Secure by default

The defaults

How a request is checked

The C++ plugin is the authority. The Node.js server checks requests early so it can fail fast, but the plugin re-checks every request, from either route, before it reaches the editor's queue. A refused request does no editor work at all. The checks run in order:

1. Capability token. Missing or wrong: 401 Invalid capability token.

2. Scope. The token must hold the scope the capability needs: SCOPE_NOT_GRANTED otherwise.

3. Consent. Destructive capabilities need a matching grant: CONSENT_REQUIRED otherwise.

4. Project, paths, console and quota. PATH_NOT_PERMITTED, PROJECT_NOT_PERMITTED, COMMAND_BLOCKED or QUOTA_EXCEEDED.

Capability tokens

The first time the editor starts with the plugin, it generates a random 32-byte token and writes it, as 64 hex characters, to <YourProject>/Saved/MCP/capability-token. Native HTTP clients send it in the X-MCP-Capability-Token header; the stdio server reads the file itself (through UE_PROJECT_PATH) and presents it in its WebSocket handshake.

• Tokens are compared in constant time and never written to logs, receipts or health output.
• A session can't switch tokens halfway through.
• The file is readable by your OS user like the rest of the project. Saved/ is normally not committed; keep it that way, and tighten permissions if it sits on a shared drive.

To rotate the token, delete Saved/MCP/capability-token (or clear the Capability Token setting), restart the editor and update your HTTP clients.

Scopes and scoped tokens

Every capability requires one of four scopes: Read, Write, Destructive or Admin. Membership is exact: holding Write does not grant Read, and an action the catalog doesn't know demands Admin, so unknown requests are refused by default. The main token is Admin.

For anything narrower, add entries under Security › Scoped Tokens in the plugin settings. Each scoped token can have its own scopes (never Admin), allowed path prefixes such as /Game/Sandbox/, allowed projects, and per-minute request and tool-call quotas. Typical uses: a read-only token for an assistant that should only look, a token confined to one folder for an experimental agent, or a rate-limited token on a shared machine.

Consent for destructive work

62 capabilities declare a consent mode: explicit, or elevated for the most destructive, such as bulk deletes. describe returns the exact grant; the call must send it back unchanged:

"consent": { "capability": "control_actor.delete", "acknowledge": "explicit", "nonce": "62A12661-4F6A-1C97-339E-69921EE9E2A7" }

• A grant covers one call to one capability. On the native route its nonce makes it single-use: a replay is refused with CONSENT_REUSED.
• It is never inferred from localhost, from earlier calls or from an idempotency key.
• Consent is not permission: the caller still needs the capability's scope.

Consent makes deleting a step the model has to take on purpose, rather than a side effect of a loosely worded prompt. To approve such calls yourself, use your client's tool-approval setting for the unreal tool.

Other safeguards

• Paths. File-system paths are checked for traversal and symbolic links, once when accepted and again just before use.
• Console. Chaining (;, &&, ||, |, backticks, newlines) is refused, as are quit, exit, shutdown, crash and similar, and attempts to reach Python or a shell through the console.
• Python. system_control.execute_python exists. It needs Write scope and explicit consent per call, and scripts are limited to 1 MB. Anything that can run Python can do anything the editor can, so treat that consent as a real decision.
• Rate limits. Native HTTP allows 16 sessions and 32 connections, and per session 600 requests and 120 tool calls a minute.

Remote and LAN access

Both routes are loopback-only by default. Reaching the editor from another machine takes Allow Non Loopback plus a Listen Host in the plugin, a firewall rule, and the token, which stays required: the native server refuses to bind to a LAN address without it. The WebSocket route supports TLS. The native server speaks plain HTTP, so beyond a network you fully trust, reach it through an SSH tunnel or a TLS reverse proxy rather than exposing the port.