AI Skills, MCP Tools, and CLI for Unity Engine. Full AI develop and test loop. Use cli for quick setup. Efficient token usage, advanced tools. Any C# method may be turned into a tool by a single line. Works with Claude Code, Gemini, Copilot, Cursor and any other absolutely for free.
This report summarizes scanner evidence for IvanMurzak/Unity-MCP, a C# project with 4,562 GitHub stars. SynthScan examined 196,612 lines of code across 1487 source files, recording 561 pattern matches distributed across 17 syntactic categories. The legacy adjusted pattern signal is 6.5 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Payload schema: 1.0.0 · Engine: 2.0.0 · Scoring: heuristic-density-v1 · Scan date: 2026-10-31.
Can maintainers explain intent, assumptions, and trade-offs? 289 finding(s).
Are imports declared and package/API names verified? 62 finding(s).
Are wrappers, guards, and repeated structures necessary? 272 finding(s).
Which changes need focused human review? 561 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 561 distinct pattern matches across 17 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | README.md | 300 | # 1.1 Install unity-mcp-cli # ┌────────────────────┐ | COMMENT |
| MEDIUM | README.md | 302 | # ├────────────────────┤ | COMMENT |
| MEDIUM | README.md | 317 | # └────────────────────┘ | COMMENT |
| MEDIUM | docs/README.es.md | 300 | # 1.1 Instalar unity-mcp-cli # ┌────────────────────┐ | COMMENT |
| MEDIUM | docs/README.es.md | 302 | # ├────────────────────┤ | COMMENT |
| MEDIUM | docs/README.es.md | 317 | # └────────────────────┘ | COMMENT |
| MEDIUM | docs/README.ja.md | 300 | # 1.1 unity-mcp-cli をインストール # ┌────────────────────┐ | COMMENT |
| MEDIUM | docs/README.ja.md | 302 | # ├────────────────────┤ | COMMENT |
| MEDIUM | docs/README.ja.md | 317 | # └────────────────────┘ | COMMENT |
| MEDIUM | docs/README.zh-CN.md | 300 | # 1.1 安装 unity-mcp-cli # ┌────────────────────┐ | COMMENT |
| MEDIUM | docs/README.zh-CN.md | 302 | # ├────────────────────┤ | COMMENT |
| MEDIUM | docs/README.zh-CN.md | 317 | # └────────────────────┘ | COMMENT |
| MEDIUM | cli/README.md | 57 | # 1.1 Install unity-mcp-cli # ┌────────────────────┐ | COMMENT |
| MEDIUM | cli/README.md | 59 | # ├────────────────────┤ | COMMENT |
| MEDIUM | cli/README.md | 74 | # └────────────────────┘ | COMMENT |
| MEDIUM | cli/tests/open.test.ts | 168 | // ── Unit tests for the extracted validation helpers ─────────────────────────── | COMMENT |
| MEDIUM | cli/tests/close.test.ts | 63 | // ─── close command — flag parsing, refusals, idempotent no-op ───────────────── | COMMENT |
| MEDIUM | cli/tests/close.test.ts | 139 | // ─── path normalisation helpers (pure unit tests) ──────────────────────────── | COMMENT |
| MEDIUM | cli/tests/close.test.ts | 234 | // ─── shutdown utility unit tests ────────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/tests/close.test.ts | 355 | // ─── live-editor integration smoke test (gated by UMCP_LIVE=1) ─────────────── | COMMENT |
| MEDIUM | cli/tests/run-tool.test.ts | 57 | // ── resolveConnectionFromConfig unit tests ──────────────────────────────────── | COMMENT |
| MEDIUM | cli/tests/run-tool.test.ts | 193 | // ── machine-store credential wiring (default, un-injected path) ─────────────── | COMMENT |
| MEDIUM | cli/tests/run-tool.test.ts | 242 | // ── resolveConnection cloud-auth-missing signal (feeds the run-tool guard) ───── | COMMENT |
| MEDIUM | cli/tests/run-tool.test.ts | 329 | // ── run-tool CLI integration tests ──────────────────────────────────────────── | COMMENT |
| MEDIUM | cli/tests/run-tool.test.ts | 371 | // ── run-tool config-based resolution integration tests ──────────────────────── | COMMENT |
| MEDIUM | cli/docs/README.es.md | 57 | # 1.1 Install unity-mcp-cli # ┌────────────────────┐ | COMMENT |
| MEDIUM | cli/docs/README.es.md | 59 | # ├────────────────────┤ | COMMENT |
| MEDIUM | cli/docs/README.es.md | 74 | # └────────────────────┘ | COMMENT |
| MEDIUM | cli/docs/README.ja.md | 57 | # 1.1 Install unity-mcp-cli # ┌────────────────────┐ | COMMENT |
| MEDIUM | cli/docs/README.ja.md | 59 | # ├────────────────────┤ | COMMENT |
| MEDIUM | cli/docs/README.ja.md | 74 | # └────────────────────┘ | COMMENT |
| MEDIUM | cli/docs/README.zh-CN.md | 57 | # 1.1 Install unity-mcp-cli # ┌────────────────────┐ | COMMENT |
| MEDIUM | cli/docs/README.zh-CN.md | 59 | # ├────────────────────┤ | COMMENT |
| MEDIUM | cli/docs/README.zh-CN.md | 74 | # └────────────────────┘ | COMMENT |
| MEDIUM | cli/src/commands/install-plugin.ts | 50 | // ── Phase 1: install the plugin into the Unity project's manifest ──────── | COMMENT |
| MEDIUM | cli/src/commands/install-plugin.ts | 99 | // ── Phase 2: download the RID-matched server binary (--with-server) ────── | COMMENT |
| MEDIUM | cli/src/commands/install-plugin.ts | 122 | // ── Phase 3: redeem an enrollment code (--enroll / --enroll-stdin) ─────── | COMMENT |
| MEDIUM | .github/workflows/release.yml | 1 | # ┌──────────────────────────────────────────────────────────────────┐ | COMMENT |
| MEDIUM | .github/workflows/release.yml | 7 | # └──────────────────────────────────────────────────────────────────┘ | COMMENT |
| MEDIUM | .github/workflows/release.yml | 374 | # ------------------- | COMMENT |
| MEDIUM | .github/workflows/release.yml | 490 | # ------------------- | COMMENT |
| MEDIUM | .github/workflows/test_unity_plugin.yml | 1 | # ┌──────────────────────────────────────────────────────────────────┐ | COMMENT |
| MEDIUM | .github/workflows/test_unity_plugin.yml | 7 | # └──────────────────────────────────────────────────────────────────┘ | COMMENT |
| MEDIUM | .github/workflows/test_pull_request_manual.yml | 1 | # ┌──────────────────────────────────────────────────────────────────┐ | COMMENT |
| MEDIUM | .github/workflows/test_pull_request_manual.yml | 7 | # └──────────────────────────────────────────────────────────────────┘ | COMMENT |
| MEDIUM | .github/workflows/test_pull_request_manual.yml | 188 | # ------------------- | COMMENT |
| MEDIUM | .github/workflows/test_pull_request_manual.yml | 316 | # ------------------- | COMMENT |
| MEDIUM | .github/workflows/publish_test_results.yml | 1 | # ┌──────────────────────────────────────────────────────────────────┐ | COMMENT |
| MEDIUM | .github/workflows/publish_test_results.yml | 7 | # └──────────────────────────────────────────────────────────────────┘ | COMMENT |
| MEDIUM | .github/workflows/test_pull_request.yml | 1 | # ┌──────────────────────────────────────────────────────────────────┐ | COMMENT |
| MEDIUM | .github/workflows/test_pull_request.yml | 7 | # └──────────────────────────────────────────────────────────────────┘ | COMMENT |
| MEDIUM | .github/workflows/test_pull_request.yml | 211 | # ------------------- | COMMENT |
| MEDIUM | .github/workflows/test_pull_request.yml | 339 | # ------------------- | COMMENT |
| MEDIUM | .github/workflows/test_cli.yml | 1 | # ┌──────────────────────────────────────────────────────────────────┐ | COMMENT |
| MEDIUM | .github/workflows/test_cli.yml | 7 | # └──────────────────────────────────────────────────────────────────┘ | COMMENT |
| MEDIUM | .github/workflows/claude.yml | 1 | # ┌──────────────────────────────────────────────────────────────────┐ | COMMENT |
| MEDIUM | .github/workflows/claude.yml | 7 | # └──────────────────────────────────────────────────────────────────┘ | COMMENT |
| MEDIUM | .github/workflows/generate-unity-activation-file.yml | 1 | # ┌──────────────────────────────────────────────────────────────────┐ | COMMENT |
| MEDIUM | .github/workflows/generate-unity-activation-file.yml | 7 | # └──────────────────────────────────────────────────────────────────┘ | COMMENT |
| MEDIUM | .github/workflows/filter_oracle.yml | 1 | # ┌──────────────────────────────────────────────────────────────────┐ | COMMENT |
| 131 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …cinemachine/Tests/Editor/Rql/CinemachineModuleTests.cs | 39 | var skill = global::com.IvanMurzak.Unity.MCP.Editor.API.Skill_Rql.Render(); | CODE |
| CRITICAL | …cinemachine/Tests/Editor/Rql/CinemachineModuleTests.cs | 125 | var skill = global::com.IvanMurzak.Unity.MCP.Editor.API.Skill_Rql.Render(); | CODE |
| CRITICAL | …p.probuilder/Tests/Editor/Rql/ProBuilderModuleTests.cs | 43 | var skill = global::com.IvanMurzak.Unity.MCP.Editor.API.Skill_Rql.Render(); | CODE |
| CRITICAL | …p.probuilder/Tests/Editor/Rql/ProBuilderModuleTests.cs | 130 | var skill = global::com.IvanMurzak.Unity.MCP.Editor.API.Skill_Rql.Render(); | CODE |
| CRITICAL | …p.navigation/Tests/Editor/Rql/NavigationModuleTests.cs | 35 | var skill = global::com.IvanMurzak.Unity.MCP.Editor.API.Skill_Rql.Render(); | CODE |
| CRITICAL | …mcp.animation/Tests/Editor/Rql/AnimationModuleTests.cs | 43 | var skill = global::com.IvanMurzak.Unity.MCP.Editor.API.Skill_Rql.Render(); | CODE |
| CRITICAL | …mcp.animation/Tests/Editor/Rql/AnimationModuleTests.cs | 143 | var skill = global::com.IvanMurzak.Unity.MCP.Editor.API.Skill_Rql.Render(); | CODE |
| CRITICAL | …lesystem/Tests/Editor/Rql/ParticleSystemModuleTests.cs | 34 | StringAssert.Contains("## Particle systems", global::com.IvanMurzak.Unity.MCP.Editor.API.Skill_Rql.Render()) | CODE |
| CRITICAL | …/Editor/Rql/UnityEngine_ParticleSystem_AdapterTests.cs | 51 | var response = UnityMcpPluginEditor.Instance.Tools!.RunCallTool(new com.IvanMurzak.McpPlugin.Common.Model.Re | CODE |
| CRITICAL | …inputsystem/Tests/Editor/Rql/InputSystemModuleTests.cs | 128 | var skill = global::com.IvanMurzak.Unity.MCP.Editor.API.Skill_Rql.Render(); | CODE |
| CRITICAL | …ity.mcp.splines/Tests/Editor/Rql/SplinesModuleTests.cs | 36 | var skill = global::com.IvanMurzak.Unity.MCP.Editor.API.Skill_Rql.Render(); | CODE |
| CRITICAL | …ity.mcp.splines/Tests/Editor/Rql/SplinesModuleTests.cs | 82 | var skill = global::com.IvanMurzak.Unity.MCP.Editor.API.Skill_Rql.Render(); | CODE |
| CRITICAL | …ql/UnityEngine_Splines_SplineContainer_AdapterTests.cs | 124 | var response = UnityMcpPluginEditor.Instance.Tools!.RunCallTool(new com.IvanMurzak.McpPlugin.Common.Model.Re | CODE |
| CRITICAL | …ity.mcp.terrain/Tests/Editor/Rql/TerrainModuleTests.cs | 36 | var skill = global::com.IvanMurzak.Unity.MCP.Editor.API.Skill_Rql.Render(); | CODE |
| CRITICAL | …UnityEngine_Playables_PlayableDirector_AdapterTests.cs | 40 | private static string Ref(Object o) => $"ref(\"{com.IvanMurzak.Unity.MCP.Editor.Rql.RqlUnity.Engine.RefOf(o)}\") | CODE |
| CRITICAL | …y.mcp.timeline/Tests/Editor/Rql/TimelineModuleTests.cs | 36 | var skill = global::com.IvanMurzak.Unity.MCP.Editor.API.Skill_Rql.Render(); | CODE |
| CRITICAL | …ity.mcp.tilemap/Tests/Editor/Rql/TilemapModuleTests.cs | 36 | var skill = global::com.IvanMurzak.Unity.MCP.Editor.API.Skill_Rql.Render(); | CODE |
| CRITICAL | …RCASE/Tests/Editor/Rql/YOUR_FEATURE_NAMEModuleTests.cs | 90 | var skill = global::com.IvanMurzak.Unity.MCP.Editor.API.Skill_Rql.Render(); | CODE |
| CRITICAL | …Tests/EditorRqlModules/Lighting/LightingModuleTests.cs | 39 | var skill = global::com.IvanMurzak.Unity.MCP.Editor.API.Skill_Rql.Render().Replace("\r\n", "\n"); | CODE |
| CRITICAL | …/Tests/Editor/Rql/EditorApi/RqlEditorApi_StateTests.cs | 124 | var logger = new com.IvanMurzak.Unity.MCP.Utils.UnityLogger("com.IvanMurzak.McpPlugin.ToolRunnerCollection") | CODE |
| CRITICAL | …ql/Adapters/Asset/UnityEngine_Material_AdapterTests.cs | 110 | private static string RefOf(Object o) => com.IvanMurzak.Unity.MCP.Editor.Rql.RqlUnity.Engine.RefOf(o)!; | CODE |
| CRITICAL⚡ | …mcp/Tests/Editor/Tool/RunToolStructuredContentTests.cs | 44 | _reflector.JsonSerializer.AddConverter(new com.IvanMurzak.Unity.MCP.JsonConverters.Vector3Converter()); | CODE |
| CRITICAL⚡ | …mcp/Tests/Editor/Tool/RunToolStructuredContentTests.cs | 45 | _reflector.JsonSerializer.AddConverter(new com.IvanMurzak.Unity.MCP.JsonConverters.ColorConverter()); | CODE |
| CRITICAL⚡ | …mcp/Tests/Editor/Tool/RunToolStructuredContentTests.cs | 46 | _reflector.JsonSerializer.AddConverter(new com.IvanMurzak.Unity.MCP.JsonConverters.QuaternionConverter()); | CODE |
| CRITICAL | …cp/Tests/Editor/Tool/Script/ScriptExecuteGuardTests.cs | 66 | Code = "System.Threading.Tasks.Task.Factory.StartNew(() => 5, System.Threading.CancellationToken.None, " | CODE |
| CRITICAL | …anmurzak.unity.mcp/Editor/Scripts/Rql/RqlUnity.Refs.cs | 24 | var o = EditorUtility.EntityIdToObject(com.IvanMurzak.Unity.MCP.Runtime.Utils.EntityIdUtils.FromString(id)); | CODE |
| CRITICAL | …ty.mcp/Editor/Scripts/Rql/ToolFormat/RqlToolBinding.cs | 96 | _signatures.GetOrAdd(method, m => com.IvanMurzak.ReflectorNet.Utils.MainThread.Instance.Run(() => Build(m, d | CODE |
| CRITICAL | …ty.mcp/Editor/Scripts/Rql/ToolFormat/RqlToolBinding.cs | 271 | var ok = com.IvanMurzak.ReflectorNet.Utils.MainThread.Instance.Run(() => | CODE |
| CRITICAL | …ty.mcp/Editor/Scripts/Rql/ToolFormat/RqlToolBinding.cs | 311 | return com.IvanMurzak.ReflectorNet.Utils.MainThread.Instance.Run(() => | CODE |
| CRITICAL | …ity.mcp/Editor/Scripts/API/SystemTool/Skills.Create.cs | 38 | "run via com.IvanMurzak.ReflectorNet.Utils.MainThread.Instance.Run(), and the method should either " + | CODE |
| CRITICAL | …ity.mcp/Editor/Scripts/API/SystemTool/Skills.Create.cs | 48 | "All Unity API calls must use com.IvanMurzak.ReflectorNet.Utils.MainThread.Instance.Run(). " + | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | README.md | 301 | npm install -g unity-mcp-cli # │ Available AI agent │ | COMMENT |
| LOW | docs/README.es.md | 301 | npm install -g unity-mcp-cli # │ Available AI agent │ | COMMENT |
| LOW | docs/README.ja.md | 301 | npm install -g unity-mcp-cli # │ Available AI agent │ | COMMENT |
| LOW | docs/README.zh-CN.md | 301 | npm install -g unity-mcp-cli # │ Available AI agent │ | COMMENT |
| LOW | cli/tests/extensions-catalog-csharp-parity.test.ts | 1 | import { describe, it, expect } from 'vitest'; | COMMENT |
| LOW | cli/tests/launch-error-dismiss.test.ts | 221 | describe('permanent-error message constants', () => { | COMMENT |
| LOW | cli/tests/unity-editor.test.ts | 461 | // --------------------------------------------------------------------------- | COMMENT |
| LOW | cli/tests/project-identity.test.ts | 1 | // Copyright (c) 2024 Ivan Murzak. All rights reserved. | COMMENT |
| LOW | cli/src/cli.ts | 1 | // CLI entry for `unity-mcp-cli`, exported at the `./cli` subpath. | COMMENT |
| LOW | cli/src/lib.ts | 1 | // Library entry point for `unity-mcp-cli`. | COMMENT |
| LOW | cli/src/utils/extensions-catalog.ts | 1 | // The CLI's typed mirror of the SHARED extension catalogue — the single source of | COMMENT |
| LOW | cli/src/utils/unity-editor.ts | 301 | // user-typed trailing separator (e.g. `C:\Program Files\Unity\Hub\Editor\`) | COMMENT |
| LOW | cli/src/utils/launch-error-dismiss.ts | 381 | `${LINUX_XDOTOOL_MISSING_PREFIX}. Install it (e.g. \`sudo apt-get install xdotool\`) to enable Unity launch-erro | COMMENT |
| LOW | cli/src/lib/open.ts | 341 | // Don't throw out of the event listener — the caller can't | COMMENT |
| LOW | cli/src/lib/logger.ts | 1 | // Minimal logger interface used by shared utility functions that are | COMMENT |
| LOW | .github/workflows/release.yml | 1 | # ┌──────────────────────────────────────────────────────────────────┐ | COMMENT |
| LOW | .github/workflows/release.yml | 241 | name: unity-installer-package | COMMENT |
| LOW | .github/workflows/release.yml | 741 | done <<< "$release_notes_cleaned" | COMMENT |
| LOW | .github/workflows/release.yml | 761 | # blind spot is how the truncation-budget bug fixed above went unnoticed. | COMMENT |
| LOW | .github/workflows/test_unity_plugin.yml | 1 | # ┌──────────────────────────────────────────────────────────────────┐ | COMMENT |
| LOW | .github/workflows/test_unity_plugin.yml | 21 | # ordinary pull_request run, where the chain feed steps below are no-ops. | COMMENT |
| LOW | .github/workflows/test_pull_request_manual.yml | 41 | # Resolve what to test, ONCE. A fork PR's commits are fetchable from this repository | COMMENT |
| LOW | .github/workflows/test_pull_request.yml | 1 | # ┌──────────────────────────────────────────────────────────────────┐ | COMMENT |
| LOW | .github/workflows/test_cli.yml | 1 | # ┌──────────────────────────────────────────────────────────────────┐ | COMMENT |
| LOW | .github/workflows/generate-unity-activation-file.yml | 1 | # ┌──────────────────────────────────────────────────────────────────┐ | COMMENT |
| LOW | .github/workflows/filter_oracle.yml | 1 | # ┌──────────────────────────────────────────────────────────────────┐ | COMMENT |
| LOW | .github/scripts/chain_fixture.py | 1 | #!/usr/bin/env python3 | COMMENT |
| LOW | .github/scripts/chain_feed.py | 61 | # lock input validation — every lock-sourced scalar, strictly, at LOAD time | COMMENT |
| LOW | .github/scripts/chain_feed.py | 81 | #: A ref as `lock.py` records it (`refs/heads/<branch>`, `refs/pull/<n>/head`, a sha). This file | COMMENT |
| LOW | .github/scripts/chain_feed.py | 521 | }, | COMMENT |
| LOW | .github/scripts/chain_feed.py | 3581 | ), end="") | COMMENT |
| LOW | …OWERCASE/Editor/Scripts/Rql/YOUR_FEATURE_NAMEModule.cs | 21 | /// <summary> | COMMENT |
| LOW | templates/extension/commands/open-all-projects-unix.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | …/Assets/com.IvanMurzak/AI Game Dev Installer/README.md | 301 | npm install -g unity-mcp-cli # │ Available AI agent │ | COMMENT |
| LOW | …-MCP-Plugin/Tests~/EngineFree/ConnectionConfigTests.cs | 21 | /// <summary> | COMMENT |
| LOW | …ity-MCP-Plugin/Tests~/EngineFree/ToolAttributeTests.cs | 21 | { | COMMENT |
| LOW | Unity-MCP-Plugin/Tests~/EngineFree/NuGetPinGateTests.cs | 61 | /// record that <i>some</i> NuGet DLL set was restored, never <i>which</i>. Raise a pin without | COMMENT |
| LOW | …MCP-Plugin/Packages/com.ivanmurzak.unity.mcp/README.md | 301 | npm install -g unity-mcp-cli # │ Available AI agent │ | COMMENT |
| LOW | …rzak.unity.mcp/Runtime/UnityMcpPluginRuntime.Static.cs | 81 | } | COMMENT |
| LOW | …rzak.unity.mcp/Runtime/UnityMcpPluginRuntime.Static.cs | 101 | /// { | COMMENT |
| LOW | ….ivanmurzak.unity.mcp/Runtime/UnityMcpPlugin.Config.cs | 101 | COMMENT | |
| LOW | ….ivanmurzak.unity.mcp/Runtime/UnityMcpPlugin.Config.cs | 121 | COMMENT | |
| LOW | ….ivanmurzak.unity.mcp/Runtime/UnityMcpPlugin.Config.cs | 181 | public TransportMethod TransportMethod { get; set; } = TransportMethod.streamableHttp; | COMMENT |
| LOW | ….ivanmurzak.unity.mcp/Runtime/UnityMcpPlugin.Config.cs | 261 | // already-written client `.mcp.json` (stale Bearer -> 401; Unity-MCP #897 / mcp-authorize i2). | COMMENT |
| LOW | ….ivanmurzak.unity.mcp/Runtime/UnityMcpPluginBuilder.cs | 21 | /// Builder for configuring a runtime <see cref="UnityMcpPluginRuntime"/> from C# code. | COMMENT |
| LOW | …ges/com.ivanmurzak.unity.mcp/Runtime/UnityMcpPlugin.cs | 241 | public static string GenerateToken() | COMMENT |
| LOW | …ges/com.ivanmurzak.unity.mcp/Runtime/UnityMcpPlugin.cs | 261 | /// directory reported with backslashes hashes identically to its forward-slash form. The port | COMMENT |
| LOW | …ivanmurzak.unity.mcp/Runtime/Unity/Logs/ILogStorage.cs | 61 | } | COMMENT |
| LOW | …on/UnityEngine_Material_ReflectionConverter.Runtime.cs | 101 | logs?.Success($"Property '{propertyValue.name}' modified to '{value}'. Converter: {GetType().Get | COMMENT |
| LOW | …mpl/UnityEngine_Texture_ReflectionConverter.Runtime.cs | 21 | using LogLevel = Microsoft.Extensions.Logging.LogLevel; | COMMENT |
| LOW | …mpl/UnityEngine_Texture_ReflectionConverter.Runtime.cs | 41 | COMMENT | |
| LOW | …Impl/UnityEngine_Sprite_ReflectionConverter.Runtime.cs | 21 | using LogLevel = Microsoft.Extensions.Logging.LogLevel; | COMMENT |
| LOW | …Impl/UnityEngine_Sprite_ReflectionConverter.Runtime.cs | 41 | COMMENT | |
| LOW | …om.ivanmurzak.unity.mcp/Runtime/Utils/EntityIdUtils.cs | 21 | /// Unity 6.5+ encodes an EntityId's raw data as | COMMENT |
| LOW | …ivanmurzak.unity.mcp/Runtime/Utils/EnvironmentUtils.cs | 21 | /// <summary> | COMMENT |
| LOW | …ivanmurzak.unity.mcp/Runtime/Utils/EnvironmentUtils.cs | 121 | } | COMMENT |
| LOW | …rzak.unity.mcp/Runtime/Data/ObjectRef.pre-Unity.6.5.cs | 61 | #endif | COMMENT |
| LOW | …ity.mcp/Tests/Editor/McpServerRestartAndPidKeyTests.cs | 21 | /// before the binary folder is deleted, then STARTED after publish, so the post-publish StartServer() | COMMENT |
| LOW | …k.unity.mcp/Tests/Editor/McpServerPathOverrideTests.cs | 21 | /// (<see cref="McpServerManager.ServerPathEnvVar"/>): when it points at an EXISTING file that file is | COMMENT |
| LOW | …urzak.unity.mcp/Tests/Editor/ConnectionManagerTests.cs | 161 | } | COMMENT |
| 120 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | .github/scripts/chain_feed.py | 248 | "build": "npm ci && npm run typecheck && npm run build", | CODE |
| HIGH⚡ | .github/scripts/chain_feed.py | 250 | "npm pkg set version={ws_version} && npm ci && npm run build && npm pack --pack-destination {npm_feed}", | CODE |
| HIGH | .github/scripts/chain_feed.py | 269 | "build": "cd cli && npm ci && npm run build", | CODE |
| HIGH | .github/scripts/chain_feed.py | 271 | "cd cli && npm ci && npm pkg set version={ws_version} && npm pack --pack-destination {npm_feed}", | CODE |
| HIGH | .github/scripts/chain_feed.py | 371 | "cd cli && npm ci && npm pkg set version={ws_version} && npm pack --pack-destination {npm_feed}", | CODE |
| HIGH | .github/scripts/chain_feed.py | 416 | "cd cli && npm ci && npm pkg set version={ws_version} && npm pack --pack-destination {npm_feed}", | CODE |
| HIGH | .github/scripts/chain_feed.py | 449 | "build": "pnpm install --frozen-lockfile && pnpm build && pnpm typecheck", | CODE |
| HIGH | .github/scripts/chain_feed.py | 3439 | " group: ${{ github.event_name == 'workflow_dispatch' && %s || format('%s-{0}', github.ref) }}" | CODE |
| HIGH | .github/scripts/chain_feed.py | 3474 | " exe=\"$(\"$c\" -c '%s' 2>/dev/null)\" || continue" % CHAIN_PY_PROBE, | CODE |
| HIGH | .github/scripts/chain_feed.py | 3492 | " try { $out = & $cmd.Source -c '%s' 2>$null } catch { continue }" % CHAIN_PY_PROBE, | CODE |
| HIGH | .github/scripts/chain_feed.py | 1257 | yet its workflow packs with `npm pkg set version=$CHAIN_WS_VERSION && npm pack`. | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | cli/src/utils/extension-compatibility.ts | 9 | export function unityExtensionDependencies(packageId: string, unityVersion: string): Readonly<Record<string, string>> { | CODE |
| LOW | cli/src/utils/cloud-login.ts | 78 | function buildAccountSwitchConfirm( | CODE |
| LOW | cli/src/utils/connection.ts | 38 | export function resolveAndValidateProjectPath(positionalPath: string | undefined, options: ConnectionOptions): string { | CODE |
| LOW | cli/src/utils/cloud-credentials.ts | 41 | export function createCloudCredentialProvider( | CODE |
| LOW | cli/src/utils/cloud-credentials.ts | 68 | export function resetCloudCredentialProviderForTests(): void { | CODE |
| LOW | cli/src/utils/unity-hub.ts | 225 | export function parseInstalledEditorsLine(line: string): InstalledEditor | null { | CODE |
| LOW | cli/src/utils/unity-hub.ts | 483 | function runHubInstallWithProgress(hubPath: string, args: string[], version: string): Promise<void> { | CODE |
| LOW | cli/src/utils/unity-editor.ts | 160 | export function getSecondaryInstallPathFile(os: NodeJS.Platform): string | null { | CODE |
| LOW | cli/src/utils/unity-editor.ts | 194 | export function readSecondaryInstallPaths(os: NodeJS.Platform): string[] { | CODE |
| LOW | cli/src/utils/unity-editor.ts | 258 | function findEditorPathByCommonLocations(version?: string): string | null { | CODE |
| LOW | cli/src/utils/manifest.ts | 55 | export async function resolveLatestPackageVersion( | CODE |
| LOW | cli/src/utils/config.ts | 112 | export function getOrCreateConfig(projectPath: string): UnityConnectionConfig { | CODE |
| LOW | cli/src/utils/config.ts | 215 | export async function resolveConnectionFromConfig( | CODE |
| LOW | cli/src/utils/launch-error-dismiss.ts | 97 | export async function tryDismissLaunchErrorsDialog( | CODE |
| LOW | cli/src/lib/create-project.ts | 23 | function defaultResolveEditorExecutable(editorInstallPath: string): string | null { | CODE |
| LOW | cli/src/lib/open.ts | 83 | function extractEditorPathFromCommandLine(commandLine: string): string { | CODE |
| LOW | cli/src/lib/open.ts | 628 | async function pollAndDismissLaunchErrors(opts: PollAndDismissOptions): Promise<void> { | CODE |
| LOW | cli/src/commands/login.ts | 37 | async function finishPartialAuthorization(store: MachineCredentialStore): Promise<never> { | CODE |
| LOW | .github/scripts/chain_feed.py | 2053 | def _assert_only_patch_entry_changed(before_raw, after_raw, old_key, new_key, new_value): | CODE |
| LOW | .github/scripts/chain_feed.py | 2318 | def pe_version_strings_from_bytes(buf): | CODE |
| LOW | templates/extension/commands/check-versions.py | 202 | def _scripting_define_entries(text: str) -> list[tuple[int, str, list[str]]]: | CODE |
| LOW⚡ | commands/tools/validate_mcp_openai.py | 74 | def convert_mcp_to_openai_tool(mcp_tool): | CODE |
| LOW⚡ | commands/tests/test_release_dependency_guard.py | 82 | def test_prerelease_resolver_pin_fails(self): | STRING |
| LOW⚡ | commands/tests/test_release_dependency_guard.py | 87 | def test_unpublished_pin_and_unknown_package_fail(self): | STRING |
| LOW⚡ | commands/tests/test_release_dependency_guard.py | 95 | def test_resolver_downloads_the_version_exactly_as_written(self): | STRING |
| LOW⚡ | commands/tests/test_release_dependency_guard.py | 100 | def test_npm_dist_tags_are_not_pins(self): | STRING |
| LOW⚡ | commands/tests/test_release_dependency_guard.py | 105 | def test_registry_outage_fails_closed(self): | STRING |
| LOW⚡ | commands/tests/test_release_dependency_guard.py | 110 | def test_local_resolver_feed_fails(self): | STRING |
| LOW⚡ | commands/tests/test_release_dependency_guard.py | 115 | def test_vendored_code_exec_must_be_a_published_release(self): | STRING |
| LOW⚡ | commands/tests/test_release_dependency_guard.py | 127 | def test_extension_upm_dependencies_are_scanned(self): | STRING |
| LOW⚡ | commands/tests/test_release_dependency_guard.py | 135 | def test_missing_shipped_file_fails(self): | STRING |
| LOW⚡ | commands/tests/test_release_dependency_guard.py | 142 | def test_prerelease_and_normalize(self): | STRING |
| LOW | commands/tests/test_extensions.py | 19 | def test_existing_newer_sdk_dependency_is_preserved(self): | CODE |
| LOW | commands/tests/test_extensions.py | 40 | def test_original_packages_pass_then_undeclared_sibling_assembly_fails(self): | CODE |
| LOW⚡ | commands/tests/test_extensions.py | 55 | def test_assembly_definition_without_scripts_fails(self): | CODE |
| LOW⚡ | commands/tests/test_extensions.py | 62 | def test_original_test_deletion_or_assertion_changes_fail(self): | CODE |
| LOW⚡ | commands/tests/test_extensions.py | 72 | def test_duplicate_native_guid_fails(self): | CODE |
| LOW⚡ | commands/tests/test_extensions.py | 79 | def test_sync_core_is_selected_local_idempotent_and_dry_run_writes_nothing(self): | CODE |
| LOW | commands/tests/test_extensions.py | 103 | def test_route_metadata_ignores_yaml_only_description_escapes(self): | CODE |
| LOW⚡ | commands/tests/test_extensions.py | 150 | def test_unsigned_archive_rejected_signed_native_bytes_accepted(self): | STRING |
| LOW⚡ | commands/tests/test_extensions.py | 155 | def test_foreign_component_file_or_path_traversal_rejected(self): | STRING |
| LOW⚡ | commands/tests/test_extensions.py | 161 | def test_signer_generated_repository_is_bound_without_loosening_native_metadata(self): | STRING |
| LOW | commands/tests/test_extensions.py | 177 | def test_native_source_file_may_not_be_omitted(self): | STRING |
| LOW | commands/tests/test_extensions.py | 183 | def test_installer_is_reproducible_and_contains_original_guid_and_file_bytes(self): | STRING |
| LOW | commands/tests/test_extensions.py | 201 | def test_published_component_is_never_rebuilt(self): | STRING |
| LOW | commands/tests/test_extensions.py | 210 | def test_route_gate_rejects_old_repository_and_unfiltered_core_tags(self): | STRING |
| LOW | commands/tests/test_extensions.py | 228 | def test_pr_reporter_receives_xml_including_train_prs(self): | STRING |
| LOW | commands/tests/test_extensions.py | 287 | def test_original_modes_remain_active_and_gate_every_publication(self): | STRING |
| LOW | commands/tests/test_commands.py | 112 | def test_bump_rewrites_only_the_version_strings(self): | STRING |
| LOW⚡ | commands/tests/test_commands.py | 127 | def test_preserves_crlf_and_writes_no_bom(self): | STRING |
| LOW⚡ | commands/tests/test_commands.py | 137 | def test_what_if_writes_nothing(self): | STRING |
| LOW⚡ | commands/tests/test_commands.py | 144 | def test_invalid_and_same_version(self): | STRING |
| LOW⚡ | commands/tests/test_commands.py | 150 | def test_missing_package_json_fails(self): | STRING |
| LOW⚡ | commands/tests/test_commands.py | 205 | def test_bump_updates_package_json_and_installer(self): | STRING |
| LOW⚡ | commands/tests/test_commands.py | 211 | def test_update_pins_every_core_reference_and_nothing_else(self): | STRING |
| LOW⚡ | commands/tests/test_commands.py | 220 | def test_update_falls_back_to_tags_and_what_if_writes_nothing(self): | STRING |
| LOW | commands/tests/test_commands.py | 232 | def test_update_is_a_noop_when_current(self): | STRING |
| LOW | commands/tests/test_commands.py | 270 | def test_replaces_content_and_names(self): | STRING |
| LOW | commands/tests/test_commands.py | 287 | def test_installer_extra_path_moves_the_installer(self): | STRING |
| LOW | commands/tests/test_commands.py | 295 | def test_invalid_feature_name_fails(self): | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/scripts/chain_fixture.py | 200 | CODE | |
| LOW | .github/scripts/chain_fixture.py | 355 | CODE | |
| LOW | .github/scripts/chain_fixture.py | 404 | CODE | |
| LOW | .github/scripts/chain_fixture.py | 480 | CODE | |
| LOW | .github/scripts/check_nuget_gate.py | 97 | CODE | |
| LOW | .github/scripts/chain_feed.py | 1935 | CODE | |
| LOW | .github/scripts/chain_feed.py | 1964 | CODE | |
| LOW | .github/scripts/chain_feed.py | 2252 | CODE | |
| LOW | .github/scripts/chain_feed.py | 2318 | CODE | |
| LOW | .github/scripts/chain_feed.py | 2503 | CODE | |
| LOW | .github/scripts/chain_feed.py | 2751 | CODE | |
| LOW | .github/scripts/chain_feed.py | 3030 | CODE | |
| LOW | .github/scripts/chain_feed.py | 3095 | CODE | |
| LOW | .github/scripts/chain_feed.py | 3147 | CODE | |
| LOW | .github/scripts/chain_feed.py | 3291 | CODE | |
| LOW | .github/scripts/chain_feed.py | 3338 | CODE | |
| LOW | templates/extension/commands/check-versions.py | 231 | CODE | |
| LOW | commands/run_unity_tests.py | 108 | CODE | |
| LOW | commands/extensions.py | 57 | CODE | |
| LOW | commands/extensions.py | 166 | CODE | |
| LOW | commands/extensions.py | 238 | CODE | |
| LOW | commands/extensions.py | 282 | CODE | |
| LOW | commands/extension_release.py | 64 | CODE | |
| LOW | commands/extension_release.py | 100 | CODE | |
| LOW | commands/tools/validate_mcp_openai.py | 94 | CODE | |
| LOW | commands/tools/validate_json_schema.py | 48 | CODE | |
| LOW | commands/tools/validate_json_schema.py | 74 | CODE | |
| LOW | commands/tests/test_extensions.py | 128 | CODE | |
| LOW | commands/tests/test_extensions.py | 261 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH⚡ | commands/tools/validate_mcp_openai.py | 66 | print(f" Content: OPENAI_API_KEY=sk-your-api-key-here") | CODE |
| HIGH⚡ | commands/tools/validate_mcp_openai.py | 68 | print(f" Linux/Mac: export OPENAI_API_KEY='sk-your-api-key-here'") | CODE |
| HIGH⚡ | commands/tools/validate_mcp_openai.py | 69 | print(f" Windows: set OPENAI_API_KEY=sk-your-api-key-here") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/scripts/chain_feed.py | 3318 | except Exception as exc: # a corrupt tarball is a failing proof, never a crash | CODE |
| LOW | …mplates/extension/commands/update_ai_game_developer.py | 65 | except Exception: | CODE |
| LOW | …mplates/extension/commands/update_ai_game_developer.py | 72 | except Exception as exc: | CODE |
| LOW | …mplates/extension/commands/update_ai_game_developer.py | 146 | except Exception as exc: # report and exit 1, like the former PowerShell script | CODE |
| LOW | templates/extension/commands/bump_version.py | 154 | except Exception as exc: # report and exit 1, like the former PowerShell script | CODE |
| MEDIUM | commands/run_unity_tests.py | 157 | print(f"Error: {parsed.error}") | CODE |
| MEDIUM | commands/run_act_test.py | 141 | print(f"Error: .env file not found at {ENV_FILE}\n") | CODE |
| MEDIUM | commands/run_act_test.py | 153 | print("Error: Missing required secrets in .env file:") | CODE |
| LOW | commands/bump_version.py | 182 | except Exception as exc: # mirror the .ps1 catch-all: report and exit 1 | CODE |
| MEDIUM | commands/tools/validate_mcp_openai.py | 28 | print("Error: openai library not found.") | CODE |
| LOW | commands/tools/validate_mcp_openai.py | 138 | except Exception as e: | CODE |
| LOW | commands/tools/validate_mcp_openai.py | 194 | except Exception as e: | CODE |
| LOW | commands/tools/validate_mcp_openai.py | 307 | except Exception as e: | CODE |
| MEDIUM | commands/tools/validate_json_schema.py | 21 | print("Error: jsonschema library not found.") | CODE |
| LOW | commands/tools/validate_json_schema.py | 124 | except Exception as e: | CODE |
| LOW | commands/tools/validate_json_schema.py | 160 | except Exception as e: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | .github/scripts/chain_fixture.py | 865 | except (ValueError, OSError): | CODE |
| HIGH | .github/scripts/chain_feed.py | 4029 | except (ValueError, OSError): # pragma: no cover | CODE |
| HIGH | commands/tools/validate_mcp_openai.py | 21 | except ImportError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | README.md | 273 | ## Step 1: Install `Unity MCP Plugin` | COMMENT |
| LOW | README.md | 326 | ## Step 2: Install `AI agent` | COMMENT |
| LOW | README.md | 340 | ## Step 3: Configure `AI agent` | COMMENT |
| LOW | …/Assets/com.IvanMurzak/AI Game Dev Installer/README.md | 273 | ## Step 1: Install `Unity MCP Plugin` | COMMENT |
| LOW | …/Assets/com.IvanMurzak/AI Game Dev Installer/README.md | 326 | ## Step 2: Install `AI agent` | COMMENT |
| LOW | …/Assets/com.IvanMurzak/AI Game Dev Installer/README.md | 340 | ## Step 3: Configure `AI agent` | COMMENT |
| LOW | …MCP-Plugin/Packages/com.ivanmurzak.unity.mcp/README.md | 273 | ## Step 1: Install `Unity MCP Plugin` | COMMENT |
| LOW | …MCP-Plugin/Packages/com.ivanmurzak.unity.mcp/README.md | 326 | ## Step 2: Install `AI agent` | COMMENT |
| LOW | …MCP-Plugin/Packages/com.ivanmurzak.unity.mcp/README.md | 340 | ## Step 3: Configure `AI agent` | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …plates/extension/commands/open_all_projects_windows.py | 14 | CODE | |
| LOW | …mplates/extension/commands/update_ai_game_developer.py | 14 | CODE | |
| LOW | templates/extension/commands/bump_version.py | 17 | CODE | |
| LOW | templates/extension/commands/init.py | 22 | CODE | |
| LOW | templates/extension/commands/check-versions.py | 48 | CODE | |
| LOW | commands/run_unity_tests.py | 14 | CODE | |
| LOW | commands/run_act_test.py | 15 | CODE | |
| LOW | commands/extensions.py | 2 | CODE | |
| LOW | commands/bump_version.py | 22 | CODE | |
| LOW | commands/generate_release.py | 11 | CODE | |
| LOW | commands/release_dependency_guard.py | 30 | CODE | |
| LOW | commands/extension_release.py | 2 | CODE | |
| LOW | commands/tools/validate_json_schema.py | 12 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | .github/scripts/chain_feed.py | 257 | # mixed-language concurrency suite runs MCP-Plugin-dotnet's C# harness from source | COMMENT |
| MEDIUM | commands/tools/validate_mcp_openai.py | 180 | # Check for missing descriptions or other best practices | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | commands/tools/validate_mcp_openai.py | 119 | # Check if it's wrapped in a result object (like the example) | COMMENT |
| LOW | commands/tools/validate_mcp_openai.py | 294 | # Check if file exists | COMMENT |
| LOW | commands/tools/validate_mcp_openai.py | 326 | # Check if filename was provided as command line argument | COMMENT |
| LOW | commands/tools/validate_json_schema.py | 111 | # Check if file exists | COMMENT |
| LOW | commands/tools/validate_json_schema.py | 169 | # Check if filename was provided as command line argument | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …mcp/Tests/Editor/Tool/RunToolStructuredContentTests.cs | 703 | public static Person ReturnCustomClass() => new Person { Name = "John Doe", Age = 30 }; | CODE |
| LOW | …mcp/Tests/Editor/Tool/RunToolStructuredContentTests.cs | 707 | CompanyName = "Acme Corp", | CODE |
| LOW | …k.unity.mcp/Tests/Editor/Tool/RunToolRqlResultTests.cs | 66 | Assert.AreEqual("John Doe", data!["Name"]!.GetValue<string>()); | CODE |
| LOW | …k.unity.mcp/Tests/Editor/Tool/RunToolRqlResultTests.cs | 74 | Assert.AreEqual("Acme Corp", data!["CompanyName"]!.GetValue<string>()); | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/release.yml | 715 | # Create the release URL | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .github/scripts/chain_fixture.py | 294 | CODE | |
| LOW | templates/extension/commands/check-versions.py | 231 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | templates/extension/commands/open-all-projects-unix.sh | 13 | # Usage: | COMMENT |