
Security News
PHP Patches Critical RCE Vulnerabilities, Organizations Urged to Take Unpatched Sites Offline
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.
weaponlab-mcp
Advanced tools
An MCP server that finds and fixes first-person weapon bugs behind a gate: your game's probe measures, the Gate judges, Rig Lab and Motion Lab read and mend.
An MCP server that finds and fixes first-person weapon bugs behind a gate: hands off the gun, a magazine crooked in its well, a blade held wrong, arms covering the screen.
Each bug becomes a case: a metric, a weapon, an action and a pass rule. Your game's own probe measures the weapons. The Gate passes a change only when its target cases pass and nothing else got worse. Fix each kind of bug once, then check every weapon with it.
Weapon Lab never runs your game itself. You write a small probe for your engine that follows the probe contract: a job file in, a rows file out. Everything else works on what the probe writes back.
| Group | Tools | What for |
|---|---|---|
| Gate | gate_run, gate_verdict, gate_propose, gate_approve, gate_set_baseline, gate_cases, ... | Keeps the bugs as cases, measures, compares against a baseline, judges a change, records a person's approval. |
| Probe | probe_run, probe_plan, probe_status | Starts your game's probe. Tries a fix before it is written: tuned fields, staged assets, screenshots, parts dumps. |
| Rig Lab | rig_pieces, rig_facts, rig_align, rig_part_line, rig_fist | Reads the posed weapon from a parts dump: its pieces, real-world facts (the magazine behind the barrel), a magazine's line into its well, a hilt in the fist. |
| Motion Lab | motion_roll, motion_roll_profile, motion_roll_set, motion_track, motion_render | Rebuilds clips in Blender: turns a hand about its forearm inside the forearm's range, puts a sliding part back on its axis. |
| Specs | spec_list, spec_read, spec_validate, spec_write | One file a weapon: marks (grip, support), anchors (pieces to find), facts, limits. |
| Contract | contract_check | Checks a probe's job, rows or parts dump. |
The demo is a toy game with two planted bugs and a probe in about 150 lines. It needs no engine.
pip install -e .
cd examples/demo
weaponlab gate run probe,rig
(python -m weaponlab works the same when pip's scripts folder is not on your PATH.)
The rifle's left hand misses its handguard by 3.75 cm. The knife's hilt lies 90 degrees across the fist.
tests/test_demo.py walks the whole loop: measure, find the fix, try it by tune, judge it.
weaponlab init in your project. It writes weaponlab.json and empty data files.examples/demo/probe/demo_probe.py.
Set its command in weaponlab.json.weaponlab/data/weapons.json and their actions in actions.json.Check your probe on its own with weaponlab contract job|rows|parts <file>.
{"mcpServers": {"weaponlab": {"command": "weaponlab-mcp", "env": {"WEAPONLAB_PROJECT": "C:/path/to/your/game"}}}}
| Setting | Meaning |
|---|---|
WEAPONLAB_PROJECT | The project folder with weaponlab.json. The current folder by default. |
WEAPONLAB_BLENDER | Blender, for Motion Lab. Found on the PATH or in the usual install folders otherwise. |
hand_r, index_01_r, lowerarm_r) for the fist measure and
the forearm roll.Weapon Lab is the general part of the tools built for ToangTown, an Unreal 5.8 game with 46 weapons. Its first probe is ToangTown's. The contract's lessons come from that probe. Pose Lab (poselab-mcp) answers the body's side: clipping, the view, a grip solver. The Gate can use it as a provider.
MIT
FAQs
An MCP server that finds and fixes first-person weapon bugs behind a gate: your game's probe measures, the Gate judges, Rig Lab and Motion Lab read and mend.
We found that weaponlab-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
PHP releases emergency patches for two critical RCE vulnerabilities as agencies urge organizations to take unpatched sites offline.

Threat Research
/Security News
A supply chain attack compromised LiteLLM 1.107.0 on PyPI and Docker, spreading malware that steals cloud credentials, developer secrets, and AI provider keys.

Security News
vlt 1.5.0 links skills from JavaScript dependencies to coding agents, with lockfile versioning and Socket data to filter out known malicious packages.