
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
gdharness
Advanced tools
A harness for driving a Godot 4 project from an agent: editor addons, a runtime bridge into the running game, an MCP server in front of them, and a CLI that installs and diagnoses the Godot side.
An agent cannot see a running game. It reads your scripts and guesses at the rest: whether the button is on screen, whether the panel updated, whether that error mattered.
gdharness makes the engine answerable instead. What the screen says, where a control is, what a property reads right now, what the console printed, what broke and on which line.
Hand this to your agent:
Install gdharness into this project by following
https://aureliolo.github.io/gdharness/agent.md, then tell me what it asked you to
recommend back to me.
Or do it yourself, and pick your harness: aureliolo.github.io/gdharness.
editor_run { "op": "start", "projectPath": "C:/games/hall" }
runtime_inspect { "op": "find", "says": "Buy" } // the button, by the word on it
runtime_input { "op": "click", "nodePath": "/root/Hall/Ledger/BuyButton" }
runtime_inspect { "op": "text", "nodePath": "/root/Hall/Ledger" } // what the panel says now
editor_output { "projectPath": "C:/games/hall" } // errors and warnings, with backtraces
The open editor plays the game, so its debugger holds it, which is what lets you set a breakpoint and read the variables in scope when it stops.
Every answer is read back out of the engine after the fact, never echoed from the request. A tool that cannot answer says which state it is in and what would change it, rather than answering emptily, so a call that succeeded is a call that was understood.
| Needs | Godot 4.7 or newer, Node 22 or newer. Runs under Bun 1.4 too. |
| Surface | 30 tools named domain_verb, and 4 godot:// resources |
| Reaches | The editor that is open, a game it is playing, and the project on disk |
| Harnesses | 35, written inside the project wherever the harness has a project config |
| Skill | Written to .agents/skills, which every major harness reads |
| Install | npm, or a Sigstore-signed archive with an SBOM, SLSA Build Level 3 |
| Proven | Every tool driven against Godot 4.7.2 in CI, on Windows, Linux and macOS |
| Status | 1.0: every release is a patch. What a bump means |
Older 4.x is likely to work and is not tested.
aureliolo.github.io/gdharness: installing it, how the parts connect, and every tool, op and argument.
SECURITY.md is how to report something. CONTRIBUTING.md is what a change has to clear.
Fork of GoPeak v2.3.9, September 2026, MIT: the original MCP server godot-mcp by Solomon Elias, GoPeak by HaD0Yun, and completely reworked since to be hardened, condensed and more streamlined.
Not affiliated with the Godot Foundation.
FAQs
A harness for driving a Godot 4 project from an agent: editor addons, a runtime bridge into the running game, an MCP server in front of them, and a CLI that installs and diagnoses the Godot side.
The npm package gdharness receives a total of 9,434 weekly downloads. As such, gdharness popularity was classified as popular.
We found that gdharness demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.