Coding-Solo/godot-mcp

AI review

The extension uses axios for HTTP requests and child_process for executing commands, which are expected for its stated purpose of launching Godot and capturing debug output. No hidden instructions, prompt injection, or data exfiltration mechanisms were found. The DEBUG environment variable access is standard and not a security concern.

• low Use of axios for network requests — axios is included as a dependency, which could be used to make outbound HTTP requests. However, this is a common library and the extension's purpose (launching Godot, capturing output) does not inherently require network access. No evidence of misuse was found in the provided code.
• low Use of child_process for command execution — The extension imports spawn and execFile from child_process, which is expected for launching the Godot editor and running projects. This is consistent with the stated purpose and not inherently malicious.
• low Environment variable access for DEBUG mode — The extension reads process.env.DEBUG to enable debug mode. This is a standard practice for development and does not expose sensitive data or pose a security risk.

Model: deepseek-chat

Static findings