop environment. - [PRIVILEGE_ESCALATION]: The instructions recommend running the shell as an Administrator if permission errors occur during the installation process, which is a standard procedure for global NPM installations on Windows.
- [PERSISTENCE_MECHANISMS]: By modifying the
claude_desktop_config.jsonfile, the skill ensures the Godot MCP server is loaded automatically whenever the Claude Desktop application starts. - [INDIRECT_PROMPT_INJECTION]: The skill creates a surface for indirect prompt injection by ingesting user requests for scene automation and translating them into configuration changes, though it mitigates risks by instructing the agent to perform JSON syntax validation before saving changes.
Audit Metadata