io.github.doritoman90000/universal-game-modder
NPM · UNIVERSAL-GAME-MODDER · SCANNED SEP 20
Local MCP server: detects a game's engine and gives agents native binary analysis/patching tools.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security98
- No malware found by supply-chain analysis.Pass
- No known CVEs affecting this package version or its production dependencies.Pass
- No install/post-install scripts declared.Pass
- 61 of 160 dependencies flagged as unhealthy (1 deprecated). View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 17 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability79
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 6792 tokens (~67/item across 100 items; 100 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management60
- Stability observed for 18 of 30 days with no destabilising changes; credit accrues until the full window elapses.Partial
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Tool Safety75
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- 0 of 1 tool(s) whose name or description implies an irreversible operation declare an MCP destructiveHint annotation; "build_and_deploy" implies "deploy" and declares no destructiveHint at all, which the MCP spec reads as destructive by default. See how to fix → Fail
- An AI judge read all 100 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
How do I install the io.github.doritoman90000/universal-game-modder MCP server?
io.github.doritoman90000/universal-game-modder runs locally as an npm package, launched with npx -y universal-game-modder. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · universal-game-modder
claude mcp add doritoman90000-universal-game-modder -- npx -y universal-game-modder
{
"mcpServers": {
"doritoman90000-universal-game-modder": {
"command": "npx",
"args": [
"-y",
"universal-game-modder"
]
}
}
} {
"servers": {
"doritoman90000-universal-game-modder": {
"command": "npx",
"args": [
"-y",
"universal-game-modder"
]
}
}
} codex mcp add doritoman90000-universal-game-modder -- npx -y universal-game-modder
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"doritoman90000-universal-game-modder": {
"type": "local",
"command": [
"npx",
"-y",
"universal-game-modder"
],
"enabled": true
}
}
} openclaw mcp add doritoman90000-universal-game-modder --command npx --arg -y --arg universal-game-modder
mcp_servers:
doritoman90000-universal-game-modder:
command: "npx"
args: ["-y", "universal-game-modder"] {
"McpServers": {
"doritoman90000-universal-game-modder": {
"Transport": "stdio",
"Command": "npx",
"Arguments": [
"-y",
"universal-game-modder"
]
}
}
} assistant mcp add doritoman90000-universal-game-modder -t stdio -c npx -a -y universal-game-modder
{
"mcpServers": {
"doritoman90000-universal-game-modder": {
"command": "npx",
"args": [
"-y",
"universal-game-modder"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 20 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 57 to 60. That category is still filling its 30-day observation window: 17 days of observed history at the previous scan, 18 at this one. The score rises as the window fills, whether or not the server changes.
- 18 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 50 to 53. That category is still filling its 30-day observation window: 15 days of observed history at the previous scan, 16 at this one. The score rises as the window fills, whether or not the server changes.
- 16 Sept 26 +2
- CVE-2026-82562 no longer affects this package ▲ security
- CVE-2026-82417 no longer affects this package ▲ security
- Known CVEs: fail → pass ▲ security
- 15 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 40 to 43. That category is still filling its 30-day observation window: 12 days of observed history at the previous scan, 13 at this one. The score rises as the window fills, whether or not the server changes.
- 13 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 33 to 37. That category is still filling its 30-day observation window: 10 days of observed history at the previous scan, 11 at this one. The score rises as the window fills, whether or not the server changes.
- 11 Sept 26 +1
No change was recorded against any check on this day. Stability & Change Management went from 27 to 30. That category is still filling its 30-day observation window: 8 days of observed history at the previous scan, 9 at this one. The score rises as the window fills, whether or not the server changes.
- 10 Sept 26 +3
- Stability: unverified → 0.27 ▲ functional
- 2 Sept 26 68
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 20 Sept 2026 · Analysed npm/universal-game-modder@0.1.4
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Dependencies 160 packages
| Packages resolved | 160 |
|---|---|
| Deprecated | 1 |
| Stale | 60 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
jar_edit_class_constants ~83
Edit numeric constants in .class file bytecode.
| Name | Type | Req | Description |
|---|---|---|---|
| class_path | string | yes | Path to .class file |
| occurrence | number | – | Which occurrence to replace (0-indexed) |
| replacements | object | yes | Map of old_value -> new_value |
| session_id | string | yes | Session ID |
| value_type | string | – | Value type hint |
No output schema declared.
No examples provided.
jar_edit_constant_pool ~56
Edit constants by their exact constant pool index.
| Name | Type | Req | Description |
|---|---|---|---|
| class_path | string | yes | Path to .class file |
| edits | object | yes | Map of pool_index -> new_value |
| session_id | string | yes | Session ID |
No output schema declared.
No examples provided.
jar_edit_file ~52
Edit a text file within the JAR.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | File path within JAR |
| new_content | string | yes | New file content |
| session_id | string | yes | Session ID |
No output schema declared.
No examples provided.
jar_hex_edit ~62
Write raw bytes at a specific offset in a file.
| Name | Type | Req | Description |
|---|---|---|---|
| class_path | string | yes | Path to file |
| hex_data | string | yes | Hex string to write |
| offset | number | yes | Byte offset |
| session_id | string | yes | Session ID |
No output schema declared.
No examples provided.
jar_hex_view ~69
Read raw bytes from a .class file as hex dump.
| Name | Type | Req | Description |
|---|---|---|---|
| class_path | string | yes | Path to file |
| length | number | – | Bytes to read (default 256) |
| offset | number | – | Start offset (default 0) |
| session_id | string | yes | Session ID |
No output schema declared.
No examples provided.
jar_inspect_constant_pool ~67
Dump the constant pool of a .class file.
| Name | Type | Req | Description |
|---|---|---|---|
| class_path | string | yes | Path to .class file |
| filter_type | string | – | Filter by constant type |
| filter_value | string | – | Filter by value |
| session_id | string | yes | Session ID |
No output schema declared.
No examples provided.
jar_list ~52
List contents of an opened JAR file.
| Name | Type | Req | Description |
|---|---|---|---|
| filter_pattern | string | – | Optional filename filter |
| max_results | number | – | Max results (default 100) |
| session_id | string | yes | Session ID |
No output schema declared.
No examples provided.
jar_list_sessions ~16
List all active JAR sessions.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
jar_open ~46
Open and extract a JAR file for exploration and editing.
| Name | Type | Req | Description |
|---|---|---|---|
| jar_path | string | yes | Path to the JAR file |
| session_id | string | – | Optional custom session ID |
No output schema declared.
No examples provided.
jar_preset_apply ~55
Apply a saved preset of constant edits.
| Name | Type | Req | Description |
|---|---|---|---|
| preset_name | string | yes | Preset name to apply |
| reverse | boolean | – | Reverse the edits (default: false) |
| session_id | string | yes | Session ID |
No output schema declared.
No examples provided.
jar_preset_list ~16
List all saved edit presets.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
jar_preset_save ~79
Save a named preset of constant edits for reuse.
| Name | Type | Req | Description |
|---|---|---|---|
| class_path | string | yes | Target class path |
| description | string | yes | Preset description |
| edit_mode | string | – | Edit mode: constants or pool (default: constants) |
| edits | object | yes | Edit map |
| preset_name | string | yes | Preset name |
No output schema declared.
No examples provided.
jar_read_class ~75
Read and decompile a Java .class file.
| Name | Type | Req | Description |
|---|---|---|---|
| class_path | string | yes | Path to .class file within JAR |
| decompile | boolean | – | Decompile to Java source (default: true) |
| extra_classpath | array | – | Additional classpath entries |
| session_id | string | yes | Session ID |
No output schema declared.
No examples provided.
jar_read_file ~41
Read a text file from the JAR.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | File path within JAR |
| session_id | string | yes | Session ID |
No output schema declared.
No examples provided.
jar_repack ~45
Repack the modified JAR file with all changes.
| Name | Type | Req | Description |
|---|---|---|---|
| output_path | string | – | Optional output path (defaults to original) |
| session_id | string | yes | Session ID |
No output schema declared.
No examples provided.
jar_restore_file ~41
Restore a file from backup to undo modifications.
| Name | Type | Req | Description |
|---|---|---|---|
| class_path | string | yes | File path within JAR |
| session_id | string | yes | Session ID |
No output schema declared.
No examples provided.
jar_scaffold_mod ~114
Generate a minimal Minecraft mod JAR structure.
| Name | Type | Req | Description |
|---|---|---|---|
| author | string | – | Author name |
| description | string | – | Mod description |
| loader | string | – | Mod loader: fabric, forge, neoforge (default: fabric) |
| mc_version | string | – | Minecraft version (default: 1.21.5) |
| mod_id | string | yes | Mod ID (lowercase, no spaces) |
| mod_name | string | yes | Mod display name |
| output_dir | string | yes | Output directory |
No output schema declared.
No examples provided.
jar_search ~59
Search within JAR for classes, methods, or strings.
| Name | Type | Req | Description |
|---|---|---|---|
| search_term | string | yes | Search term |
| search_type | string | – | Type: filename, content, classname (default: filename) |
| session_id | string | yes | Session ID |
No output schema declared.
No examples provided.
jar_search_bytecode ~54
Search for numeric values or strings in bytecode.
| Name | Type | Req | Description |
|---|---|---|---|
| file_filter | string | – | Optional file filter pattern |
| search_value | string | yes | Value to search for |
| session_id | string | yes | Session ID |
No output schema declared.
No examples provided.
jar_search_opcodes ~54
Search for bytecode opcode patterns in .class files.
| Name | Type | Req | Description |
|---|---|---|---|
| file_filter | string | – | Optional file filter |
| pattern | string | yes | Opcode pattern to search for |
| session_id | string | yes | Session ID |
No output schema declared.
No examples provided.
list_assets ~70
List assets in loaded game with file sizes.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max results (default 200) |
| offset | number | – | Skip first N results (default 0) |
| path_filter | string | – | Filter assets by path substring |
| type_filter | string | – | Filter by asset type |
No output schema declared.
No examples provided.
list_available_tools ~42
List all tools available for the currently loaded game engine, grouped by category.
| Name | Type | Req | Description |
|---|---|---|---|
| engine | string | – | Engine to list tools for (uses current game if omitted) |
No output schema declared.
No examples provided.
list_exports ~29
List all exports in a package without reading full properties.
| Name | Type | Req | Description |
|---|---|---|---|
| asset_path | string | yes | Asset path |
No output schema declared.
No examples provided.
list_monobehaviours ~52
List all MonoBehaviour components in assembly.
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | yes | Assembly key |
| filter | string | – | Optional name filter |
| limit | number | – | Max results (default 200) |
No output schema declared.
No examples provided.
list_patchable_methods ~69
List all methods in a type that can be Harmony patched.
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | yes | Assembly key |
| filter | string | – | Optional method name filter |
| include_inherited | boolean | – | Include inherited methods (default: false) |
| type_name | string | yes | Full type name |
No output schema declared.
No examples provided.
list_scriptableobjects ~38
List all ScriptableObject types in assembly.
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | yes | Assembly key |
| filter | string | – | Optional name filter |
No output schema declared.
No examples provided.
list_types ~96
List all types (classes, structs, enums, interfaces) in a loaded assembly.
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | yes | Assembly key (from load_assembly) |
| base_type | string | – | Filter by base type name |
| filter | string | – | Filter by name (substring match) |
| kind | string | – | Filter by kind: class, struct, enum, interface |
| limit | number | – | Max results (default 200) |
No output schema declared.
No examples provided.
load_assembly ~62
Load a .NET assembly (DLL) for analysis. Must be called before other Unity tools.
| Name | Type | Req | Description |
|---|---|---|---|
| assembly_path | string | yes | Full path to the .NET DLL file |
| managed_directory | string | – | Optional: path to the Managed directory for dependency resolution |
No output schema declared.
No examples provided.
load_game ~75
Set a game as the active modding target. Auto-detects engine, sets up session state, and returns what tools are available for this game type.
| Name | Type | Req | Description |
|---|---|---|---|
| game_name | string | – | Optional human-readable game name (auto-detected from path if omitted) |
| game_path | string | yes | Full path to the game directory |
No output schema declared.
No examples provided.
mod_this_game ~90
End-to-end game modding assistant. Detects engine, analyzes game structure, and returns a modding plan with available tools and next steps. Start here when modding a new game.
| Name | Type | Req | Description |
|---|---|---|---|
| game_path | string | yes | Full path to the game directory |
| objective | string | – | What you want to mod (e.g. "infinite health", "speed hack", "item spawner") |
No output schema declared.
No examples provided.
offset_to_rva ~51
Convert a file offset to a Relative Virtual Address (RVA) in a PE file.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | Path to PE file |
| offset | number | yes | File offset to convert |
No output schema declared.
No examples provided.
open_game ~75
Open a game directory for Unreal asset reading. Scans for .pak/.ucas/.utoc files.
| Name | Type | Req | Description |
|---|---|---|---|
| aes_key | string | – | AES decryption key if assets are encrypted |
| game_path | string | yes | Path to game directory |
| ue_version | string | – | Unreal Engine version (auto-detected if omitted) |
No output schema declared.
No examples provided.
pattern_scan ~99
IDA-style pattern scan with wildcards. Searches for byte patterns in PE sections.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | Path to PE file |
| max_results | number | – | Max results (default 10) |
| pattern | string | yes | Pattern with wildcards (e.g. "48 8B 05 ?? ?? ?? ?? 48 85 C0") |
| section | string | – | PE section to search (default: .text) |
No output schema declared.
No examples provided.
pattern_scan_all ~58
Scan entire file for a pattern (not limited to a section).
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | Path to file |
| max_results | number | – | Max results (default 50) |
| pattern | string | yes | Pattern with wildcards |
No output schema declared.
No examples provided.
read_asset ~53
Read all exports and properties from an asset.
| Name | Type | Req | Description |
|---|---|---|---|
| asset_path | string | yes | Asset path (e.g. /Game/Maps/MainLevel) |
| max_depth | number | – | Max property nesting depth (default 4) |
No output schema declared.
No examples provided.
read_asset_export ~54
Read a specific named export from an asset.
| Name | Type | Req | Description |
|---|---|---|---|
| asset_path | string | yes | Asset path |
| export_name | string | yes | Export name to read |
| max_depth | number | – | Max depth (default 5) |
No output schema declared.
No examples provided.
read_blueprint ~45
Read Blueprint class definition, components, and default properties.
| Name | Type | Req | Description |
|---|---|---|---|
| asset_path | string | yes | Blueprint asset path |
| max_depth | number | – | Max depth (default 3) |
No output schema declared.
No examples provided.
read_datatable ~58
Read a DataTable asset with all rows and field values.
| Name | Type | Req | Description |
|---|---|---|---|
| asset_path | string | yes | DataTable asset path |
| limit | number | – | Max rows (default 100) |
| row_filter | string | – | Optional row name filter |
No output schema declared.
No examples provided.
read_playerprefs ~53
Read Unity PlayerPrefs from Windows registry.
| Name | Type | Req | Description |
|---|---|---|---|
| company_name | string | yes | Company name from PlayerSettings |
| filter | string | – | Optional key filter |
| product_name | string | yes | Product name from PlayerSettings |
No output schema declared.
No examples provided.
read_unity_assets_info ~34
List Unity asset files in game data directory.
| Name | Type | Req | Description |
|---|---|---|---|
| data_directory | string | yes | Path to game _Data directory |
No output schema declared.
No examples provided.
rva_to_offset ~51
Convert a Relative Virtual Address (RVA) to a file offset in a PE file.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | Path to PE file |
| rva | number | yes | RVA to convert |
No output schema declared.
No examples provided.
scaffold_mod ~126
Generate a mod project skeleton from templates. Creates project files, plugin class, and build configuration.
| Name | Type | Req | Description |
|---|---|---|---|
| framework | string | – | Mod framework: bepinex5, melonloader, jar (auto-detected from loaded game if omitted) |
| game_managed_dir | string | – | Path to game Managed directory (for .csproj references) |
| mod_guid | string | – | Unique mod identifier (e.g. com.author.modname) |
| mod_name | string | yes | Mod name (used for class name and project) |
| output_dir | string | yes | Where to create the mod project |
No output schema declared.
No examples provided.
search_assets ~40
Search for assets by name (case-insensitive).
| Name | Type | Req | Description |
|---|---|---|---|
| limit | number | – | Max results (default 100) |
| query | string | yes | Search query |
No output schema declared.
No examples provided.
search_binary_pattern ~62
Search for text patterns in a binary file using stream-based approach.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | yes | Path to binary file |
| max_results | number | – | Max results per pattern (default 50) |
| patterns | array | yes | Text patterns to search for |
No output schema declared.
No examples provided.
search_code ~76
Search across assembly for types, methods, fields, or string literals.
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | yes | Assembly key |
| limit | number | – | Max results (default 100) |
| pattern | string | yes | Search pattern |
| scope | string | – | Search scope: all, types, methods, fields, strings (default: all) |
No output schema declared.
No examples provided.
unpack_game ~171
CATALOG-FIRST universal unpacker. Recursively walks an ENTIRE game install, classifies and sha256-hashes EVERY file, and persists the catalog into a SQLite <game>.autopsy.db (game/binary/asset/data_store tables, provenance on every row). Read-only: never writes game files. Containers (.pak/.pck/.bundle/...) are catalogued as single rows, never expanded (per-format extraction is a later slice). Idempotent: re-running on the same game re-opens the DB and upserts, no duplicate rows.
| Name | Type | Req | Description |
|---|---|---|---|
| db_path | string | – | Optional output path for the .autopsy.db. Defaults to <game_path>/.autopsy/<name>.autopsy.db. |
| game_path | string | yes | Full path to the game install directory to catalog. |
No output schema declared.
No examples provided.
unreal_game_status ~17
Check current state of Unreal asset reader.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
validate_assembly ~45
Validate compiled plugin DLL for missing references and conflicts.
| Name | Type | Req | Description |
|---|---|---|---|
| managed_directory | string | yes | Path to game Managed directory |
| plugin_path | string | yes | Path to compiled plugin DLL |
No output schema declared.
No examples provided.
validate_patch_target ~77
Validate that a Harmony patch target method exists with expected signature.
| Name | Type | Req | Description |
|---|---|---|---|
| assembly | string | yes | Assembly key |
| expected_params | string | – | Expected parameter types (comma-separated) |
| expected_return | string | – | Expected return type |
| method_name | string | yes | Target method name |
| type_name | string | yes | Target type name |
No output schema declared.
No examples provided.
verify_patches ~50
Verify Harmony patch targets in plugin still exist in game assembly.
| Name | Type | Req | Description |
|---|---|---|---|
| game_assembly | string | yes | Path to game Assembly-CSharp.dll |
| plugin_path | string | yes | Path to compiled plugin DLL |
No output schema declared.
No examples provided.
What is the io.github.doritoman90000/universal-game-modder MCP server?
io.github.doritoman90000/universal-game-modder is an MCP server listed in the public MCP registry as io.github.doritoman90000/universal-game-modder. Local MCP server: detects a game's engine and gives agents native binary analysis/patching tools. This page covers its npm package (universal-game-modder).
Is the io.github.doritoman90000/universal-game-modder MCP server safe to use?
io.github.doritoman90000/universal-game-modder scores 78 out of 100 on VerifyMCP. We found no known CVEs affecting it as of 20 September 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.doritoman90000/universal-game-modder MCP server expose?
io.github.doritoman90000/universal-game-modder exposes 100 tools: detect_engine, load_game, game_status, find_steam_games, mod_this_game, and 95 more. Their descriptions and schemas cost roughly 6,792 tokens of context every time the server is loaded.
Is the io.github.doritoman90000/universal-game-modder MCP server still maintained?
io.github.doritoman90000/universal-game-modder is still listed as active in the MCP registry. We last reached this channel on 20 September 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.doritoman90000/universal-game-modder MCP server under?
io.github.doritoman90000/universal-game-modder declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.