
Research
/Security News
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.
dcl-agent-mcp
Advanced tools
AI agent bridge for Decentraland ??give your agents a body in the metaverse
Give your AI agents a body in Decentraland.
An MCP server that lets AI agents autonomously explore Decentraland, classify scenes, evaluate relevance, and record activity to Lowdown.
npm install dcl-agent-mcp
{
"mcpServers": {
"dcl-agent-mcp": {
"command": "node",
"args": ["node_modules/dcl-agent-mcp/dist/server.js"],
"env": {
"LOWDOWN_API_URL": "https://lowdown-proxy.vercel.app"
}
}
}
}
To use enter_world, move, get_position, observe_world, disconnect_world — tools that give your agent a real avatar body in DCL — you need the Pulse bridge:
git clone https://github.com/PetShopBros/dcl-agent-mcp
cd pulse-test/DCLPulseTestClient/src/DCLPulseTestClient
dotnet build
Requires .NET 10 SDK.
cd pulse-test
npm install
node generate-auth.js
This creates auth-chain.json and ephemeral-key.json in pulse-test/.
{
"mcpServers": {
"dcl-agent-mcp": {
"command": "node",
"args": ["node_modules/dcl-agent-mcp/dist/server.js"],
"env": {
"LOWDOWN_API_URL": "https://lowdown-proxy.vercel.app",
"PULSE_EXE_PATH": "/path/to/DCLPulseTestClient.exe",
"PULSE_AUTH_DIR": "/path/to/pulse-test",
"PULSE_SERVER_IP": "pulse-server.decentraland.org",
"PULSE_SERVER_PORT": "7777",
"PULSE_REALM": "main"
}
}
}
}
Without Pulse setup, REST-only tools (observe, explore, record_visit, register_scene) still work.
| Tool | Requires Pulse | Description |
|---|---|---|
enter_world(parcel) | ✅ | Enter DCL with a real avatar + get scene info |
get_position() | ✅ | Get current avatar coordinates |
move(x, y, z) | ✅ | Teleport avatar to world coordinates |
observe_world() | ✅ | Observe avatar state + scene info |
disconnect_world() | ✅ | Disconnect avatar from DCL |
observe(parcel) | ❌ | Get scene info via REST |
explore(agentId, baseParcel) | ❌ | Autonomously discover unvisited scenes |
register_scene(parcel, name, category) | ❌ | Make your scene discoverable to AI agents |
record_visit(agentId, parcel, outcome) | ❌ | Record agent activity to Lowdown |
Run a self-scheduling agent that explores DCL every hour:
LOWDOWN_API_URL=https://lowdown-proxy.vercel.app \
DCL_SHOWROOM_PARCEL=0,0 \
AGENT_ID=my-agent \
node node_modules/dcl-agent-mcp/dist/scheduler.js
FAQs
AI agent bridge for Decentraland ??give your agents a body in the metaverse
We found that dcl-agent-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.

Research
/Security News
Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.

Product
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.