unreal-engine-mcp-server 0.5.2 → 0.5.4

package/dist/types/handler-types.d.ts

@@ -0,0 +1,343 @@
+export interface Vector3 {
+    x: number;
+    y: number;
+    z: number;
+}
+export interface Rotator {
+    pitch: number;
+    yaw: number;
+    roll: number;
+}
+export interface Transform {
+    location?: Vector3;
+    rotation?: Rotator;
+    scale?: Vector3;
+}
+export interface HandlerArgs {
+    action?: string;
+    subAction?: string;
+    [key: string]: unknown;
+}
+export interface AutomationResponse {
+    success: boolean;
+    message?: string;
+    error?: string;
+    result?: unknown;
+    [key: string]: unknown;
+}
+export interface ComponentInfo {
+    name: string;
+    class?: string;
+    objectPath?: string;
+    [key: string]: unknown;
+}
+export interface ActorArgs extends HandlerArgs {
+    actorName?: string;
+    name?: string;
+    classPath?: string;
+    class?: string;
+    type?: string;
+    location?: Vector3;
+    rotation?: Rotator;
+    scale?: Vector3;
+    meshPath?: string;
+    timeoutMs?: number;
+    force?: Vector3;
+    parentActor?: string;
+    childActor?: string;
+    tag?: string;
+    newName?: string;
+    offset?: Vector3;
+    visible?: boolean;
+    componentName?: string;
+    componentType?: string;
+    properties?: Record<string, unknown>;
+}
+export interface AssetArgs extends HandlerArgs {
+    assetPath?: string;
+    path?: string;
+    directory?: string;
+    directoryPath?: string;
+    sourcePath?: string;
+    destinationPath?: string;
+    newName?: string;
+    name?: string;
+    filter?: string;
+    recursive?: boolean;
+    overwrite?: boolean;
+    classNames?: string[];
+    packagePaths?: string[];
+    parentMaterial?: string;
+    parameters?: Record<string, unknown>;
+    assetPaths?: string[];
+    meshPath?: string;
+}
+export interface BlueprintArgs extends HandlerArgs {
+    blueprintPath?: string;
+    name?: string;
+    savePath?: string;
+    blueprintType?: string;
+    componentType?: string;
+    componentName?: string;
+    attachTo?: string;
+    variableName?: string;
+    eventType?: string;
+    customEventName?: string;
+    nodeType?: string;
+    graphName?: string;
+    x?: number;
+    y?: number;
+    memberName?: string;
+    nodeId?: string;
+    pinName?: string;
+    linkedTo?: string;
+    fromNodeId?: string;
+    fromPin?: string;
+    fromPinName?: string;
+    toNodeId?: string;
+    toPin?: string;
+    toPinName?: string;
+    propertyName?: string;
+    value?: unknown;
+    properties?: Record<string, unknown>;
+    compile?: boolean;
+    save?: boolean;
+    metadata?: Record<string, unknown>;
+}
+export interface EditorArgs extends HandlerArgs {
+    command?: string;
+    filename?: string;
+    resolution?: string;
+    location?: Vector3;
+    rotation?: Rotator;
+    fov?: number;
+    speed?: number;
+    viewMode?: string;
+    width?: number;
+    height?: number;
+    enabled?: boolean;
+    realtime?: boolean;
+    bookmarkName?: string;
+    assetPath?: string;
+    path?: string;
+    category?: string;
+    preferences?: Record<string, unknown>;
+    timeoutMs?: number;
+}
+export interface LevelArgs extends HandlerArgs {
+    levelPath?: string;
+    levelName?: string;
+    levelPaths?: string[];
+    destinationPath?: string;
+    savePath?: string;
+    subLevelPath?: string;
+    parentLevel?: string;
+    parentPath?: string;
+    streamingMethod?: 'Blueprint' | 'AlwaysLoaded';
+    exportPath?: string;
+    packagePath?: string;
+    sourcePath?: string;
+    lightType?: 'Directional' | 'Point' | 'Spot' | 'Rect';
+    name?: string;
+    location?: Vector3;
+    rotation?: Rotator;
+    intensity?: number;
+    color?: number[];
+    quality?: string;
+    streaming?: boolean;
+    shouldBeLoaded?: boolean;
+    shouldBeVisible?: boolean;
+    dataLayerLabel?: string;
+    dataLayerName?: string;
+    dataLayerState?: string;
+    actorPath?: string;
+    min?: number[];
+    max?: number[];
+    origin?: number[];
+    extent?: number[];
+    metadata?: Record<string, unknown>;
+    timeoutMs?: number;
+}
+export interface SequenceArgs extends HandlerArgs {
+    path?: string;
+    name?: string;
+    actorName?: string;
+    actorNames?: string[];
+    spawnable?: boolean;
+    trackName?: string;
+    trackType?: string;
+    property?: string;
+    frame?: number;
+    value?: unknown;
+    speed?: number;
+    lengthInFrames?: number;
+    start?: number;
+    end?: number;
+    startFrame?: number;
+    endFrame?: number;
+    assetPath?: string;
+    muted?: boolean;
+    solo?: boolean;
+    locked?: boolean;
+}
+export interface EffectArgs extends HandlerArgs {
+    location?: Vector3;
+    rotation?: Rotator;
+    scale?: number;
+    preset?: string;
+    systemPath?: string;
+    shape?: string;
+    size?: number;
+    color?: number[];
+    name?: string;
+    emitterName?: string;
+    modulePath?: string;
+    parameterName?: string;
+    parameterType?: string;
+    type?: string;
+    filter?: string;
+}
+export interface EnvironmentArgs extends HandlerArgs {
+    name?: string;
+    landscapeName?: string;
+    location?: Vector3;
+    scale?: Vector3;
+    componentCount?: {
+        x: number;
+        y: number;
+    };
+    sectionSize?: number;
+    sectionsPerComponent?: number;
+    materialPath?: string;
+    foliageType?: string;
+    foliageTypePath?: string;
+    meshPath?: string;
+    density?: number;
+    radius?: number;
+    minScale?: number;
+    maxScale?: number;
+    alignToNormal?: boolean;
+    randomYaw?: boolean;
+    cullDistance?: number;
+    transforms?: Transform[];
+    locations?: Vector3[];
+    bounds?: {
+        min: Vector3;
+        max: Vector3;
+    };
+    seed?: number;
+    heightData?: number[];
+    layerName?: string;
+}
+export interface LightingArgs extends HandlerArgs {
+    lightType?: 'Directional' | 'Point' | 'Spot' | 'Rect';
+    name?: string;
+    location?: Vector3;
+    rotation?: Rotator;
+    intensity?: number;
+    color?: number[];
+    temperature?: number;
+    radius?: number;
+    falloffExponent?: number;
+    innerCone?: number;
+    outerCone?: number;
+    castShadows?: boolean;
+    method?: 'Lightmass' | 'LumenGI' | 'ScreenSpace' | 'None';
+    bounces?: number;
+    quality?: string;
+    enabled?: boolean;
+    density?: number;
+    fogHeight?: number;
+    cubemapPath?: string;
+    sourceType?: 'CapturedScene' | 'SpecifiedCubemap';
+    recapture?: boolean;
+}
+export interface PerformanceArgs extends HandlerArgs {
+    type?: 'CPU' | 'GPU' | 'Memory' | 'RenderThread' | 'GameThread' | 'All';
+    category?: string;
+    duration?: number;
+    outputPath?: string;
+    level?: number;
+    scale?: number;
+    enabled?: boolean;
+    maxFPS?: number;
+    verbose?: boolean;
+    detailed?: boolean;
+}
+export interface InspectArgs extends HandlerArgs {
+    objectPath?: string;
+    name?: string;
+    actorName?: string;
+    componentName?: string;
+    propertyName?: string;
+    propertyPath?: string;
+    value?: unknown;
+    className?: string;
+    classPath?: string;
+    filter?: string;
+    tag?: string;
+    snapshotName?: string;
+    destinationPath?: string;
+    outputPath?: string;
+    format?: string;
+}
+export interface GraphArgs extends HandlerArgs {
+    assetPath?: string;
+    blueprintPath?: string;
+    systemPath?: string;
+    graphName?: string;
+    nodeType?: string;
+    nodeId?: string;
+    x?: number;
+    y?: number;
+    memberName?: string;
+    variableName?: string;
+    eventName?: string;
+    functionName?: string;
+    targetClass?: string;
+    memberClass?: string;
+    componentClass?: string;
+    pinName?: string;
+    linkedTo?: string;
+    fromNodeId?: string;
+    fromPinName?: string;
+    toNodeId?: string;
+    toPinName?: string;
+    parentNodeId?: string;
+    childNodeId?: string;
+    properties?: Record<string, unknown>;
+}
+export interface SystemArgs extends HandlerArgs {
+    command?: string;
+    category?: string;
+    profileType?: string;
+    level?: number;
+    key?: string;
+    value?: string;
+    section?: string;
+    configName?: string;
+    resolution?: string;
+    enabled?: boolean;
+    widgetPath?: string;
+    parentName?: string;
+    childClass?: string;
+    target?: string;
+    platform?: string;
+    configuration?: string;
+    arguments?: string;
+}
+export interface InputArgs extends HandlerArgs {
+    name?: string;
+    path?: string;
+    actionPath?: string;
+    contextPath?: string;
+    key?: string;
+}
+export interface PipelineArgs extends HandlerArgs {
+    target?: string;
+    platform?: string;
+    configuration?: string;
+    arguments?: string;
+    projectPath?: string;
+}
+//# sourceMappingURL=handler-types.d.ts.map

package/dist/types/handler-types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=handler-types.js.map

package/dist/unreal-bridge.d.ts

@@ -26,7 +26,7 @@ export declare class UnrealBridge {
         timeoutMs?: number;
         allowAlternate?: boolean;
     }): Promise<Record<string, any>>;
-    executeConsoleCommand(command: string, _options?: Record<string, never>): Promise<any>;
+    executeConsoleCommand(command: string): Promise<any>;
     executeConsoleCommands(commands: Iterable<string | {
         command: string;
         priority?: number;

package/dist/unreal-bridge.js

@@ -1,6 +1,6 @@
 import { Logger } from './utils/logger.js';
 import { ErrorHandler } from './utils/error-handler.js';
-import { DEFAULT_AUTOMATION_HOST, DEFAULT_AUTOMATION_PORT } from './constants.js';
+import { DEFAULT_AUTOMATION_HOST, DEFAULT_AUTOMATION_PORT, CONSOLE_COMMAND_TIMEOUT_MS, ENGINE_QUERY_TIMEOUT_MS } from './constants.js';
 import { UnrealCommandQueue } from './utils/unreal-command-queue.js';
 import { CommandValidator } from './utils/command-validator.js';
 export class UnrealBridge {
@@ -72,7 +72,9 @@ export class UnrealBridge {
             try {
                 await this.connectPromise;
             }
-            catch { }
+            catch (err) {
+                this.log.debug('Existing connect promise rejected', err instanceof Error ? err.message : String(err));
+            }
             return this.connected;
         }
         this.connectPromise = ErrorHandler.retryWithBackoff(() => {
@@ -337,7 +339,7 @@ export class UnrealBridge {
             };
         }
     }
-    async executeConsoleCommand(command, _options = {}) {
+    async executeConsoleCommand(command) {
         const automationAvailable = Boolean(this.automationBridge && typeof this.automationBridge.sendAutomationRequest === 'function');
         if (!automationAvailable) {
             throw new Error('Automation bridge not connected');
@@ -359,7 +361,7 @@ export class UnrealBridge {
             if (!this.automationBridge || !this.automationBridge.isConnected()) {
                 throw new Error('Automation bridge not connected');
             }
-            const pluginResp = await this.automationBridge.sendAutomationRequest('console_command', { command: cmdTrimmed }, { timeoutMs: 30000 });
+            const pluginResp = await this.automationBridge.sendAutomationRequest('console_command', { command: cmdTrimmed }, { timeoutMs: CONSOLE_COMMAND_TIMEOUT_MS });
             if (pluginResp && pluginResp.success) {
                 return { ...pluginResp, transport: 'automation_bridge' };
             }
@@ -420,7 +422,7 @@ export class UnrealBridge {
         }
         const bridge = this.getAutomationBridge();
         try {
-            const resp = await bridge.sendAutomationRequest('system_control', { action: 'get_engine_version' }, { timeoutMs: 15000 });
+            const resp = await bridge.sendAutomationRequest('system_control', { action: 'get_engine_version' }, { timeoutMs: ENGINE_QUERY_TIMEOUT_MS });
             const raw = resp && typeof resp.result === 'object'
                 ? resp.result
                 : resp?.result ?? resp ?? {};
@@ -456,7 +458,7 @@ export class UnrealBridge {
         }
         const bridge = this.getAutomationBridge();
         try {
-            const resp = await bridge.sendAutomationRequest('system_control', { action: 'get_feature_flags' }, { timeoutMs: 15000 });
+            const resp = await bridge.sendAutomationRequest('system_control', { action: 'get_feature_flags' }, { timeoutMs: ENGINE_QUERY_TIMEOUT_MS });
             const raw = resp && typeof resp.result === 'object'
                 ? resp.result
                 : resp?.result ?? resp ?? {};

package/dist/utils/command-validator.d.ts

@@ -2,6 +2,7 @@ export declare class CommandValidator {
     private static readonly DANGEROUS_COMMANDS;
     private static readonly FORBIDDEN_TOKENS;
     private static readonly INVALID_PATTERNS;
+    private static readonly DANGEROUS_PATTERNS;
     static validate(command: string): void;
     static isLikelyInvalid(command: string): boolean;
     static getPriority(command: string): number;

package/dist/utils/command-validator.js

@@ -21,6 +21,7 @@ export class CommandValidator {
         /^invalid_command/i,
         /^this_is_not_a_valid/i,
     ];
+    static DANGEROUS_PATTERNS = CommandValidator.DANGEROUS_COMMANDS.map(cmd => new RegExp(`(?:^|\\s)${cmd.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}(?:\\s|$)`, 'i'));
     static validate(command) {
         if (!command || typeof command !== 'string') {
             throw new Error('Invalid command: must be a non-empty string');
@@ -36,15 +37,24 @@ export class CommandValidator {
         if (cmdLower === 'py' || cmdLower.startsWith('py ')) {
             throw new Error('Python console commands are blocked from external calls for safety.');
         }
-        if (this.DANGEROUS_COMMANDS.some(dangerous => cmdLower.includes(dangerous))) {
+        if (this.DANGEROUS_PATTERNS.some(pattern => pattern.test(cmdLower))) {
             throw new Error(`Dangerous command blocked: ${command}`);
         }
         if (cmdLower.includes('&&') || cmdLower.includes('||')) {
             throw new Error('Command chaining with && or || is blocked for safety.');
         }
+        if (cmdTrimmed.includes(';')) {
+            throw new Error('Command chaining with ; (semicolon) is blocked for safety.');
+        }
+        if (cmdTrimmed.includes('|')) {
+            throw new Error('Command piping with | is blocked for safety.');
+        }
         if (this.FORBIDDEN_TOKENS.some(token => cmdLower.includes(token))) {
             throw new Error(`Command contains unsafe token and was blocked: ${command}`);
         }
+        if (cmdTrimmed.includes('`')) {
+            throw new Error('Backtick characters are blocked for safety.');
+        }
     }
     static isLikelyInvalid(command) {
         const cmdTrimmed = command.trim();

package/dist/utils/error-handler.js

@@ -142,7 +142,9 @@ export class ErrorHandler {
             if (!isNaN(status) && (status === 429 || (status >= 500 && status < 600)))
                 return true;
         }
-        catch { }
+        catch (err) {
+            log.debug('isRetriable check failed', err instanceof Error ? err.message : String(err));
+        }
         return false;
     }
     static async retryWithBackoff(fn, options = {}) {

package/dist/utils/response-validator.js

@@ -128,8 +128,8 @@ export class ResponseValidator {
     ajv;
     validators = new Map();
     constructor() {
-        const AjvCtor = Ajv?.default ?? Ajv;
-        this.ajv = new AjvCtor({
+        const AjvClass = Ajv.default ?? Ajv.default;
+        this.ajv = new AjvClass({
             allErrors: true,
             verbose: true,
             strict: true

package/dist/utils/safe-json.d.ts

@@ -1,2 +1,2 @@
-export declare function cleanObject(obj: any, maxDepth?: number): any;
+export declare function cleanObject<T = unknown>(obj: T, maxDepth?: number): T;
 //# sourceMappingURL=safe-json.d.ts.map

package/dist/utils/safe-json.js

@@ -1,7 +1,7 @@
 import { Logger } from './logger.js';
+const log = new Logger('safe-json');
 export function cleanObject(obj, maxDepth = 10) {
     const seen = new WeakSet();
-    const logger = new Logger('safe-json');
     function clean(value, depth, path = 'root') {
         if (depth > maxDepth) {
             return '[Max depth reached]';
@@ -23,9 +23,7 @@ export function cleanObject(obj, maxDepth = 10) {
         }
         seen.add(value);
         if (Array.isArray(value)) {
-            const result = value.map((item, index) => clean(item, depth + 1, `${path}[${index}]`));
-            seen.delete(value);
-            return result;
+            return value.map((item, index) => clean(item, depth + 1, `${path}[${index}]`));
         }
         const cleaned = {};
         const keys = Object.keys(value);
@@ -37,10 +35,9 @@ export function cleanObject(obj, maxDepth = 10) {
                 }
             }
             catch (e) {
-                logger.error(`Error cleaning property ${path}.${key}`, e);
+                log.error(`Error cleaning property ${path}.${key}`, e);
             }
         }
-        seen.delete(value);
         return cleaned;
     }
     return clean(obj, 0);

package/dist/utils/unreal-command-queue.js

@@ -112,7 +112,7 @@ export class UnrealCommandQueue {
             if (!this.isProcessing && this.queue.length > 0) {
                 this.processQueue();
             }
-        }, 1000);
+        }, 250);
     }
     stopProcessor() {
         if (this.processorInterval) {

package/dist/utils/validation.js

@@ -1,5 +1,6 @@
 import { toRotTuple, toVec3Tuple } from './normalize.js';
 const MAX_PATH_LENGTH = 260;
+const MAX_ASSET_NAME_LENGTH = 64;
 const INVALID_CHARS = /[@#%$&*()+=\[\]{}<>?|\\;:'"`,~!\s]/g;
 const RESERVED_KEYWORDS = [
     'None', 'null', 'undefined', 'true', 'false',
@@ -23,8 +24,8 @@ export function sanitizeAssetName(name) {
     if (!/^[A-Za-z]/.test(sanitized)) {
         sanitized = `Asset_${sanitized}`;
     }
-    if (sanitized.length > 64) {
-        sanitized = sanitized.slice(0, 64);
+    if (sanitized.length > MAX_ASSET_NAME_LENGTH) {
+        sanitized = sanitized.slice(0, MAX_ASSET_NAME_LENGTH);
     }
     return sanitized;
 }
@@ -37,6 +38,9 @@ export function sanitizePath(path) {
         path = `/${path}`;
     }
     let segments = path.split('/').filter(s => s.length > 0);
+    if (segments.some(s => s === '..' || s === '.')) {
+        throw new Error('Path traversal (..) is not allowed');
+    }
     if (segments.length === 0) {
         return '/Game';
     }

package/docs/handler-mapping.md

@@ -122,6 +122,7 @@ This document maps the TypeScript tool definitions to their corresponding C++ ha
 | `configure_shadows` | `McpAutomationBridge_LightingHandlers.cpp` | `HandleLightingAction` | |
 | `set_exposure` | `McpAutomationBridge_LightingHandlers.cpp` | `HandleLightingAction` | |
 | `set_ambient_occlusion` | `McpAutomationBridge_LightingHandlers.cpp` | `HandleLightingAction` | |
+| `list_light_types` | `McpAutomationBridge_LightingHandlers.cpp` | `HandleLightingAction` | Discovery: Returns all `ALight` subclasses |
 
 ## 7. Performance Manager (`manage_performance`)
 
@@ -148,7 +149,7 @@ This document maps the TypeScript tool definitions to their corresponding C++ ha
 | `create_animation_bp` | `McpAutomationBridge_AnimationHandlers.cpp` | `HandleCreateAnimBlueprint` | |
 | `play_montage` | `McpAutomationBridge_AnimationHandlers.cpp` | `HandlePlayAnimMontage` | |
 | `setup_ragdoll` | `McpAutomationBridge_AnimationHandlers.cpp` | `HandleSetupRagdoll` | |
-| `configure_vehicle` | `McpAutomationBridge_AnimationHandlers.cpp` | `HandleAnimationPhysicsAction` | |
+| `configure_vehicle` | `McpAutomationBridge_AnimationHandlers.cpp` | `HandleAnimationPhysicsAction` | Supports custom vehicle type passthrough |
 
 ## 9. Effects Manager (`manage_effect`)
 
@@ -160,6 +161,8 @@ This document maps the TypeScript tool definitions to their corresponding C++ ha
 | `create_niagara_system` | `McpAutomationBridge_EffectHandlers.cpp` | `HandleCreateNiagaraSystem` | |
 | `create_niagara_emitter` | `McpAutomationBridge_EffectHandlers.cpp` | `HandleCreateNiagaraEmitter` | |
 | `add_niagara_module` | `McpAutomationBridge_NiagaraGraphHandlers.cpp` | `HandleNiagaraGraphAction` | |
+| `list_debug_shapes` | `McpAutomationBridge_EffectHandlers.cpp` | `HandleEffectAction` | Discovery: Returns all debug shape types |
+| `clear_debug_shapes` | `McpAutomationBridge_EffectHandlers.cpp` | `HandleEffectAction` | Clears persistent debug shapes |
 
 ## 10. Environment Builder (`build_environment`)
 
@@ -202,6 +205,8 @@ This document maps the TypeScript tool definitions to their corresponding C++ ha
 | `play` | `McpAutomationBridge_SequenceHandlers.cpp` | `HandleSequenceAction` | |
 | `add_keyframe` | `McpAutomationBridge_SequencerHandlers.cpp` | `HandleAddSequencerKeyframe` | |
 | `add_camera` | `McpAutomationBridge_SequenceHandlers.cpp` | `HandleAddCameraTrack` | |
+| `add_track` | `McpAutomationBridge_SequenceHandlers.cpp` | `HandleSequenceAction` | Dynamic track class resolution |
+| `list_track_types` | `McpAutomationBridge_SequenceHandlers.cpp` | `HandleSequenceAction` | Discovery: Returns all `UMovieSceneTrack` subclasses |
 
 ## 13. Introspection (`inspect`)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unreal-engine-mcp-server",
-  "version": "0.5.2",
+  "version": "0.5.4",
   "mcpName": "io.github.ChiR24/unreal-engine-mcp",
   "description": "A comprehensive Model Context Protocol (MCP) server that enables AI assistants to control Unreal Engine via native automation bridge. Built with TypeScript and designed for game development automation.",
   "type": "module",
@@ -85,7 +85,7 @@
     "dataloader": "^2.2.3",
     "dotenv": "^17.2.3",
     "graphql": "^16.12.0",
-    "graphql-yoga": "^5.17.1",
+    "graphql-yoga": "^5.18.0",
     "ws": "^8.18.3",
     "zod": "^4.2.1"
   },

package/plugins/McpAutomationBridge/Source/McpAutomationBridge/Private/McpAutomationBridge_EnvironmentHandlers.cpp

@@ -1,4 +1,4 @@
-#include "McpAutomationBridgeGlobals.h"
+#include "McpAutomationBridgeGlobals.h"
 #include "McpAutomationBridgeHelpers.h"
 #include "McpAutomationBridgeSubsystem.h"
 
@@ -1024,6 +1024,30 @@ bool UMcpAutomationBridgeSubsystem::HandleConsoleCommandAction(
     return true;
   }
 
+  // 4. Block line breaks
+  if (LowerCommand.Contains(TEXT("\n")) || LowerCommand.Contains(TEXT("\r"))) {
+    SendAutomationResponse(RequestingSocket, RequestId, false,
+                           TEXT("Multi-line commands are blocked for safety"),
+                           nullptr, TEXT("COMMAND_BLOCKED"));
+    return true;
+  }
+
+  // 5. Block semicolon and pipe
+  if (LowerCommand.Contains(TEXT(";")) || LowerCommand.Contains(TEXT("|"))) {
+    SendAutomationResponse(RequestingSocket, RequestId, false,
+                           TEXT("Command chaining with semicolon or pipe is blocked for safety"),
+                           nullptr, TEXT("COMMAND_BLOCKED"));
+    return true;
+  }
+
+  // 6. Block backticks
+  if (LowerCommand.Contains(TEXT("`"))) {
+    SendAutomationResponse(RequestingSocket, RequestId, false,
+                           TEXT("Commands containing backticks are blocked for safety"),
+                           nullptr, TEXT("COMMAND_BLOCKED"));
+    return true;
+  }
+
   // Execute the command
   try {
     UWorld *TargetWorld = nullptr;