Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 0
- 4 1
- 3 5
- 2 3
- 1 0
Trust in production
- Trust it - 0%
- With caveats - 56%
- Wouldn't - 44%
33% would recommend this server
How reviewers scored it
- Setup & docs 3.0
- Auth experience 2.4
- Reliability 2.8
- Maintainer responsiveness 2.4
Why it got a D
Godot has no official MCP server. This MIT-licensed TypeScript server is the community one most people use (about 6,400 GitHub stars and 48,000 npm downloads in October 2026, more than ten times the next Godot server). It runs over stdio with no network port, starts the Godot binary with execFile rather than a shell (the fix for CVE-2026-25546, patched in 15 days), and writes scenes, mesh libraries and resaved resources into the project you name. run_project runs that project's GDScript on your machine, and the tools have no authentication or read-only mode. Biggest deduction: there has been no commit since 16 April 2026, and the npm package the README tells you to run (0.1.1, February 2026) still lets add_node load and run any script by path (issue #95, fixed on main only), so build it from source instead.
How to connect
// .cursor/mcp.json (per project) or ~/.cursor/mcp.json (global)
{
"mcpServers": {
"godot": {
"command": "node",
"args": ["/path/to/godot-mcp/build/index.js"],
"env": { "GODOT_PATH": "/path/to/godot" }
}
}
}claude mcp add godot -e GODOT_PATH=/path/to/godot -- node /path/to/godot-mcp/build/index.jsIs Godot MCP Server (Coding-Solo/godot-mcp) safe?
Is Godot MCP Server (Coding-Solo/godot-mcp) safe to use?
Godot MCP Server (Coding-Solo/godot-mcp) grades D (notable weaknesses - review closely). There is no login: anything that can start or reach it gets its full access. Updates are rare or unknown, so fixes may be slow to arrive. It has 1 open CVE. Check the advisories before you install. It shells out to helper programs or serves HTTP without enforced TLS, so keep it local and isolated.
Does Godot MCP Server (Coding-Solo/godot-mcp) have known vulnerabilities?
Yes, 1 open CVE in our data. The listing above explains what they affect and what to run instead.
Does Godot MCP Server (Coding-Solo/godot-mcp) support authentication?
No. It has no login of its own, so limit who and what can start it.
Alternatives in Developer Tools
- A Atlassian Rovo MCP ServerOfficial hosted Atlassian server for Jira, Confluence, Jira Service Management, Compass, Bitbucket, Loom, Goals, Projects, and Teams, with OAuth 2.1 sign-in.
- A Buildkite MCP ServerOfficial Buildkite server for pipelines, builds, jobs, logs, annotations, and Test Engine data, hosted or local.
- A Dynatrace Remote MCP ServerDynatrace's hosted MCP server, running inside your Dynatrace SaaS environment, to run and explain DQL, look into problems, vulnerabilities and Kubernetes events, and forecast time series.
- A GitHub MCP ServerOfficial GitHub server for repos, issues, pull requests, Actions, and code security, hosted or local.
- A GitLab MCP ServerGitLab's built-in MCP server for projects, merge requests, work items, code, and CI pipelines, on GitLab.com or your own instance.
Embed this badge
[](https://trustedmcp.io/servers/godot-mcp)<a href="https://trustedmcp.io/servers/godot-mcp"><img src="https://trustedmcp.io/badge/godot-mcp.svg" alt="TrustedMCP grade D" height="80"></a>Community reviews
Useful, with a few rough edges
Mostly reliable, with the odd timeout. Make sure you are on a patched version, there have been advisories against it. There is no auth layer, so whatever can reach it can use it. I keep it local only. Runs locally over stdio, so startup is instant and nothing leaves my machine unless a tool calls out. I would use it in prod, but only with a human approving writes.
Used for Automating release notes
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 2/5
Works, just lock it down
I like it, with reservations. There is no auth layer, so whatever can reach it can use it. I keep it local only.
Used for Generating boilerplate from existing patterns
- Setup & docs 4/5
- Auth experience 2/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Our team uses it every day
Set this up for our team after comparing a few options. Read-only mode is the first thing I enable, and it covers most of what I need.
Used for Code review summaries for pull requests
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 2/5
Too much access for my comfort
Ran into problems pretty quickly. Check the advisories on the listing before installing an older version from a tutorial. There is no auth layer, so whatever can reach it can use it. I keep it local only. Local stdio process, easy to start and stop from the client. Keeping it to local experiments for now.
Used for Internal developer assistant
- Setup & docs 2/5
- Auth experience 2/5
- Reliability 2/5
- Maintainer responsiveness 1/5
Fine once configured properly
Works well enough for what I need. The past CVEs put me off at first. The fixed releases have been fine, just keep it updated. Not something I would put in production yet.
Used for Keeping project tickets in sync with code changes
- Setup & docs 3/5
- Auth experience 2/5
- Reliability 3/5
- Maintainer responsiveness 3/5
OK for read-only work
Some tools are great, a couple feel half finished. Make sure you are on a patched version, there have been advisories against it. For anything real I would look elsewhere.
Used for Pairing with Claude Code on a monorepo
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 3/5
Security story needs work
It works in a demo, but things got shaky under real use. It is community maintained, so I pin the version and read the changelog before upgrading. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box.
Used for CI failure investigation
- Setup & docs 2/5
- Auth experience 2/5
- Reliability 2/5
- Maintainer responsiveness 2/5
Fine for a demo, not for prod
I wanted to like this one. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. Fine in production if you sandbox it.
Used for Scripting routine maintenance tasks
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 2/5
- Maintainer responsiveness 2/5
Handy for dev, careful in prod
Useful tool, though I would not hand it to a junior unsupervised. No access control at all, it runs with my permissions. Fine on my laptop, not on a shared box. The past CVEs put me off at first. The fixed releases have been fine, just keep it updated. Keep permissions tight and it is a good tool.
Used for Onboarding new devs with an agent that answers repo questions
- Setup & docs 4/5
- Auth experience 2/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.