Doyunha Gopeak MCP Server

Findings (18)

• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/gdscript_parser.ts:207
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/sdk@1.29.0: 6 known vulnerabilities

  GHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  axios@1.16.0: 20 known vulnerabilities

  GHSA-3pq3-5fj3-cg6v, GHSA-42h9-826w-cgv3, GHSA-44g4-m2mj-wpvx, GHSA-4hqw-qxg8-jxx2, GHSA-542g-h47m-68v8 +15 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@2.2.2: 2 known vulnerabilities

  GHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  fast-uri@3.1.2: 11 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-fph4-wmhf-6fwf +6 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  follow-redirects@1.16.0: 3 known vulnerabilities

  GHSA-8r9p-f939-6h3c, GHSA-mrwp-f3q8-3g9p, GHSA-q3jh-wrc6-jgq8

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  form-data@4.0.5: 1 known vulnerability

  GHSA-hmw2-7cc7-3qxx

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  hono@4.12.18: 21 known vulnerabilities

  GHSA-2gcr-mfcq-wcc3, GHSA-3hrh-pfw6-9m5x, GHSA-54fx-42gc-7vw4, GHSA-5r4p-p66f-jhc7, GHSA-79qm-7rj5-m7r9 +16 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ip-address@10.2.0: 8 known vulnerabilities

  GHSA-22jq-vg5j-6vgg, GHSA-2vr4-cq9g-pvrc, GHSA-4xrf-jv44-h6hh, GHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv +3 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  ws@8.19.0: 2 known vulnerabilities

  GHSA-58qx-3vcg-4xpx, GHSA-96hv-2xvq-fx4p

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@4.3.6: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@1.19.14: 2 known vulnerabilities

  GHSA-frvp-7c67-39w9, GHSA-rmxm-3fg6-px4f

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  esbuild@0.24.2: 1 known vulnerability

  GHSA-67mh-4wv8-2f99

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.15.0: 4 known vulnerabilities

  GHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-q8mj-m7cp-5q26, GHSA-x5fp-wj9c-mxmx

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a postinstall script

  node scripts/postinstall.mjs

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a prepare script

  npm run build

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  Reads environment variables not listed in the manifest

  GOPEAK_SETUP_HOOKS, GOPEAK_BRIDGE_HOST, GOPEAK_BRIDGE_PORT, GODOT_PATH, SHELL, LOG_MODE, GOPEAK_TOOL_PROFILE, MCP_TOOL_PROFILE, GOPEAK_TOOLS_PAGE_SIZE, USERPROFILE, GODOT_DEBUG, GODOT_BRIDGE_PORT, MCP_BRIDGE_PORT, GODOT_BRIDGE_HOST, GOPEAK_TEST_PROJECT

Network activity

Tools exposed (33)

• tool-catalog

  [compact alias of tool_catalog] Discover available tools including hidden legacy tools. Use query to search by capability keywords. Results include group categorization (core/dynamic). Matching dynamic groups are auto-activated and become available immediately. Core groups (always visible): core_met

• project-list

  [compact alias of list_projects] Scans a directory for Godot projects (folders containing project.godot). Use to discover projects before using other tools. Returns array of {path, name}.

• project-info

  [compact alias of get_project_info] Returns metadata about a Godot project including name, version, main scene, autoloads, and directory structure. Use to understand project before modifying. Requires valid project.godot.

• project-search

  [compact alias of search_project] Searches for text or regex patterns across project files. Use to find function usages, variable references, or TODOs. Returns file paths and line numbers.

• project-setting-get

  [compact alias of get_project_setting] Reads a value from project.godot settings. Use to check game name, window size, physics settings, etc.

• project-setting-set

  [compact alias of set_project_setting] Writes a value to project.godot settings. Use to configure game name, window size, physics, etc.

• editor-launch

  [compact alias of launch_editor] Opens the Godot editor GUI for a project. Use when visual inspection or manual editing of scenes/scripts is needed. Opens a new window on the host system. Requires: project directory with project.godot file.

• editor-run

  [compact alias of run_project] Launches a Godot project in a new window and captures output. Use to test gameplay or verify script behavior. Runs until stop_project is called. Use get_debug_output to retrieve logs.

• editor-stop

  [compact alias of stop_project] Terminates the currently running Godot project process. Use to stop a project started with run_project. No effect if no project is running.

• editor-debug-output

  [compact alias of get_debug_output] Retrieves console output and errors from the currently running Godot project. Use after run_project to check logs, errors, and print statements. Returns empty if no project is running.

• editor-status

  [compact alias of get_editor_status] Returns the connection status of the Godot Editor Plugin bridge. Use to check if the editor is connected before using scene/resource tools that require the editor plugin.

• editor-version

  [compact alias of get_godot_version] Returns the installed Godot engine version string. Use to check compatibility (e.g., Godot 4.4+ features like UID). Returns version like "4.3.stable" or "4.4.dev".

• scene-create

  [compact alias of create_scene] Creates a new Godot scene file (.tscn) with a specified root node type. Use to start building new game levels, UI screens, or reusable components. The scene is saved automatically after creation.

• scene-save

  [compact alias of save_scene] Saves changes to a scene file or creates a variant at a new path. Most scene modification tools save automatically, but use this for explicit saves or creating variants.

• scene-nodes

  [compact alias of list_scene_nodes] Returns complete scene tree structure with all nodes, types, and hierarchy. Use to understand scene organization before modifying. Returns nested tree with node paths.

• scene-node-add

  [compact alias of add_node] Adds ANY node type to an existing scene. This is the universal node creation tool — replaces all specialized create_* node tools. Supports ALL ClassDB node types (Camera3D, DirectionalLight3D, AudioStreamPlayer, HTTPRequest, RayCast3D, etc.). Set any property via the prop

• scene-node-properties

  [compact alias of get_node_properties] Returns all properties of a specific node in a scene. Use to inspect current values before modifying. Returns property names, values, and types.

• scene-node-set

  [compact alias of set_node_properties] Sets multiple properties on a node in a scene. Prerequisite: scene and node must exist (use create_scene and add_node first). Use to modify position, scale, rotation, or any node-specific properties. Scene is saved automatically unless saveScene=false.

• scene-node-delete

  [compact alias of delete_node] Removes a node and all its children from a scene. Use to clean up unused nodes. Cannot delete root node. Scene is saved automatically unless saveScene=false.

• script-create

  [compact alias of create_script] Creates a new GDScript (.gd) file with optional templates. Use to generate scripts for game logic. Templates: "singleton" (autoload), "state_machine" (FSM), "component" (modular), "resource" (custom Resource).

• script-modify

  [compact alias of modify_script] Adds functions, variables, or signals to an existing GDScript. Use to extend scripts without manual editing. Supports @export, @onready annotations and type hints.

• script-info

  [compact alias of get_script_info] Analyzes a GDScript and returns its structure: functions, variables, signals, class_name, extends. Use before modify_script to understand existing code.

• class-query

  [compact alias of query_classes] Query available Godot classes from ClassDB with filtering. Use to discover node types, resource types, or any class before using add_node/create_resource. Categories: node, node2d, node3d, control, resource, physics, physics2d, audio, visual, animation.

• class-info

  [compact alias of query_class_info] Get detailed information about a specific Godot class: methods, properties, signals, enums. Use to discover available properties before calling add_node/create_resource/set_node_properties, or to find methods before call_runtime_method.

• signal-connect

  [compact alias of connect_signal] Creates a signal connection between nodes in a scene. Prerequisite: source and target nodes must exist. Use to wire up button clicks, collision events, custom signals. Saved to scene file.

• resource-dependencies

  [compact alias of get_dependencies] Analyzes resource dependencies and detects circular references. Use to understand what a scene/script depends on before refactoring.

• export-presets

  [compact alias of list_export_presets] Lists all export presets defined in export_presets.cfg. Use before export_project to see available targets (Windows, Linux, Android, etc.).

• export-run

  [compact alias of export_project] Exports the project to a distributable format. Use to build final game executables. Requires export templates installed.

• runtime-status

  [compact alias of get_runtime_status] Checks if a Godot game instance is running and connected for live debugging. Use before other runtime tools.

• visualizer-map

  [compact alias of map_project] Crawl the entire Godot project and build an interactive visual map of all scripts showing their structure (variables, functions, signals), connections (extends, preloads, signal connections), and descriptions. Opens an interactive browser-based visualization at localho

• lsp-diagnostics

  [compact alias of lsp_get_diagnostics] Get GDScript diagnostics from Godot Language Server for a script file.

• dap-output

  [compact alias of dap_get_output] Get captured Godot DAP console output lines

• tool-groups

  [compact alias of manage_tool_groups] Manage tool groups. Actions: list (show all core + dynamic groups), activate (enable a dynamic group), deactivate (disable a dynamic group), reset (disable all dynamic), status (show current state). Core groups (always visible, 33 tools): core_meta, core_project