
Threat Research
/Security News
Searchjacked: Hidden Browser Extensions Hijack Searches for 13 Million Users
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.
gdharness
Advanced tools
A harness for driving a Godot 4 project from an agent: editor addons, a runtime bridge into the running game, an MCP server in front of them, and a CLI that installs and diagnoses the Godot side.
An agent cannot see a running game. It reads your scripts and guesses at the rest: whether the button is on screen, whether the panel updated, whether that error mattered.
gdharness makes the engine answerable instead. What the screen says, where a control is, what a property reads right now, what the console printed, what broke and on which line.
Hand this to your agent:
Install gdharness here by following https://aureliolo.github.io/gdharness/agent.md,
then tell me what it asked you to recommend back to me.
Or do it yourself, and pick your harness: aureliolo.github.io/gdharness.
editor_run { "op": "start", "projectPath": "C:/games/hall" }
runtime_inspect { "op": "find", "says": "Buy" } // the button, by the word on it
runtime_input { "op": "click", "nodePath": "/root/Hall/Ledger/BuyButton" }
runtime_inspect { "op": "text", "nodePath": "/root/Hall/Ledger" } // what the panel says now
editor_output { "projectPath": "C:/games/hall" } // errors and warnings, with backtraces
The open editor plays the game, so its debugger holds it, which is what lets you set a breakpoint and read the variables in scope when it stops.
Every answer is read back out of the engine after the fact, never echoed from the request. A tool that cannot answer says which state it is in and what would change it, rather than answering emptily, so a call that succeeded is a call that was understood.
| Needs | Godot 4.7 or newer, Node 22 or newer. Runs under Bun 1.4 too. |
| Surface | 30 tools named domain_verb, 4 godot:// resources and 3 prompts |
| Reaches | The editor that is open, a game it is playing, and the project on disk |
| Harnesses | 35, written inside the project wherever the harness has a project config |
| Skill | Written to .agents/skills, which every major harness reads |
| Install | npm, or a Sigstore-signed archive with an SBOM, SLSA Build Level 3 |
| Proven | Every tool driven against Godot 4.7.2 in CI, on Windows, Linux and macOS |
| Status | 1.0: every release is a patch. What a bump means |
Older 4.x is likely to work and is not tested.
aureliolo.github.io/gdharness: installing it, how the parts connect, and every tool, op and argument.
SECURITY.md is how to report something. CONTRIBUTING.md is what a change has to clear.
Fork of GoPeak v2.3.9, September 2026, MIT: the original MCP server godot-mcp by Solomon Elias, GoPeak by HaD0Yun, and completely reworked since to be hardened, condensed and more streamlined.
Not affiliated with the Godot Foundation.
FAQs
A harness for driving a Godot 4 project from an agent: editor addons, a runtime bridge into the running game, an MCP server in front of them, and a CLI that installs and diagnoses the Godot side.
The npm package gdharness receives a total of 0 weekly downloads. As such, gdharness popularity was classified as not popular.
We found that gdharness demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Threat Research
/Security News
319 browser extensions installed by 13.4 million users hijack searches, capture queries, and collect referral payments from Yahoo and Bing.

Threat Research
Malicious Firefox extensions mimic Phantom, Jupiter, and Bitget wallets to steal recovery phrases and private keys, with one fetching its payload remotely.

Product
Socket Threat Intel now shows which malware campaigns were blocked or detected in your organization, with links to scans and Firewall events.