MCP server for controlling UEFN (Unreal Editor for Fortnite) from Claude Code — 22 tools for actors, assets, levels, viewport, and Python execution
MCPpedia last refreshed this data
Uefn MCP Server is an MCP server that MCP server for controlling UEFN (Unreal Editor for Fortnite) from Claude Code — 22 tools for actors, assets, levels, viewport, and Python execution. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 52/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients — only the file and path differ.
{
"mcpServers": {
"uefn": {
"args": [
"C:/path/to/uefn-mcp-server/mcp_server.py"
],
"command": "python"
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Control UEFN (Unreal Editor for Fortnite) from Claude Code via the Model Context Protocol.
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
uvx 'mcp' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories — click any category to see the underlying evidence.
MCP Python SDK: WebSocket server transport does not support Host/Origin validation
### Summary In affected versions, the deprecated WebSocket server transport (`mcp.server.websocket.websocket_server`) accepted the WebSocket handshake without applying any `Host` or `Origin` header validation. The `TransportSecuritySettings` mechanism that the SSE and Streamable HTTP transports use for this purpose was not wired into the WebSocket transport, so there was no SDK-level way to restrict which origins could connect. ### Am I affected? Only if a developer's application server exposes
MCP Python SDK: HTTP transports serve session requests without verifying the authenticated principal
### Summary In affected versions, the SSE and Streamable HTTP server transports routed incoming requests to an existing session based only on the session identifier, without verifying that the request was authenticated as the same principal that created the session. Anyone who learned or guessed a session ID could send JSON-RPC messages on that session, regardless of which bearer token the request carried. ### Am I affected? Only if a developer's application server uses an HTTP transport (SSE,
MCP Python SDK: Experimental task handlers allow any client to access and cancel other clients' tasks
### Summary In affected versions, the default request handlers installed by the experimental tasks feature (`server.experimental.enable_tasks()`) did not check which session created a task before acting on it. On a server with more than one connected client, any client could observe, read results from, and cancel tasks belonging to other clients. ### Am I affected? Only if the developer's application server calls `server.experimental.enable_tasks()`. If `grep -r enable_tasks` over their codebas
Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default
### Description The Model Context Protocol (MCP) Python SDK does not enable DNS rebinding protection by default for HTTP-based servers. When an HTTP-based MCP server is run on localhost without authentication using `FastMCP` with streamable HTTP or SSE transport, and has not configured `TransportSecuritySettings`, a malicious website could exploit DNS rebinding to bypass same-origin policy restrictions and send requests to the local MCP server. This could allow an attacker to invoke tools or ac
MCP Python SDK vulnerability in the FastMCP Server causes validation error, leading to DoS
A validation error in the MCP SDK can cause an unhandled exception when processing malformed requests, resulting in service unavailability (500 errors) until manually restarted. Impact may vary depending on the deployment conditions, and presence of infrastructure-level resilience measures. Thank you to Rich Harang for reporting this issue.
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Others in developer-tools / entertainment
Context7 Platform -- Up-to-date code documentation for LLMs and AI code editors
XcodeBuildMCP provides tools for Xcode project management, simulator management, and app utilities.
A Model Context Protocol (MCP) server and CLI that provides tools for agent use when working on iOS and macOS projects.
Monitor browser logs directly from Cursor and other MCP compatible IDEs.
MCP Security Weekly
Get CVE alerts and security updates for Uefn Mcp Server and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.
Control UEFN (Unreal Editor for Fortnite) from Claude Code via the Model Context Protocol.
Claude Code <--stdio--> MCP Server (mcp_server.py) <--HTTP--> Listener (uefn_listener.py, inside UEFN)
unreal.* calls dispatched via editor tick callbackOpen Claude Code and ask: "Help me set up UEFN MCP server" — it will install dependencies, create config files, and walk you through the rest.
If you prefer to do it manually, follow steps 1-5 below.
Use Tools > Execute Python Script in the UEFN menu bar, then select the uefn_listener.py file.
A status window will appear showing:
You can safely close this window — the listener continues running in the background.
On your system (not inside UEFN):
pip install mcp
Create .mcp.json in your project root (or add to ~/.claude/settings.json):
{
"mcpServers": {
"uefn": {
"command": "python",
"args": ["C:/path/to/uefn-mcp-server/mcp_server.py"]
}
}
}
Claude Code picks up .mcp.json on startup. After restart, you'll have 28 UEFN tools available.
Ask Claude Code:
To start the listener automatically when UEFN opens your project:
# Copy both files to your UEFN project's Content/Python/ directory
cp uefn_listener.py <YourUEFNProject>/Content/Python/uefn_listener.py
cp init_unreal.py <YourUEFNProject>/Content/Python/init_unreal.py
UEFN automatically executes init_unreal.py on project open.
| Category | Tools |
|---|---|
| System | ping, execute_python, get_log, get_editor_log, shutdown |
| Actors | get_all_actors, get_selected_actors, spawn_actor, delete_actors, set_actor_transform, get_actor_properties, set_actor_properties, select_actors, focus_selected |
| Assets | list_assets, get_asset_info, get_selected_assets, rename_asset, delete_asset, duplicate_asset, does_asset_exist, save_asset, search_assets |
| Project | get_project_info |
| Level | save_current_level, get_level_info |
| Viewport | get_viewport_camera, set_viewport_camera |
The execute_python tool is the most powerful — it runs arbitrary Python code inside the editor with full access to the unreal module:
# Pre-populated variables: unreal, actor_sub, asset_sub, level_sub, tk, get_tk_root
# Assign to `result` to return a value
actors = actor_sub.get_all_level_actors()
result = [a.get_actor_label() for a in actors]
Tkinter note: When creating UI windows via
execute_python, useget_tk_root()+tk.Toplevel(root). Never calltk.Tk()— multiple instances crash the editor.
The system uses two independently running Python process