# Unreal_mcp > A comprehensive Model Context Protocol (MCP) server that enables AI assistants to control Unreal Engine through the native C++ Automation Bridge plugin. Built with TypeScript and C++. - **URL**: https://www.freshcrate.ai/projects/Unreal_mcp - **Author**: ChiR24 - **Category**: MCP Servers - **Latest version**: `v0.5.30` (2026-06-05) - **License**: MIT - **Source**: https://github.com/ChiR24/Unreal_mcp - **Language**: C++ - **GitHub**: 532 stars, 87 forks - **Registry**: github - **Tags**: `c++`, `mcp`, `mcp-server`, `unreal-engine`, `unreal-engine-5` ## Description A comprehensive Model Context Protocol (MCP) server that enables AI assistants to control Unreal Engine through the native C++ Automation Bridge plugin. Built with TypeScript and C++. ## Recent releases | Version | Date | Urgency | Changes | | --- | --- | --- | --- | | `v0.5.30` | 2026-06-05 | High | > [!IMPORTANT] > ### 🚀 Native MCP & Code-Backed Tool Parity Release > This release covers the `v0.5.21` to `0.5.30` release diff, including the TypeScript MCP server, native bridge plugin, tests, scripts, docs, workflows, and dependency manifests. The summary below is based on code and test changes, not commit subjects alone.
✨ Added - **Native MCP Streamable HTTP endpoint** — added an opt-in in-plugin `/mcp` server with JSON-RPC 2.0 initialize/tools/list/ | | `v0.5.21` | 2026-04-03 | High | ## What's Changed * fix: widget crash by @ChiR24 in https://github.com/ChiR24/Unreal_mcp/pull/306 * 🛡️ Sentinel: [HIGH] Fix unsafe path handling in export_level by @google-labs-jules[bot] in https://github.com/ChiR24/Unreal_mcp/pull/305 * docs: fix rate limiting defaults and missing GraphQL heading by @kalihman in https://github.com/ChiR24/Unreal_mcp/pull/307 * fix: enable searchText filtering in search_assets action by @kalihman in https://github.com/ChiR24/Unreal_mcp/pull/308 * fix: alig | | `v0.5.20` | 2026-03-20 | Low | > [!IMPORTANT] > ### 🛡️ Security Fix & UE 5.0 Compatibility > This release includes a critical path traversal fix in export_asset, UE 5.0 compatibility improvements, and external actors support for World Partition. ### 🛡️ Security
🔒 Path Traversal in export_asset (5cf2a3c) \| Aspect \| Details \| \|--------\|---------\| \| **Severity** \| 🚨 CRITICAL \| \| **Vulnerability** \| Path traversal in `exp | | `v0.5.19` | 2026-03-17 | Low | --- > [!IMPORTANT] > ### 🛡️ Security Hardening & Major Plugin Refactoring > This release includes critical security fixes for command injection and path traversal vulnerabilities, a complete deep-level refactoring of 57 C++ handler files with centralized utilities, and removal of the WebAssembly integration. ### 🛡️ Security
🔒 Command Injection Prevention (#288) \| Component \| Change \| | | `v0.5.18` | 2026-02-21 | Low | > [!IMPORTANT] > ### 🔧 Installation, Documentation & Dependency Updates > This release fixes npm install failures when downloading from GitHub releases, adds first-time project setup guidance, and updates dependencies. ### 🛠️ Fixed
🐛 npm install failure from release archives (#215) \| Issue \| Root Cause \| Fix \| \|-------\|------------\|-----\| \| `npm install` fails with ESLint config error \| Release | | `v0.5.17` | 2026-02-16 | Low | > [!IMPORTANT] > ### 🔧 World Tools Category Fixes & Security Hardening > This release includes critical bug fixes, security hardening, and UE 5.7 compatibility improvements across all world-building tools (landscape, foliage, geometry, volumes, navigation). ### 🛡️ Security
🔒 Path Validation & Input Sanitization (#207) \| Component \| Change \| \|-----------\|--------\| \| **SanitizeProjectRelativePath | | `v0.5.16` | 2026-02-12 | Low | Release v0.5.16 ## What's Changed * feat(bridge): add IPv6 support and hostname validation in https://github.com/ChiR24/Unreal_mcp/pull/194 * feat: implement 200+ MCP action handlers for comprehensive UE automation in https://github.com/ChiR24/Unreal_mcp/pull/200 * feat(tests): add heartbeat/progress protocol integration tests and enhance test runner setup in https://github.com/ChiR24/Unreal_mcp/pull/201 * Potential fix for code scanning alert no. 25: Incomplete string escaping or encodin | | `v0.5.15` | 2026-02-06 | Low | Release v0.5.15 ## What's Changed * chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in https://github.com/ChiR24/Unreal_mcp/pull/190 * chore(deps): bump github/codeql-action from 4.32.1 to 4.32.2 by @dependabot[bot] in https://github.com/ChiR24/Unreal_mcp/pull/189 * feat: add support for non-loopback binding in automation bridge settings by @ChiR24 in https://github.com/ChiR24/Unreal_mcp/pull/193 **Full Changelog**: https://github.com/ChiR24/Unreal_mcp/comp | | `v0.5.14` | 2026-02-05 | Low | > [!IMPORTANT] > ### 🔐 TLS & Network Security Release > This release introduces TLS/SSL support for secure WebSocket connections (`wss://`), per-connection rate limiting, loopback-only network binding enforcement, and authentication state tracking for the Automation Bridge. ### 🛡️ Security
🔒 Loopback-Only Binding & Handshake Enforcement (70c2745) \| Aspect \| Details \| \|--------\|---------\| \| **Severity** \| 🚨 HIGH \| \| **Loopback Binding** \| A | | `v0.5.13` | 2026-02-02 | Low | > [!IMPORTANT] > ### 🛡️ Security & Compatibility Release > This release includes multiple critical security fixes for command injection and path traversal vulnerabilities, along with full Unreal Engine 5.0 backward compatibility and WebSocket stability improvements. ### 🛡️ Security
🔒 Command Injection in UITools (#144) \| Aspect \| Details \| \|--------\|---------\| \| **Severity** \| 🚨 HIGH \| \| **Vul | ## Dependency audit - **Score**: 100/100 - **Total deps**: 17 - **Resolved**: 17 - **Unresolved**: 0 - **License conflicts**: 0 - **Warnings**: 0 - **Scanned**: 2026-05-11 ## Citation - HTML: https://www.freshcrate.ai/projects/Unreal_mcp - Markdown: https://www.freshcrate.ai/projects/Unreal_mcp.md - Dependencies JSON: https://www.freshcrate.ai/api/projects/Unreal_mcp/deps _Generated by freshcrate.ai. Indexes github releases for AI-agent ecosystem packages._