DEV Community: youichi uda

I Built a Godot MCP Server Because Existing Ones Couldn't Let AI Test My Game

youichi uda — Tue, 24 Feb 2026 14:25:29 +0000

The Problem

I make games in Godot. I use AI (Claude Code) to write code daily. But the workflow always had the same bottleneck:

AI writes code → I run the game → I check if it works → I report back → AI fixes → I run again...

That "I run and check" part adds up. Especially when you're tweaking UI, testing edge cases, or iterating on a mechanic. I wanted to hand off the entire build-test-fix cycle to AI.

I tried existing Godot MCP servers. The free ones (godot-mcp, etc.) have ~13 tools focused on file operations. They can't even launch the game, let alone play it or take screenshots. The paid alternative (GDAI MCP, $19) has ~30 tools but still no input simulation or runtime analysis.

None of them could do what I needed: AI builds the game, runs it, tests it, and fixes what's broken — without me touching anything.

So I built Godot MCP Pro. 84 tools, 14 categories. Input simulation, runtime analysis, screenshots — everything needed for AI to autonomously test a running game.

Demo: One Prompt → Complete Reversi + AI Playtest

To show what this looks like in practice, here's a demo. Empty Godot project, one prompt, AI does the rest.

The Prompt (summary)

Build a complete Reversi game in this Godot project.
Single scene, single script, all rendering via _draw().

Requirements: 8x8 board, pieces, highlights, flip animation,
standard rules, score display, restart button...

After building, set as main scene and play it.
Then playtest: play 4 moves, screenshot after each,
fix anything that's wrong.

The key is the last part — "playtest it yourself, fix anything that's wrong." That single instruction turns AI from a code generator into a QA tester.

What Happened

Build Phase (~2 min)

AI autonomously chains tool calls to build the game:

create_script("main.gd")    → Full game logic in one file
create_scene("main.tscn")   → Scene with Node2D root
attach_script                → Wire script to root
add_node × 4                → Score, Turn, Message labels + Restart button
save_scene → set_project_setting → reload_project → play_scene

The editor updates in real-time. Nodes appear in the scene tree, the game window opens with a fully rendered Reversi board.

Playtest Phase (~2 min)

This is why I built the tool. AI takes a screenshot, inspects the board, clicks a cell, takes another screenshot to verify:

Moves 1-2: Successful. AI confirms piece placement, flipping, score updates after each move.

Move 3: AI clicks B2 → Takes screenshot → "B2 was not a valid move. Score didn't change." → Reads the yellow highlights on the board to find valid cells → Self-corrects to C4 → Success.

Move 4: AI clicks E2 → Same thing — detects failure from screenshot → Self-corrects to E3 → Success.

The AI made mistakes, but it caught them from the screenshots and fixed them without any human input. This is the workflow I wanted: tell AI to test, and it figures out the rest.

Report

After testing, AI outputs a full checklist:

Feature	Status
8×8 board rendering	OK
Piece drawing with outlines	OK
Valid move highlights	OK
Last-move indicator	OK
8-direction flip logic	OK
Flip animation	OK
Score and turn display	OK
Auto-pass handling	OK
Restart button	OK

How It Works

Architecture

AI Assistant ←--MCP/stdio--→ Node.js Server ←--WebSocket--→ Godot Editor Plugin

MCP (Model Context Protocol) is an open protocol by Anthropic that gives AI access to "tools." Godot MCP Pro implements this protocol with 84 tools across 14 categories.

The four tool categories that make autonomous testing possible:

Category	Why it matters
`play_scene` / `stop_scene`	AI can launch and stop the game
`simulate_mouse_click` / `simulate_key` / `simulate_sequence`	AI can send input to the running game
`get_game_screenshot`	AI can see the running game
`get_game_scene_tree` / `get_game_node_properties`	AI can read runtime state

Without these, AI can write code but can't verify it works. With them, AI closes the loop.

Why Not Just Edit Files?

File editing gives you code generation. It doesn't give you:

Game launch/stop control
Input simulation (keyboard, mouse, action sequences)
Screenshot capture from running game
Runtime state inspection (live scene tree, node properties)
Ctrl+Z undo (all MCP mutations go through Godot's UndoRedoManager)

The build → test → fix cycle needs bidirectional communication with the editor. That's the whole point.

Full Tool List (84 tools / 14 categories)

Category	#	What it does
Project	7	Filesystem, settings, UID conversion
Scene	9	Create, open, delete, instance, play/stop
Node	11	Add, delete, rename, properties, signals
Script	6	List, read, create, edit, attach
Editor	8	Screenshots, errors, GDScript execution
Input Simulation	5	Keyboard, mouse, actions, sequences
Runtime Analysis	4	Live scene tree, properties, monitoring
Animation	6	Create, tracks, keyframes
TileMap	6	Cell ops, fill, info
Theme & UI	6	Colors, constants, fonts, styleboxes
Shader	6	Create, edit, parameters
Batch Ops	5	Search, bulk changes, dependencies
Profiling	2	Performance monitors
Export	3	Presets, build commands

Input simulation, runtime analysis, signal management, animation, tilemap, shader, and profiling tools are exclusive to Godot MCP Pro — no other Godot MCP server has them.

How I Actually Use It Day-to-Day

The Reversi demo is a showcase. In practice, the most useful things are more mundane:

UI setup: "Set this Label's font to 24, anchor to center-top" — AI changes it directly in the editor
Signal wiring: "Connect this button's pressed signal" — done without opening the Node dock
Prototyping: "Make the player dash when pressing Shift" — AI writes the code, launches the game, tests it
Bug investigation: "Run the game, do X, then read the player's position and velocity" — AI reports back with actual runtime values

It lets me focus on game design and final decisions while AI handles the editor busywork.

Getting Started

Requirements: Godot 4.x (4.3+), Node.js 18+, MCP-compatible AI client (Claude Code, Claude Desktop, Cursor, Cline, etc.)

Get it from godot-mcp.abyo.net
Copy addons/godot_mcp/ into your Godot project
Enable the plugin in Project Settings → Plugins
Add to your AI client's MCP config:

{
  "mcpServers": {
    "godot-mcp-pro": {
      "command": "node",
      "args": ["path/to/mcp/server/build/index.js"]
    }
  }
}

Godot MCP Pro — 84 tools, 14 categories, $5 one-time, lifetime updates.

godot-mcp.abyo.net

I checked the WordPress sites I built years ago. Here's what I found.

youichi uda — Sun, 08 Feb 2026 08:06:20 +0000

"Oh, that site still works"

If you've ever built WordPress sites for clients, you know the feeling. You think about a site you delivered three years ago and wonder: are they keeping it updated?

You check. WordPress 5.x. Plugins untouched since delivery. PHP 8.1 — which reached end of security support in December 2025. No security headers configured at all.

It works. But "working" is not the same as "safe."

This article is about the uncomfortable reality of what happens to WordPress sites after we hand them over.

WordPress Is a Monoculture

The numbers

WordPress dominates the CMS market globally, holding about 61.7% of market share among CMS-powered sites. But in some markets, the concentration is extreme.

In Japan, WordPress holds 82.9% of the CMS market. "Small business website" and "WordPress site" are essentially synonyms. And while Japan is an extreme case, the pattern holds across most markets — WordPress is the default choice for agencies and freelancers everywhere.

Why monocultures are dangerous

In agriculture, monoculture — growing a single crop across vast areas — creates systemic risk. One disease can wipe out an entire harvest.

The CMS market has the same problem. When WordPress is this dominant, a single exploit can target millions of sites simultaneously. Find a vulnerability in Plugin A, and every site running that plugin is exposed. It's an attacker's dream: maximum impact, minimum effort.

And those vulnerabilities? They're discovered every single day.

Vulnerabilities Don't Trickle — They Pour

The scale

June 2025: 337 new vulnerabilities reported (298 plugins, 39 themes)
One week in January 2026 (Jan 12–18): 180 vulnerabilities disclosed
96% of vulnerabilities come from plugins

That's roughly 25 new vulnerabilities per day. No individual developer or small team can keep up with this manually.

The scary part: no authentication required

About half of the vulnerabilities reported in late 2025 were exploitable without authentication. No login needed. No special permissions. Just hit a URL:

GET /wp-json/vulnerable-plugin/v1/sensitive-data HTTP/1.1
Host: target-site.example.com

That's all it takes to leak data in some real-world vulnerabilities.

The Maintenance Gap

What happens after delivery

Here's a lifecycle I've seen play out dozens of times:

Year 0: Agency builds WordPress site with 10 plugins.
        Client declines maintenance contract — "too expensive."

Year 1: Agency says "please keep it updated."
        Client says "sure" (they don't).

Year 2: Maintenance contract ends. Relationship fades.

Year 3: Nobody remembers the wp-login password.
        The site becomes untouchable — "don't break it."

Year 4: PHP 8.1 reaches EOL. Hosting provider sends warnings. Ignored.

Year 5: Three plugins are abandoned by their developers.
        Known vulnerabilities, zero patches.

Year 6: ← We are here. The site loads fine.
          It's a vulnerability goldmine.

According to Japan's IPA (Information-technology Promotion Agency) 2024 SME Cybersecurity Survey:

Finding	Number
Most common cause of unauthorized access	Unpatched vulnerabilities (48%)
Average incident cost	~$5,000 (¥730,000)
Average recovery time	5.8 days
Incidents impacting business partners	~70%

These numbers are from Japanese SMEs, but the pattern is universal. Small businesses everywhere run outdated WordPress installations and lack the resources to maintain them.

Is this really someone else's problem?

Hard truth: the client chose not to pay for maintenance. But we designed the site. Did we build it to be as low-maintenance as possible? Did we adequately communicate what happens without updates?

Realistically, not every client will sign a maintenance contract. But if we could at least make the current state visible, it would open the conversation.

Checking a WordPress Site's Health From the Outside

What you can do from the terminal

As a developer, you can gather basic security intel with a few commands.

Detect WordPress version:

# From meta tags
curl -s https://example.com | grep -oP 'content="WordPress \K[0-9.]+'

# From RSS feed
curl -s https://example.com/feed/ | grep -oP '\?v=\K[0-9.]+'

# Check if readme.html is exposed
curl -sI https://example.com/readme.html | head -1

Check security headers:

curl -sI https://example.com | grep -iE \
  '(strict-transport-security|content-security-policy|x-frame-options|x-content-type-options|referrer-policy|permissions-policy)'

Try this on a small business site. Chances are nothing comes back — meaning zero security headers are configured.

Check email authentication:

# SPF
dig +short TXT example.com | grep spf

# DMARC
dig +short TXT _dmarc.example.com

A DMARC policy of p=none means phishing emails spoofing the domain aren't being blocked.

But will you do this regularly?

Running these commands once is easy. But realistically:

You want to check 10+ client domains periodically
You need to cross-reference plugin versions against new CVEs
You want to be notified when something changes
You need client-facing reports

Terminal commands don't scale.

Nyambush — Passive ASM for the Rest of Us

This is why I built Nyambush.

Nyambush is an ASM (Attack Surface Management) SaaS. Enter a domain, get an instant security assessment of its external attack surface.

ASM tools are typically enterprise software costing $30,000+/year. Nyambush starts at free — no account required.

What it checks

Check	What you learn
DNS	Subdomain enumeration, dangling CNAMEs (subdomain takeover risk), WHOIS
Email Auth	SPF/DKIM/DMARC configuration, spoofing risk assessment
HTTP Headers	Security header coverage, HTTPS configuration issues
WordPress	Core version, detected plugins/themes, known CVEs
AI Patrol	Headless browser crawling + Claude Vision AI for defacement & anomaly detection

AI Patrol — Catching Defacements That Humans Miss

Many compromised sites look perfectly normal to a casual visitor. The defacement might be subtle — injected spam links, hidden redirects, or a modified footer that only search engines see.

AI Patrol solves this with a two-layer approach:

Layer 1: Technical checks (automated during crawl)
├── HTTP status codes (5xx/4xx detection)
├── JavaScript errors
├── Console errors
├── Broken images
├── Mixed content (HTTPS → HTTP)
└── Broken links (subresource 404/5xx)

Layer 2: AI visual analysis (Claude Vision API)
├── Defacement detection (injected text, hacker signatures)
├── Debug info leaks (stack traces, SQL queries, internal paths)
├── Phishing redirects
├── Layout breakage (overlapping elements, overflow)
├── Character encoding issues
├── Suspicious ads/popups
└── SEO spam (hidden text, keyword stuffing)

Visual diff detection:

Playwright captures full-page screenshots and compares them pixel-by-pixel against the previous crawl using pixelmatch. When the change rate exceeds 5%, Claude Vision AI analyzes what changed — distinguishing legitimate content updates from unauthorized modifications.

Passive scanning only

Nyambush performs passive scanning exclusively:

DNS queries
Standard HTTP/HTTPS requests (identical to normal browser visits)
Certificate Transparency log lookups
Public vulnerability database correlation

No port scanning. No exploit attempts. No PoC execution. This means you can safely scan any domain — your own sites, client sites, or prospective clients — without legal concerns.

How agencies and freelancers use it

1. Health check past clients

Enter a former client's domain. See its current security posture. If issues are found, you have concrete data to re-engage: "Your site is running WordPress 5.8 with X known vulnerabilities. Want to discuss a fix?"

Numbers change conversations.

2. Scope new projects

For redesign or migration projects, scan the existing site first. "Here's the current security risk profile" makes a compelling case for modernization.

3. Automated post-delivery monitoring with AI

Set up AI Patrol and Nyambush continuously monitors delivered sites. When defacement, layout breakage, or JavaScript failures are detected, you get screenshots and specific findings. Present before/after screenshots with diff images to clients as evidence of your maintenance value.

4. Quality assurance at delivery

Scan your own work before handoff. Prove that security headers and email authentication are properly configured. "Security-conscious development" becomes a documented differentiator.

WordPress plugin for deeper insight

External scanning can't see everything. Install the Nyambush WordPress plugin to report:

Complete plugin inventory (including deactivated plugins)
Exact PHP version
wp-config.php security settings (debug mode, SSL enforcement)
Login security configuration

Those "deactivated but not deleted" plugins with known vulnerabilities? Now you can find them.

Pricing

	Free	Pro	Business
Monthly	$0	$13	$65
Domains	1	5	30
Scan frequency	Monthly	Weekly	Daily
AI Patrol	—	5 pages (Haiku 4.5)	50 pages (Sonnet 4.5)
Patrol scope	—	Tech checks + AI analysis + visual diff	Same (higher accuracy model)
Notifications	—	Email	Slack + LINE
AI Report	—	—	✓

Free works for personal checks. Pro fits agencies managing multiple client sites. Business adds daily AI patrol for automated defacement and incident detection.

Beyond "Build and Forget"

WordPress vulnerability disclosure has reached a scale that no individual can track manually. But "stop using WordPress" isn't realistic — it powers the majority of the web, and that's not changing anytime soon.

What we can do:

Make the invisible visible — know the current state of sites we've built
Communicate risk with data — show clients specific numbers, not vague warnings
Automate monitoring — catch changes before they become incidents
Let AI watch what humans can't — visual monitoring at a scale no team can match

Try it: nyambush.app. Enter a domain. One minute, zero signup, and you'll see what's really going on.

References

I built an open-source SBOM dashboard to track vulnerabilities across all my projects

youichi uda — Sun, 01 Feb 2026 06:38:26 +0000

I got tired of generating SBOMs and then having nowhere useful to put them. So I built SBOMHub - an open-source dashboard for managing SBOMs and tracking vulnerabilities across multiple projects.

The Problem

Tools like Syft, Trivy, and cdxgen make generating SBOMs easy. But then what?

Where do you store SBOMs for 20+ projects?
When a new CVE drops (like Log4j), can you quickly find which projects are affected?
How do you prioritize which vulnerabilities to fix first?
How do you prove to auditors that you're tracking vulnerabilities?

I needed a central place to answer these questions.

What SBOMHub Does

Core features:

Import SBOMs from any generator (CycloneDX/SPDX JSON)
Track vulnerabilities with NVD matching
Cross-project CVE search - "Show me every project using lodash < 4.17.21"
EPSS scoring - Prioritize by actual exploit probability, not just CVSS
VEX support - Mark false positives with justification
CLI for CI/CD - Fail builds on critical vulnerabilities

Quick Start

curl -fsSL https://raw.githubusercontent.com/youichi-uda/sbomhub/main/docker-compose.yml -o docker-compose.yml
docker compose up -d
# Open http://localhost:3000

That's it. PostgreSQL and Redis are included.

CLI Usage

# Install
go install github.com/youichi-uda/sbomhub-cli/cmd/sbomhub@latest

# Scan and upload (auto-detects Syft/Trivy/cdxgen)
sbomhub scan . --project my-app

# Fail CI on critical vulnerabilities
sbomhub scan . --project my-app --fail-on critical

GitHub Actions Integration

name: SBOM Check
on:
  push:
    branches: [main]

jobs:
  sbom:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - name: Install CLI
        run: curl -fsSL https://sbomhub.app/install.sh | sh
      - name: Scan and Upload
        run: sbomhub scan . --project ${{ github.repository }} --fail-on critical
        env:
          SBOMHUB_API_KEY: ${{ secrets.SBOMHUB_API_KEY }}

Tech Stack

Layer	Tech
Backend	Go 1.22+ (Echo)
Frontend	Next.js 16 + React 19
UI	shadcn/ui + Tailwind
Database	PostgreSQL 15+
Cache	Redis 7+
License	AGPL-3.0

Why Not Dependency-Track?

Fair question. Dependency-Track is more mature and battle-tested.

I built SBOMHub because:

DT dropped SPDX support in v4
I needed a CLI for CI/CD integration
I wanted cross-project CVE search
I needed SBOM diff between versions

If DT works for you, stick with it. SBOMHub is for people who need these specific features.

SaaS Option

Don't want to self-host? Try the cloud version: https://sbomhub.app

Plan	Price	Projects
Free	$0	2
Starter	~$17/mo	5
Pro	~$55/mo	Unlimited

Self-hosted is completely free (AGPL-3.0).

What's Next

[ ] LDAP/OIDC authentication
[ ] More vulnerability sources
[ ] AI-powered priority suggestions

DEV Community: youichi uda

I Built a Godot MCP Server Because Existing Ones Couldn't Let AI Test My Game

The Problem

Demo: One Prompt → Complete Reversi + AI Playtest

The Prompt (summary)

What Happened

Build Phase (~2 min)

Playtest Phase (~2 min)

Report

How It Works

Architecture

Why Not Just Edit Files?

Full Tool List (84 tools / 14 categories)

How I Actually Use It Day-to-Day

Getting Started

I checked the WordPress sites I built years ago. Here's what I found.

"Oh, that site still works"

WordPress Is a Monoculture

The numbers

Why monocultures are dangerous

Vulnerabilities Don't Trickle — They Pour

The scale

The scary part: no authentication required

The Maintenance Gap

What happens after delivery

Is this really someone else's problem?

Checking a WordPress Site's Health From the Outside

What you can do from the terminal

But will you do this regularly?

Nyambush — Passive ASM for the Rest of Us

What it checks

AI Patrol — Catching Defacements That Humans Miss

Passive scanning only

How agencies and freelancers use it

WordPress plugin for deeper insight

Pricing

Beyond "Build and Forget"

I built an open-source SBOM dashboard to track vulnerabilities across all my projects

The Problem

What SBOMHub Does

Quick Start

CLI Usage

GitHub Actions Integration

Tech Stack

Why Not Dependency-Track?

SaaS Option

What's Next

Links