Connect Cursor, Copilot & Claude AI directly to Cheat Engine via MCP. Automate reverse engineering, pointer scanning, and memory analysis using natural language.
MCPpedia last refreshed this data
Cheatengine MCP Bridge is an MCP server that connect Cursor, Copilot & Claude AI directly to Cheat Engine via MCP. Automate reverse engineering, pointer scanning, and memory analysis using natural language. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 83/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients — only the file and path differ.
{
"mcpServers": {
"cheatengine-mcp-bridge": {
"args": [
"mcp"
],
"command": "uvx"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Demo
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
uvx 'mcp' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories — click any category to see the underlying evidence.
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
### Summary In affected versions, the deprecated WebSocket server transport (`mcp.server.websocket.websocket_server`) accepted the WebSocket handshake without applying any `Host` or `Origin` header validation. The `TransportSecuritySettings` mechanism that the SSE and Streamable HTTP transports use for this purpose was not wired into the WebSocket transport, so there was no SDK-level way to restrict which origins could connect. ### Am I affected? Only if a developer's application server exposes
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
### Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a session ID could send JSON-RPC messages on that session, regardless of which bearer token the request carried. ### Am I affected? Only if a developer's application server uses an HTTP transport (SSE,
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
### Summary In affected versions, the default request handlers installed by the experimental tasks feature (`server.experimental.enable_tasks()`) did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and cancel tasks belonging to other clients. ### Am I affected? Only if the developer's application server calls `server.experimental.enable_tasks()`. If `grep -r enable_tasks` over their codebas
Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
### Description The Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using `FastMCP` with streamable HTTP or SSE transport, and has not configured `TransportSecuritySettings`, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or ac
MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS
A validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Thank you to Rich Harang for reporting this issue.
Click any tool to inspect its schema.
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Others in security / developer-tools
Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors
Chrome DevTools for coding agents
Asynchronous coordination layer for AI coding agents: identities, inboxes, searchable threads, and advisory file leases over FastMCP + Git + SQLite
MCP server for using the GitLab API
MCP Security Weekly
Get CVE alerts and security updates for Cheatengine Mcp Bridge and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
Let multibillion $ AI datacenters analyze the program memory for you.
Create mods, trainers, security audits, game bots, accelerate RE, or do anything else with any program and game in a fraction of a time.
[!NOTE] Thanks everyone for the stars, much appreciated! <3
Specially a big thank you to all the contributors!!
@libangli218, @lauralex, @iamtyroon, @HachiroSan, @Attacktive
You're staring at gigabytes of memory. Millions of addresses. Thousands of functions. Finding that one pointer, that one structure takes days or weeks of manual work.
What if you could just ask?
"Find the packet decryptor hook."
"Find the OPcode of character coordinates."
"Find the OPcode of health values."
"Find the unique AOB pattern to make my trainer reliable after game updates."
That's exactly what this does.
- Stop clicking through hex dumps and start having conversations with the memory.
| Before (Manual) | After (AI Agent + MCP) |
|---|---|
| Day 1: Find packet address | Minute 1: "Find RX packet decryption hook" |
| Day 2: Trace what writes to it | Minute 3: "Generate unique AOB signature to make it update persistent" |
| Day 3: Find RX hook | Minute 6: "Find movement OPcodes" |
| Day 4: Document structure | Minute 10: "Create python interpreter of hex to plain text" |
| Day 5: Game updates, start over | Done. |
Your AI can now:
[[base+0x10]+0x20]+0x8 → resolved in msflowchart TD
AI[AI Agent: Claude/Cursor/Copilot]
AI -->|MCP Protocol - JSON-RPC over stdio| MCP
MCP[mcp_cheatengine.py - Python MCP Server]
MCP <-->|Named Pipe - Async| PIPE
PIPE["\\.\\pipe\\CE_MCP_Bridge_v99"]
PIPE <--> CE
subgraph CE[Cheat Engine - DBVM Mode]
subgraph LUA[ce_mcp_bridge.lua]
WORKER[Worker Thread - Blocking I/O]
MAIN[Main Thread - GUI + CE API]
WORKER <-->|Sync| MAIN
end
end
MAIN -->|Memory Access| TARGET[Target .exe]
pip install -r MCP_Server/requirements.txt
Or manually:
pip install mcp pywin32
[!NOTE] Native pipe mode is Windows only because it uses Named Pipes (
pywin32). Use TCP relay transport when the MCP server runs outside the Windows environment that hosts Cheat Engine and cannot open the named pipe directly.
File -> Execute Script -> open MCP_Server/ce_mcp_bridge.lua -> Execute.File -> Execute Script, use Table -> Show Cheat Table Lua Script, paste the dofile(...) line below, and execute it:dofile([[C:\path\to\cheatengine-mcp-bridge\MCP_Server\ce_mcp_bridge.lua]])
Look for: [MCP v12.0.0] MCP Server Listening on: CE_MCP_Bridge_v99
Add to your MCP configuration (e.g., mcp_config.json):
{
"servers": {
"cheatengine": {
"command": "py
... [View full README on GitHub](https://github.com/miscusi-peek/cheatengine-mcp-bridge#readme)