Minecraft MCP Server
by yuniko-softwareA Minecraft MCP Server powered by Mineflayer API. It allows to control a Minecraft character in real-time, allowing AI assistants to build structures, explore the world, and interact with the game environment through natural language instruction
Minecraft MCP Server is an open-source mcp server by yuniko-software, written mainly in TypeScript, with 802 GitHub stars and the Apache-2.0 license. Its code was last updated Apr 4, 2026.
Scan summary: scanned Nov 5, 2026 at commit 240c8ce. No capabilities flagged by our checks. Scan policy
ScannedScanned. The automated checks below ran on the commit shown. Read each line for what was and was not covered.
Full scan at
240c8ce · Nov 5, 2026 ScannedStatic, secrets and dependency checks completed with no critical findings. BuildsIt installed from a fresh machine. BootsIt started, and MCP servers answered the protocol handshake. No undeclared egressWhile running it only contacted the domains it declared. ReproducibleEarned in this scan.
Passed. This check ran and found nothing it flags.Static code scanpassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Secrets scanpassPassed. This check ran and found nothing it flags.
Flagged. This check found an issue. See the findings below.Dependency audit164 known vulnerabilitiesfailFlagged. This check found an issue. See the findings below.
Warning. This check found something worth reading in the findings below. It is not proof of a problem.ManifestnonewarnWarning. This check found something worth reading in the findings below. It is not proof of a problem.
Passed. This check ran and found nothing it flags.BuildpassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Boot & handshake22 toolspassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Network egresspassPassed. This check ran and found nothing it flags.
Passed. This check ran and found nothing it flags.Reproducible (×3)passPassed. This check ran and found nothing it flags.
Findings (35)
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- highHigh. Something risky that needs a close look before you install.dependencies issueDetails are available to the maintainer after claiming this listing.
- mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@hono/node-server@1.19.9: 3 known vulnerabilitiesGHSA-92pp-h63x-v22m, GHSA-frvp-7c67-39w9, GHSA-wc8c-qw6v-h7f6
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.@modelcontextprotocol/sdk@1.27.1: 6 known vulnerabilitiesGHSA-22jm-h49p-29qw, GHSA-46jr-4wx8-v453, GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h, GHSA-f897-62hf-6gxq +1 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.axios@0.21.4: 23 known vulnerabilitiesGHSA-3g43-6gmg-66jw, GHSA-3p68-rc4w-qgx5, GHSA-43fc-jf86-j433, GHSA-5c9x-8gcm-mpgx, GHSA-62hf-57xw-28j9 +18 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.body-parser@2.2.2: 2 known vulnerabilitiesGHSA-27r3-jxmh-p828, GHSA-v422-hmwv-36x6
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@1.1.12: 7 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +2 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@2.0.2: 7 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-mh99-v99m-4gvg, GHSA-q2hr-2g5m-vwhr +2 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.brace-expansion@5.0.3: 8 known vulnerabilitiesGHSA-3jxr-9vmj-r5cp, GHSA-6j4f-fj2g-mc7p, GHSA-f886-m6hf-6m8v, GHSA-jxxr-4gwj-5jf2, GHSA-mh99-v99m-4gvg +3 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.express-rate-limit@8.2.1: 1 known vulnerabilityGHSA-46wh-pxpv-q5gq
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.fast-uri@3.1.0: 12 known vulnerabilitiesGHSA-333x-w4r6-6crp, GHSA-4c8g-83qw-93j6, GHSA-7p8r-x3mc-p8w7, GHSA-f65p-4m7j-42xc, GHSA-hrr3-gc8f-f4qj +7 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.flatted@3.3.3: 2 known vulnerabilitiesGHSA-25h7-pfq9-p65f, GHSA-rf6f-7fwh-wjgh
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.glob@10.4.5: 2 known vulnerabilitiesGHSA-3g3m-2fjr-6pw4, GHSA-5j98-mcp5-4vw2
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.hono@4.11.7: 34 known vulnerabilitiesGHSA-26pp-8wgv-hjvm, GHSA-2gcr-mfcq-wcc3, GHSA-3hrh-pfw6-9m5x, GHSA-458j-xx4x-4375, GHSA-5pq2-9x2x-5p6w +29 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.ip-address@10.0.1: 6 known vulnerabilitiesGHSA-h3mg-xc3c-68pw, GHSA-j6r3-76f7-8jcv, GHSA-mwp4-54f8-5fhr, GHSA-rpw4-54j3-4h4q, GHSA-rxp7-6hxx-x8q5 +1 more
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@3.14.1: 5 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.js-yaml@4.1.0: 5 known vulnerabilitiesGHSA-2883-xcg3-v3hh, GHSA-52cp-r559-cp3m, GHSA-5p4m-2wfm-xmqj, GHSA-h67p-54hq-rp68, GHSA-mh29-5h37-fv8m
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.lodash@4.17.21: 2 known vulnerabilitiesGHSA-r5fr-rjxr-66jc, GHSA-xxjr-mmjv-4gpg
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.minimatch@3.1.2: 3 known vulnerabilitiesGHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.minimatch@9.0.5: 4 known vulnerabilitiesGHSA-23c5-xmqv-rm74, GHSA-3ppc-4f35-3m26, GHSA-7r86-cg39-jmmj, GHSA-g3hv-75wg-m249
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.path-to-regexp@8.3.0: 2 known vulnerabilitiesGHSA-27v5-c462-wpq7, GHSA-j3q9-mxjg-w52f
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.picomatch@2.3.1: 2 known vulnerabilitiesGHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.picomatch@4.0.3: 2 known vulnerabilitiesGHSA-3v7f-55p6-f55p, GHSA-c2c7-rcm5-vvqj
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.uuid@8.3.2: 1 known vulnerabilityGHSA-w5hq-g745-h8pq
package-lock.json - mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.zod@3.25.76: 1 known vulnerabilityGHSA-mrhx-c7xc-m3w5
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.@humanfs/node@0.16.6: 1 known vulnerabilityGHSA-p498-v437-472g
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.ajv@6.12.6: 1 known vulnerabilityGHSA-2g4f-4pwh-qvx6
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.ajv@8.17.1: 1 known vulnerabilityGHSA-2g4f-4pwh-qvx6
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.diff@4.0.2: 1 known vulnerabilityGHSA-73rr-hh4g-fpgx
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.diff@8.0.2: 1 known vulnerabilityGHSA-73rr-hh4g-fpgx
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.follow-redirects@1.15.11: 1 known vulnerabilityGHSA-r4q5-vmmm-2653
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.minimatch@10.2.4: 1 known vulnerabilityGHSA-g3hv-75wg-m249
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.qs@6.15.0: 4 known vulnerabilitiesGHSA-4mjr-xmp4-gh2g, GHSA-6pq8-jhm2-2vcw, GHSA-q8mj-m7cp-5q26, GHSA-x5fp-wj9c-mxmx
package-lock.json - lowLow. Minor, or common in normal tools. Shown for information.package.json has a prepare scriptnpm run build
package.json - lowLow. Minor, or common in normal tools. Shown for information.No manifest declaring network access and environment variables (agent.json)
Network activity
During install
registry.npmjs.org
While running
No connections
Tools exposed (22)
get-positionGet the current position of the bot
move-to-positionMove the bot to a specific position
look-atMake the bot look at a specific position
jumpMake the bot jump
move-in-directionMove the bot in a specific direction for a duration
list-inventoryList all items in the bot's inventory
find-itemFind a specific item in the bot's inventory
equip-itemEquip a specific item
place-blockPlace a block at the specified position
dig-blockDig a block at the specified position
get-block-infoGet information about a block at the specified position
find-blocksFind one or more nearby blocks of a specific type
find-entityFind the nearest entity of a specific type
send-chatSend a chat message in-game
read-chatGet recent chat messages from players
fly-toMake the bot fly to a specific position
detect-gamemodeDetect the gamemode on game
list-recipesList all available crafting recipes the bot can make with current inventory
craft-itemCraft an item using a crafting recipe
get-recipeGet detailed information about a specific recipe
can-craftCheck if the bot can craft a specific item with current inventory
smelt-itemSmelt items using a furnace-like block
Automated result for the commit shown. See our scan policy. View the scan log
Maintainers can claim the listing to rescan, or dispute a result.
Minecraft MCP Server alternatives
View more →Similar mcp servers in Gaming & Game Dev, ranked by GitHub stars. Compare licence, recent activity and scan status before you choose.
| Name | Stars | Licence | Last updated | Scan |
|---|---|---|---|---|
| Minecraft MCP Server (this page) yuniko-software | 802 | Apache-2.0 | Apr 4, 2026 | Scanned, no flagged issues |
| Unity MCP CoplayDev | 16k | MIT | Oct 30, 2026 | Scanned, no flagged issues |
| Godot MCP Coding-Solo | 6.5k | MIT | Apr 16, 2026 | Scanned, no flagged issues |
| Unity MCP IvanMurzak | 4.6k | Apache-2.0 | Oct 31, 2026 | Scanned, no flagged issues |
| MCP Unity CoderGamester | 2k | MIT | Oct 11, 2026 | Scanned, no flagged issues |
| Mcpelauncher Manifest minecraft-linux | 1.7k | GPL-3.0 | Oct 29, 2026 | Scanned, no flagged issues |