Skip to content

n24q02m/better-godot-mcp

v1.12.0 Security

This release includes 4 security fixes for security teams reviewing exposed deployments.

Published 1mo MCP Developer Tools
✓ No known CVEs patched
Read the diff → Tool health → What is this tool? →
This release patches 4 known CVEs

Topics

ai-agents ai-coding claude claude-code cursor docker
+7 more
gdscript godot godot-engine mcp mcp-server model-context-protocol typescript

Affected surfaces

rce_ssrf deps

Summary

AI summary

Prevent argument injection in Godot project export, adding cross‑OS CI matrix and migrating transport to HTTP default.

Full changelog

v1.12.0 (2026-04-13)

Bug Fixes

  • Add tests for launchGodotEditor and consolidate suites (#466, 462f0e8)

  • Add tests for setSettingInContent edge case (#454, 8f6ccb6)

  • Add tests for wrapToolResult in registerTools (#457, 3dfd8a5)

  • Bump @n24q02m/mcp-core to 1.0.0-beta.4 (d755b93)

  • Bump @n24q02m/mcp-core to ^1.0.0 stable (b60b930)

  • Deduplicate boilerplate via createAnnotations helper (e1ef6fc)

  • Fix strict type checks for readdirSync mock (593cfa0)

  • Force LF line endings in .gitattributes to unblock Windows CI (f46caae)

  • Optimize input-map parser with direct string indexing (6f16b87)

  • Optimize nodes list with single-pass mapping (e91dded)

  • Pin @n24q02m/mcp-core to published 1.0.0-beta.3 instead of local editable path (0b92867)

  • Prevent argument injection in Godot project export (fe54521)

  • Refactor handleScripts into per-action helpers (efa7548)

  • Refactor handleUI into discrete functions (8e11ef6)

  • Refactor handleUI into discrete functions and fix formatting (8e11ef6)

  • Refactor handleUI into per-action helpers (8e11ef6)

  • Replace regex with string boundary checks in parseGodotValue (7fb9bb5)

  • Sanitize node construction to prevent scene file injection (6703be6)

  • Sanitize physics properties to prevent scene file injection (38b5223)

  • Sanitize signal connection parameters to prevent scene file injection (ae23827)

  • Strict type checks for readdirSync mock (593cfa0)

  • Validate Godot executable path to prevent arbitrary binary execution (a15ba00)

Chores

  • deps: Lock file maintenance (#449, 0ed42d8)

  • security: Update dependencies to fix npm audit vulnerabilities (a1d9cdf)

Features

  • Add cross-OS CI matrix (ubuntu/windows/macos) (be1ffc1)

  • Add mcp-core dependency for future transport and lifecycle integration (f785c15)

  • Migrate code review from Qodo to CodeRabbit (#412, 7151bb7)

  • Migrate from stdio-only to HTTP-default transport (a7c5fca)

  • Migrate HTTP transport to mcp-core runLocalServer (ee4175d)

  • Optimize disconnect string parsing in handleSignals (#450, 2f8b583)

  • Optimize godot types parsing and serialization (#448, d8fcc3f)

  • Optimize handleNodes list action (e91dded)

  • Optimize input map string parsing (6f16b87)


Detailed Changes: v1.11.0...v1.12.0

Security Fixes

  • Prevent argument injection in Godot project export
  • Sanitize node construction, physics properties, and signal connection parameters to prevent scene file injection
  • Validate Godot executable path to prevent arbitrary binary execution
  • Update dependencies to fix npm audit vulnerabilities

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Track n24q02m/better-godot-mcp

Get notified when new releases ship.

Sign up free

About n24q02m/better-godot-mcp

18 composite tools for structured Godot 4.x interaction: scenes, nodes, GDScript, shaders, animation, tilemap, physics, audio, navigation, UI, input mapping, and signals.

All releases →

Beta — feedback welcome: [email protected]