Release v0.5.21

What's Changed

• fix: widget crash by @ChiR24 in #306
• 🛡️ Sentinel: [HIGH] Fix unsafe path handling in export_level by @google-labs-jules[bot] in #305
• docs: fix rate limiting defaults and missing GraphQL heading by @kalihman in #307
• fix: enable searchText filtering in search_assets action by @kalihman in #308
• fix: align get_ai_info output with TS schema and implement blueprintPath by @kalihman in #310
• fix: unify pin serialization across blueprint graph handlers by @kalihman in #309
• fix: sanitize screenshot path to prevent directory traversal by @google-labs-jules[bot] in #314
• chore(deps): bump picomatch from 4.0.3 to 4.0.4 by @dependabot[bot] in #316
• fix(plugin): use delay-load for optional plugin modules by @ChiR24 in #317
• 🛡️ Sentinel: [HARDENING] Replace synchronous fs operations with async by @google-labs-jules[bot] in #318
• chore(deps): bump github/codeql-action from 4.33.0 to 4.34.1 by @dependabot[bot] in #319
• chore(deps): bump the dependencies group with 9 updates by @dependabot[bot] in #320
• fix: resolve asset query parameter bugs and expand classNames support by @kalihman in #311
• fix(security): sanitize user inputs in editor console commands by @google-labs-jules[bot] in #322
• feat(security): add MCP_ADDITIONAL_PATH_PREFIXES for custom content mount points by @6r0m in #326
• 🛡️ Sentinel: [HIGH] Fix command injection in bump-version action by @google-labs-jules[bot] in #327

New Contributors

• @6r0m made their first contribution in #326

Full Changelog: v0.5.20...v0.5.21

Release v0.5.20

Important

🛡️ Security Fix & UE 5.0 Compatibility

This release includes a critical path traversal fix in export_asset, UE 5.0 compatibility improvements, and external actors support for World Partition.

🛡️ Security

🔒 Path Traversal in export_asset (5cf2a3c)

Aspect	Details
Severity	🚨 CRITICAL
Vulnerability	Path traversal in export_asset action
Fix	Added path validation to prevent directory traversal attacks

Files Modified:

• McpAutomationBridge_SystemControlHandlers.cpp

✨ Added

🌍 External Actors Support (51143c3)

Feature	Description
External Actors	Support for World Partition external actors in level structure handlers
Streaming Reference	Streaming reference creation for external actor packages

Files Modified:

• McpAutomationBridge_LevelStructureHandlers.cpp (+127 lines)

🛠️ Fixed

🎮 UE 5.0 Compatibility (1057023)

Bug	Fix
bIsWorldInitialized API not available in UE 5.0	Direct access to bIsWorldInitialized for UE 5.0 compatibility

Files Modified:

• McpAutomationBridgeHelpers.h
• McpAutomationBridge_LevelStructureHandlers.cpp

🐛 Tick Task Manager Crashes (8c311d7)

Bug	Fix
Crashes from tick task manager during world operations	Added safety checks and proper cleanup in world management
World cleanup issues	Enhanced cleanup with FlushRenderingCommands safety

Files Modified:

• McpAutomationBridgeHelpers.h (+36 lines)
• McpAutomationBridge_LevelStructureHandlers.cpp (+65 lines)
• McpSafeOperations.h (+16 lines)

🐛 Sublevel Creation (bffb68c)

Bug	Fix
Sublevel creation path handling issues	Enhanced sublevel creation process with proper path handling

Files Modified:

• McpAutomationBridge_LevelStructureHandlers.cpp (+201 lines)

🔧 UE 5.7 Build (#295)

Bug	Fix
Missing includes causing build failures on UE 5.7	Added missing includes in McpHandlerUtils.cpp and McpPropertyReflection.cpp

Contributors: @a2448825647

🔄 Dependencies

GitHub Actions Updates

Package	From	To	PR
release-drafter/release-drafter	7.0.0	7.1.1	#300
softprops/action-gh-release	2.5.3	2.6.1	#301
github/codeql-action	4.32.6	4.33.0	#299

NPM Package Updates

Package	From	To	PR
flatted	3.3.3	3.4.2	#304

🔌 Plugin

MCP Automation Bridge v0.1.3

Updated plugin version to 0.1.3 with all fixes and features from this release.

See Plugin CHANGELOG for details.

---

Release v0.5.19

---

Important

🛡️ Security Hardening & Major Plugin Refactoring

This release includes critical security fixes for command injection and path traversal vulnerabilities, a complete deep-level refactoring of 57 C++ handler files with centralized utilities, and removal of the WebAssembly integration.

🛡️ Security

🔒 Command Injection Prevention (#288)

Component	Change
sanitizeCommandArgument()	Added semicolon sanitization to prevent command chaining attacks
Physics Tools	Sanitized constraint names, actor names, vehicle names, destruction names
Animation Tools	Sanitized state machine names, state names, transition conditions
System Handlers	Sanitized vehicle type, save paths, and all user-provided strings

Attack Vector Blocked: Input like "name;quit" can no longer execute arbitrary commands.

🔒 Path Traversal Fixes (#271, #282)

Component	Change
validateSnapshotPath()	Fixed bypass where paths equal to CWD (without trailing separator) were incorrectly rejected
Asset Handlers	Added path sanitization to prevent traversal attacks
Blueprint Creation	Added savePath sanitization

🔒 GraphQL CORS Hardening

Component	Change
Default CORS	Changed from permissive '*' to safe loopback origins
Allowed Origins	localhost:4000, 127.0.0.1:4000, localhost:3000, 127.0.0.1:3000
Warning	Added security warning when '*' is explicitly configured

🔧 Changed

🏗️ Complete C++ Plugin Refactoring (#280)

Deep line-by-line refactoring of 57 handler files and 8 infrastructure files:

New Infrastructure File	Purpose
McpHandlerUtils.h/cpp	Standardized JSON response builders (1,900 lines)
McpPropertyReflection.h/cpp	Property reflection utilities (1,356 lines)
McpSafeOperations.h	Safe asset/level save for UE 5.7 (659 lines)
McpVersionCompatibility.h	UE 5.0-5.7 API compatibility macros (225 lines)
McpHandlerDeclarations.h	Forward declarations (844 lines)
McpAutomationBridge_ConsoleCommandHandlers.cpp	Batch and single command execution (302 lines)

Bugs Fixed During Refactoring:

• EditorFunctionHandlers: use-after-free bug
• EffectHandlers: truncated condition + missing braces
• InventoryHandlers: duplicate TArray with undefined variables
• MaterialAuthoringHandlers: duplicate include + missing UE 5.0 fallback
• NavigationHandlers: case-sensitivity error
• SkeletonHandlers: duplicate verification + redundant code
• WidgetAuthoringHandlers: unreachable code block

⚡ Performance Improvements (#283)

Component	Change
Batch Console Commands	New batch execution API for parallel command processing
validate_assets	Changed from sequential to Promise.all concurrent validation
State Machine Creation	States now added in parallel instead of sequentially

🗑️ WebAssembly Integration Removed (#240)

Removed WebAssembly (wasm-pack/Rust) integration:

• Deleted src/wasm/ directory (874 lines)
• Deleted wasm/ Rust crate (1,500+ lines)
• Removed WASM dependency from all handlers
• Native C++ handlers provide equivalent functionality

🛠️ Fixed

🐛 Blueprint Inspect Crash (#270)

Bug	Fix
Blueprint inspect crashed when variable list exceeded buffer	Fixed truncated variable list handling
Function library blueprints not supported	Added function library blueprint support (#258)

🐛 GAS Duplicate Effect Creation (#251)

Bug	Fix
create_gameplay_effect assertion failure on duplicates	Prevented duplicate GameplayEffect creation

🐛 Volume Handler Mobility

Bug	Fix
Volume attachment failed for movable actors	Added mobility check for target actors in volume handlers

🐛 UE 5.7 Compatibility (#274)

Bug	Fix
GeometryScript AppendCapsule compile error on UE 5.5+	Added version guard for segment steps parameter

🐛 Action Name Alignment (#253)

Bug	Fix
TypeScript action names mismatched C++ handlers	Aligned all action names with C++ handler expectations

🗑️ Removed

Deprecated Tool Files

Removed deprecated standalone tool files (consolidated into handlers):

• src/tools/audio.ts → src/tools/handlers/audio-handlers.ts
• src/tools/debug.ts → consolidated into system handlers
• src/tools/introspection.ts → src/tools/handlers/inspect-handlers.ts
• src/tools/materials.ts → src/tools/handlers/material-authoring-handlers.ts
• src/tools/performance.ts → src/tools/handlers/performance-handlers.ts
• src/tools/ui.ts → consolidated into widget handlers
• src/tools/input.ts → src/tools/handlers/input-handlers.ts
• src/tools/behavior-tree.ts → consolidated
• src/tools/engine.ts → consolidated

🔄 Dependencies

NPM Package Updates

Package	From	To	PR
hono	4.12.0	4.12.7	#261, #277
express-rate-limit	8.2.1	8.3.0	#269
@types/node	Various updates		Multiple PRs

GitHub Actions Updates

Package	From	To	PR
release-drafter/release-drafter	6.2.0	7.0.0	#286
softprops/action-gh-release	2.5.0	2.5.3	#287
actions/setup-node	6.2.0	6.3.0	#257
github/codeql-action	4.32.5	4.32.6	#266

📊 Statistics

• Commits: 55 non-merge commits
• Files Changed: 185 files
• Lines Added: ~30,280
• Lines Removed: ~20,440
• New C++ Infrastructure: 5 files (~4,900 lines)
• Bugs Fixed: 15+
• Security Fixes: 4 critical

---

New Contributors

• @bytecodesky made their first contribution in #254
• @BeegHero made their first contribution in #274

Full Changelog: v0.5.18...v0.5.19

Release v0.5.18

Important

🔧 Installation, Documentation & Dependency Updates

This release fixes npm install failures when downloading from GitHub releases, adds first-time project setup guidance, and updates dependencies.

🛠️ Fixed

🐛 npm install failure from release archives (#215)

Issue	Root Cause	Fix
npm install fails with ESLint config error	Release archives excluded eslint.config.mjs and other build files	Added -source archives with complete build files
prepare script runs build unnecessarily	Checked only dist/ existence, not build artifacts	Now verifies dist/cli.js and dist/index.js exist
Deprecated --ext .ts flag in lint	ESLint 9.x removed support for --ext flag	Removed flag, extensions configured in eslint.config.mjs

Files Modified:

• package.json (prepare script, lint scripts, removed prebuild)
• .github/workflows/release.yml (added source archives, fixed plugin path)
• README.md (added Rust/wasm-pack prerequisites)

📚 Documentation

📖 First-time project open instructions (112df08)

Added guidance for users opening Unreal projects for the first time:

• Explains UE prompt to rebuild missing modules
• Documents expected plugin load failure after first rebuild
• Recommends closing and reopening project to resolve

⬆️ Dependencies

Package	From	To	PR
hono	4.11.7	4.12.0	#213
ajv	8.17.1	8.18.0	#210
actions/stale	10.1.1	10.2.0	#208
actions/dependency-review-action	4.8.2	4.8.3	#212

---

Release v0.5.17

Important

🔧 World Tools Category Fixes & Security Hardening

This release includes critical bug fixes, security hardening, and UE 5.7 compatibility improvements across all world-building tools (landscape, foliage, geometry, volumes, navigation).

🛡️ Security

🔒 Path Validation & Input Sanitization (#207)

Component	Change
SanitizeProjectRelativePath	Rejects Windows absolute paths, normalizes slashes, collapses //, requires valid UE roots (/Game, /Engine, /Script)
SanitizeProjectFilePath	File operations with path traversal protection
ValidateAssetCreationPath	Combines folder + name validation for asset creation
Actor/Volume Name Validation	Blocks invalid characters, enforces length checks
Snapshot Path Validation	Prevents directory traversal attacks via snapshot paths

Files Modified:

• McpAutomationBridgeHelpers.h (+326 lines of security helpers)
• src/tools/environment.ts (snapshot path security)
• src/utils/path-security.ts (path normalization)

🛠️ Fixed

🐛 Landscape Handler Silent Fallback Bug (McpAutomationBridge_LandscapeHandlers.cpp)

Bug	Root Cause	Fix
False positives on non-existent landscapes	Path matching compared GetPathName() (internal path) with asset path	Normalized both paths with .uasset stripping
Silent fallback to single landscape	if (!Landscape && LandscapeCount == 1) used any available landscape	Removed fallback, now returns LANDSCAPE_NOT_FOUND error
Wrong response path	Returned requested path instead of actual path	Now returns Landscape->GetPackage()->GetPathName()

Affected Handlers: HandleModifyHeightmap, HandlePaintLandscapeLayer, HandleSculptLandscape, HandleSetLandscapeMaterial

🐛 Rotation Yaw Bug (McpAutomationBridge_LightingHandlers.cpp:200)

Bug	Fix
Rotation.Yaw read from LocPtr instead of RotPtr	Changed to GetJsonNumberField((*RotPtr), TEXT("yaw"))

Impact: Incorrect rotation when spawning lights with rotation parameters.

🐛 Integer Overflow in Heightmap Operations (McpAutomationBridge_LandscapeHandlers.cpp:631-635)

Bug	Fix
static_cast<int16>(CurrentHeights[i]) overflows for values > 32767	Changed to static_cast<int32>

Impact: Heightmap raise/lower operations now produce correct results for heights above midpoint.

🐛 set_curve_key Success Reporting (McpAutomationBridge_AnimationHandlers.cpp:2139)

Bug	Fix
bSuccess initialized false, only set true inside if (bSuccess) block (unreachable)	Moved success logic before the condition check

Impact: set_curve_key now correctly reports success.

🐛 CraftingSpeed Truncation (McpAutomationBridge_InventoryHandlers.cpp:2716)

Bug	Fix
int32 CraftingSpeed truncated fractional multipliers (1.5 → 1)	Changed to double

🐛 Invalid Color Fallback Not Applied (McpAutomationBridge_LightingHandlers.cpp:277)

Bug	Fix
SetLightColor() only called when bColorValid == true, but bColorValid = false for invalid colors	Removed guard, always call SetLightColor() after correcting invalid colors to white

🐛 Double-Validation in Snapshot Path (src/tools/environment.ts:253, 322)

Bug	Fix
Redundant second validateSnapshotPath() call on already-resolved absolute paths	Removed redundant call

🐛 Intel GPU Driver Crash Prevention (McpAutomationBridgeHelpers.h)

Bug	Fix
MONZA DdiThreadingContext exceptions on Intel GPUs during level save	Added McpSafeLevelSave helper with FlushRenderingCommands and retry logic

✨ Added

🛤️ LOD Generation Enhancements (McpAutomationBridge_GeometryHandlers.cpp)

Feature	Description
landscapePath support	LOD generation now accepts single landscapePath or array assetPaths
lodCount parameter	Alternative to numLODs for specifying LOD count
Path sanitization	All LOD operations use SanitizeProjectRelativePath

🌿 FoliageType Auto-Creation (McpAutomationBridge_FoliageHandlers.cpp)

Feature	Description
Auto-create FoliageType	When painting/adding foliage, FoliageType is automatically created from StaticMesh if missing
Path validation	All foliage operations use path sanitization

🏔️ Landscape Layer Auto-Creation (McpAutomationBridge_LandscapeHandlers.cpp)

Feature	Description
Auto-create layers	When painting, landscape layers are auto-created if they don't exist (matches UE editor behavior)

📊 Handler Verification (Multiple Handler Files)

Pattern	Description
AddActorVerification	Returns actorPath, actorName, actorGuid, existsAfter, actorClass
AddComponentVerification	Returns componentName, componentClass, ownerActorPath
AddAssetVerification	Returns assetPath, assetName, existsAfter, assetClass
VerifyAssetExists	Verifies asset exists at path

Files Updated: PropertyHandlers, LevelHandlers, EffectHandlers, GASHandlers, SequenceHandlers, SkeletonHandlers, and 30+ additional handler files

🔧 Changed

🎮 UE 5.7 Compatibility

Component	Change
WebSocket Protocol	GetProtocolType() (FName) replaces deprecated GetProtocolFamily() (enum)
SCS Save	McpSafeAssetSave replaces SaveLoadedAssetThrottled to prevent recursive FlushRenderingCommands crashes
PostProcessVolume	Conditionally compiled (removed in UE 5.7)
Niagara Graph	Initialize GraphSource/NiagaraGraph to prevent null graph crashes
Landscape Edit	FLandscapeEditDataInterface for UE 5.5+, deprecation suppression for 5.0-5.4
WorldPartition	Support RuntimeHashSet in addition to RuntimeSpatialHash for UE 5.7+

📈 Performance Improvements

Component	Change
Heightmap Modification	Pass false to FLandscapeEditDataInterface to prevent 60+ second GPU sync delays
Landscape Updates	Use MarkPackageDirty instead of PostEditChange to avoid unnecessary rebuilds
Geometry Operations	Memory pressure checks and triangle limits to prevent OOM crashes

📊 Statistics

• Files Changed: 70 files
• Lines Added: ~7,200
• Lines Removed: ~1,400
• Bug Fixes: 8 critical bugs
• New Verification Helpers: 4

---

Release v0.5.16

Release v0.5.16

What's Changed

• feat(bridge): add IPv6 support and hostname validation in #194
• feat: implement 200+ MCP action handlers for comprehensive UE automation in #200
• feat(tests): add heartbeat/progress protocol integration tests and enhance test runner setup in #201
• Potential fix for code scanning alert no. 25: Incomplete string escaping or encoding in #202

Full Changelog: v0.5.15...v0.5.16

Release v0.5.15

Release v0.5.15

What's Changed

• chore(deps): bump the dependencies group with 2 updates by @dependabot[bot] in #190
• chore(deps): bump github/codeql-action from 4.32.1 to 4.32.2 by @dependabot[bot] in #189
• feat: add support for non-loopback binding in automation bridge settings by @ChiR24 in #193

Full Changelog: v0.5.14...v0.5.15

Release v0.5.14

Important

🔐 TLS & Network Security Release

This release introduces TLS/SSL support for secure WebSocket connections (wss://), per-connection rate limiting, loopback-only network binding enforcement, and authentication state tracking for the Automation Bridge.

🛡️ Security

🔒 Loopback-Only Binding & Handshake Enforcement (70c2745)

Aspect	Details
Severity	🚨 HIGH
Loopback Binding	Automation Bridge now only binds to loopback addresses (127.0.0.1 or ::1)
Handshake Required	Automation requests require completed bridge_hello handshake

C++ Plugin:

• Rejects 0.0.0.0 and :: bind attempts, falls back to 127.0.0.1 with warning
• Added AuthenticatedSockets tracking set in McpConnectionManager
• Unauthenticated sockets receive HANDSHAKE_REQUIRED error and connection close (code 4004)

TypeScript Bridge:

• Added normalizeLoopbackHost() to validate and enforce loopback addresses
• Non-loopback host values rejected with warning and fallback

✨ Added

🔐 TLS/SSL, Rate Limiting & Schema Validation (d2a94cf)

Feature	Description
TLS/SSL Support	Full wss:// WebSocket support with OpenSSL/TLS integration (TLS 1.2+)
Rate Limiting	Per-connection limits: 600 messages/min, 120 automation requests/min
Schema Validation	New Zod schemas in src/automation/message-schema.ts for type-safe message parsing

New Plugin Settings:

• bEnableTls, TlsCertificatePath, TlsPrivateKeyPath - TLS configuration
• MaxMessagesPerMinute, MaxAutomationRequestsPerMinute - Rate limit configuration

C++ Implementation:

• InitializeTlsContext(), EstablishTls(), SendRaw(), RecvRaw() - TLS-aware I/O
• Requires UE 5.7+ for native socket release; graceful fallback on older versions

TypeScript Integration:

• Added rateLimitState tracking with cleanup on connection close

🛠️ Fixed

🔧 TLS Memory Management (321206e)

Fix	Description
Struct Initialization	Fixed FParsedWebSocketUrl member initialization order (Port using uninitialized bUseTls)
SSL Context Ownership	Added bOwnsSslContext to prevent double-free of client contexts owned by ISslManager

🔧 Thread Safety & TLS Error Handling (6fd1553)

Fix	Description
Mutex Protection	Added SocketRateLimits cleanup in ForceReconnect with proper mutex locking
Declaration	Moved ShutdownTls() declaration outside WITH_SSL guard for compilation compatibility

🔧 Review Feedback Fixes (8987a3e)

Fix	Description
Duplicate Call	Fixed duplicate ActiveSockets.Empty() call in connection manager
TypeScript Cleanup	Added rateLimitState cleanup in closeAll() method

🔄 Dependencies

NPM Package Updates

Package	Update	PR
@modelcontextprotocol/sdk	1.25.3 → 1.26.0	#187
mcp-client-capabilities	Latest	#186

GitHub Actions Updates

Package	Update	PR
github/codeql-action	4.32.0 → 4.32.1	#185
actions/github-script	7.0.1 → 8.0.0	#184

---

Release v0.5.13

Important

🛡️ Security & Compatibility Release

This release includes multiple critical security fixes for command injection and path traversal vulnerabilities, along with full Unreal Engine 5.0 backward compatibility and WebSocket stability improvements.

🛡️ Security

🔒 Command Injection in UITools (#144)

Aspect	Details
Severity	🚨 HIGH
Vulnerability	Command injection via unsanitized user input in widget creation
Fix	Added sanitizeConsoleString() and applied sanitizeAssetName() to all user-provided identifiers
Contributors	@google-labs-jules[bot]

🔒 Command Injection in LevelTools (#179)

Aspect	Details
Severity	🚨 HIGH
Vulnerability	Command injection via level names, event types, and game mode parameters
Fix	Added sanitizeCommandArgument() and applied to all console command parameters
Contributors	@google-labs-jules[bot]

🔒 Path Traversal in Asset Listing (#163)

Aspect	Details
Severity	🚨 HIGH
Vulnerability	Path traversal in listAssets via filter.pathStartsWith parameter
Fix	Applied normalizeAndSanitizePath() to GraphQL listAssets and asset handler list action
Contributors	@google-labs-jules[bot]

✨ Added

🎮 Unreal Engine 5.0 Compatibility (#183)

Component	Description
API Abstractions	Version-guarded macros for Material, Niagara, AssetRegistry, Animation, and World Partition APIs
Build System	Made plugin dependencies optional with dynamic memory-based configuration
Coverage	41 handler files updated with UE 5.0-5.7 compatibility

Compatibility Macros Added:

• MCP_GET_MATERIAL_EXPRESSIONS() - Abstracts material expression access
• MCP_DATALAYER_TYPE / MCP_DATALAYER_ASSET_TYPE - Data layer type abstraction
• MCP_ASSET_FILTER_CLASS_PATHS - Asset registry filter abstraction
• MCP_ASSET_DATA_GET_CLASS_PATH() - FAssetData abstraction
• MCP_NIAGARA_EMITTER_DATA_TYPE - Niagara emitter abstraction

🛠️ Fixed

🔌 WebSocket Stability (#180, #181)

Fix	Description
TOCTOU Race	Fixed Time-of-Check-Time-of-Use race condition in ListenSocket shutdown
Shutdown Hang	Fixed WebSocket server blocking cook/package builds
Version Compatibility	Fixed PendingReceived.RemoveAt() API differences for UE 5.4+

Contributors: @kalihman

🔧 Resource Handlers (#165)

• Fixed broken actors and level resource handlers
• Added missing actors and level resources to MCP resource list

Contributors: @kalihman

🔧 Other Fixes

Fix	Description
UE 5.7	Resolved macro handling and ControlRig dynamic loading issues
UE 5.5	Fixed API compatibility issues in handlers
UE 5.1	Fixed MaterialDomain.h inclusion path
JSON	Refactored JSON handling in McpAutomationBridge

🧪 Testing

• Added security regression tests for UITools, LevelTools, and asset handlers

🔄 Dependencies

GitHub Actions Updates

Package	Update	PR
release-drafter/release-drafter	6.1.1 → 6.2.0	#160
actions/checkout	6.0.1 → 6.0.2	#161
github/codeql-action	4.31.10 → 4.32.0	#168, #170
google-github-actions/run-gemini-cli	Latest	#177

NPM Package Updates

Package	Update	PR
@modelcontextprotocol/sdk	Latest	#154
hono	4.11.4 → 4.11.7	#173
@types/node	Various updates	#158, #162, #175

---

Release v0.5.12

Changes in this Release

What's Changed

• chore(deps): bump the dependencies group with 3 updates by @dependabot[bot] in #143
• chore(deps): bump google-github-actions/run-gemini-cli from 0.1.18 to 0.1.19 by @dependabot[bot] in #142
• chore(deps): bump release-drafter/release-drafter from 6.1.0 to 6.1.1 by @dependabot[bot] in #141
• fix: sync TS handler params with C++ handlers

Full Changelog: v0.5.11...v0.5.12