Maintainer of this skill?
by playcanvas
MCP Server for AI automation of the PlayCanvas Editor
# Add to your Claude Code skills
git clone https://github.com/playcanvas/editor-mcp-serverGuides for using mcp servers skills like editor-mcp-server.
Last scanned: 5/30/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@modelcontextprotocol/sdk: @modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ajv: ajv has ReDoS when using `$data` option",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "body-parser: body-parser is vulnerable to denial of service when url encoding is used",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion Regular Expression Denial of Service vulnerability",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "flatted: flatted vulnerable to unbounded recursion DoS in parse() revive phase",
"severity": "high"
},
{
"type": "npm-audit",
"message": "hono: Hono JWK Auth Middleware has JWT algorithm confusion when JWK lacks \"alg\" (untrusted header.alg fallback)",
"severity": "high"
},
{
"type": "npm-audit",
"message": "js-yaml: js-yaml has prototype pollution in merge (<<)",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "minimatch: minimatch has a ReDoS via repeated wildcards with non-matching literal in pattern",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Denial of Service via sequential optional groups",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "qs: qs's arrayLimit bypass in comma parsing allows denial of service",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ws: ws: Uninitialized memory disclosure",
"severity": "medium"
}
],
"status": "WARNING",
"scannedAt": "2026-05-30T16:34:37.473Z",
"npmAuditRan": true,
"pipAuditRan": true
}See how editor-mcp-server compares with popular alternatives.
editor-mcp-server is an open-source mcp servers skill for AI coding assistants such as Claude Code, Codex CLI, and ChatGPT, built by playcanvas. MCP Server for AI automation of the PlayCanvas Editor. It has 143 GitHub stars.
editor-mcp-server returned warnings in SkillsLLM's automated security scan. It has no critical vulnerabilities, but review the flagged issues in the Security Report section before adding it to your workflow.
Clone the repository with "git clone https://github.com/playcanvas/editor-mcp-server" and add it to your Claude Code skills directory (see the Installation section above).
editor-mcp-server is primarily written in TypeScript. It is open-source under playcanvas on GitHub, so you can review or fork the full source.
Yes. SkillsLLM lists many other MCP Servers skills you can browse and compare side by side. Open the MCP Servers category from the badge at the top of this page, or use the Related Skills and comparison links further down to weigh editor-mcp-server against similar tools.
No comments yet. Be the first to share your thoughts!
Top skills in this category by stars
Requires a passing catalog security scan.
⚠️ Third-Party Software Notice
This skill is third-party open-source software developed and hosted independently on GitHub. SkillsLLM is an informational directory and does not control or maintain the underlying repository.
Any security checks, ratings, or warnings displayed by SkillsLLM are automated and limited in scope. They do not constitute a security certification or guarantee that the software is safe, error-free, or free from malicious code, vulnerabilities, compromised dependencies, or prompt-injection risks.
Review the source code, permissions, dependencies, and configuration before installing or running any third-party skill. Use is at your own risk. To the maximum extent permitted by applicable law, SkillsLLM is not liable for losses arising from third-party software.
| npm | Developer Site | Editor Manual | API Reference | Blog | Forum |
An MCP server that lets AI agents automate the PlayCanvas Editor and check that scenes actually run. The MCP client is built into the Editor, so no browser extension is needed.
Add the server to your MCP client. For Claude Code:
claude mcp add playcanvas -- npx -y @playcanvas/editor-mcp-server
Requires Node.js 22.18+. Add the server once per agent: two servers take turns owning the Editor port.
{
"mcpServers": {
"playcanvas": {
"command": "npx",
"args": ["-y", "@playcanvas/editor-mcp-server"]
}
}
}
Add this to claude_desktop_config.json (Settings > Developer > Edit Config), to Cursor's
global MCP servers (Cursor Settings > MCP), or to a .mcp.json committed to the project root
for Claude Code. On Windows, use "command": "cmd" with "args": ["/c", "npx", "-y", "@playcanvas/editor-mcp-server"].
codex mcp add playcanvas -- npx -y @playcanvas/editor-mcp-server
On Windows, insert cmd /c before npx. If the first run times out while npx downloads, raise
startup_timeout_sec under [mcp_servers.playcanvas] in ~/.codex/config.toml.
Then open your project in the Editor, click the MCP button below Publish, and click CONNECT. To
start with no project open, use the MCP button next to NEW PROJECT on playcanvas.com/editor. Allow
Chrome's Apps on device permission when prompted; if the Editor stays on Connecting, it is
blocked. The default port is 52000; to change it, pass --port <number> to the server and set the
same port in the Editor.
Ask your agent for the outcome you want in the open project. For example:
Add a spinning cube with a rotate script to the current scene, launch it, and capture a screenshot
of the running app to confirm it turns.
| Category | Coverage |
|---|---|
| Projects | Listing, exact reads, creation, name, description and visibility edits, and opening a project in the connected Editor |
| Entity | Exact reads, filtered lists, resolution, search, script lookup, creation, schema-safe batch edits, duplication, hierarchy changes, deletion and component lifecycle |
| Scripts | Asset text reads and writes, parsing, attachment, attributes, ordering and removal |
| Assets | Exact reads, reference graphs, native creation, streamed upload and atomic download up to 512 MiB, schema-safe edits, moves, duplication, source replacement, reimport, deletion and materials |
| Templates | Instantiation and instance override inspection, application, reversion and unlinking |
| Animation | Animation state graph reads and edits, mapping-safe state renames and animation events |
| Processing | Lightmaps, model unwrap and cancellation, texture conversion, atlases, cubemaps, fonts, metadata, compressed variants, prefiltering, sprites and bundles |
| Scene | Exact reads, listing, loading, creation, duplication, rename, deletion and scene settings |
| Settings | Scoped project, private, user, session and scene settings reads and edits |
| Viewport | Camera and viewport state, visibility, capture and focus |
| Editor | Selection, edit-time logs, transform gizmo state, undo and redo |
| Builds | Listing, exact reads, creation options, streamed downloads, primary build selection and deletion |
| Store | PlayCanvas Store search and import, licenses, Sketchfab search and import, and My Assets search and import |
| Runtime | Launch lifecycle and options, engine version discovery, screenshots, logs, live state inspection and keyboard, mouse and touch input |
| VCS | Branches, checkpoints, restore and hard reset, merges, conflict resolution and checkpoint diffs |
Tools act on the project open in the connected Editor, one Editor at a time. Project tools also
work from the project manager at playcanvas.com/editor with no project open; opening a project
reloads the tab into it and reconnects automatically. Projects can't be deleted. Runtime tools open
a Launch window, so allow pop-ups for the Editor.
The 130 tool definitions total about 43,000 tokens (4 characters per token). Claude Code's MCP tool search is on by default and loads only tool names at start, about 1,000 tokens.
The server has no telemetry. It listens on 127.0.0.1:52000 for playcanvas.com and localhost
pages, stops any other process holding that port, touches local files only for upload and download
tools, and makes one outbound request: download_build fetches the archive URL the Editor reports.
git clone https://github.com/playcanvas/editor-mcp-server.git
cd editor-mcp-server
npm install
npm run watch
Point your MCP client at src/server.ts with "command": "node". npm run debug opens the MCP
Inspector and npm run build produces the published bundle. Report bugs in
GitHub Issues.
The PlayCanvas Editor MCP Server is released under the MIT License.