unreal-engine-mcp-server 0.5.20 → 0.5.21

package/dist/tools/handlers/animation-authoring-handlers.js

@@ -1,8 +1,35 @@
 import { executeAutomationRequest } from './common-handlers.js';
 import { normalizeArgs, extractString, extractOptionalString, extractOptionalNumber, extractOptionalBoolean, extractOptionalArray, extractOptionalObject, } from './argument-helper.js';
 import { ResponseFactory } from '../../utils/response-factory.js';
+import { sanitizePath } from '../../utils/path-security.js';
+function validatePath(path, fieldName) {
+    try {
+        const sanitized = sanitizePath(path);
+        return { valid: true, sanitized };
+    }
+    catch (e) {
+        return {
+            valid: false,
+            error: ResponseFactory.error(e instanceof Error ? e.message : `Invalid ${fieldName}: path traversal or illegal characters detected`, 'SECURITY_VIOLATION')
+        };
+    }
+}
 export async function handleAnimationAuthoringTools(action, args, tools) {
     try {
+        const allPathParams = [
+            'path', 'savePath', 'skeletonPath', 'skeletalMeshPath', 'sourceSkeleton', 'targetSkeleton',
+            'assetPath', 'animationPath', 'blueprintPath', 'retargeterPath', 'meshPath', 'montagePath',
+            'animSequencePath', 'animPath', 'animAssetPath', 'animMontagePath', 'blendSpacePath', 'rigPath'
+        ];
+        for (const param of allPathParams) {
+            const value = args[param];
+            if (value && typeof value === 'string') {
+                const pathValidation = validatePath(value, param);
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+            }
+        }
         switch (action) {
             case 'create_animation_sequence': {
                 const params = normalizeArgs(args, [
@@ -40,7 +67,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'frameRate' },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const numFrames = extractOptionalNumber(params, 'numFrames') ?? 30;
                 const frameRate = extractOptionalNumber(params, 'frameRate');
                 const save = extractOptionalBoolean(params, 'save') ?? true;
@@ -62,7 +94,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'boneName', required: true },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const boneName = extractString(params, 'boneName');
                 const save = extractOptionalBoolean(params, 'save') ?? true;
                 const res = (await executeAutomationRequest(tools, 'manage_animation_authoring', {
@@ -86,7 +123,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'scale' },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const boneName = extractString(params, 'boneName');
                 const frame = extractOptionalNumber(params, 'frame') ?? 0;
                 const location = extractOptionalObject(params, 'location');
@@ -117,7 +159,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'createIfMissing', default: true },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const curveName = extractString(params, 'curveName');
                 const frame = extractOptionalNumber(params, 'frame') ?? 0;
                 const value = extractOptionalNumber(params, 'value') ?? 0;
@@ -146,7 +193,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'notifyName' },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const notifyClass = extractString(params, 'notifyClass');
                 const frame = extractOptionalNumber(params, 'frame') ?? 0;
                 const trackIndex = extractOptionalNumber(params, 'trackIndex') ?? 0;
@@ -176,7 +228,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'notifyName' },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const notifyClass = extractString(params, 'notifyClass');
                 const startFrame = extractOptionalNumber(params, 'startFrame') ?? 0;
                 const endFrame = extractOptionalNumber(params, 'endFrame') ?? 10;
@@ -205,7 +262,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'frame', required: true },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const markerName = extractString(params, 'markerName');
                 const frame = extractOptionalNumber(params, 'frame') ?? 0;
                 const save = extractOptionalBoolean(params, 'save') ?? true;
@@ -229,7 +291,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'forceRootLock', default: false },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const enableRootMotion = extractOptionalBoolean(params, 'enableRootMotion') ?? true;
                 const rootMotionRootLock = extractOptionalString(params, 'rootMotionRootLock') ?? 'RefPose';
                 const forceRootLock = extractOptionalBoolean(params, 'forceRootLock') ?? false;
@@ -256,7 +323,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'basePoseFrame', default: 0 },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const additiveAnimType = extractOptionalString(params, 'additiveAnimType') ?? 'NoAdditive';
                 const basePoseType = extractOptionalString(params, 'basePoseType') ?? 'RefPose';
                 const basePoseAnimation = extractOptionalString(params, 'basePoseAnimation');
@@ -309,7 +381,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'startTime', required: true },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const sectionName = extractString(params, 'sectionName');
                 const startTime = extractOptionalNumber(params, 'startTime') ?? 0;
                 const save = extractOptionalBoolean(params, 'save') ?? true;
@@ -333,8 +410,18 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'startTime', default: 0 },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
-                const animationPath = extractString(params, 'animationPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidationAsset = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidationAsset.valid) {
+                    return pathValidationAsset.error;
+                }
+                const assetPath = pathValidationAsset.sanitized;
+                const rawAnimationPath = extractString(params, 'animationPath');
+                const pathValidationAnim = validatePath(rawAnimationPath, 'animationPath');
+                if (!pathValidationAnim.valid) {
+                    return pathValidationAnim.error;
+                }
+                const animationPath = pathValidationAnim.sanitized;
                 const slotName = extractOptionalString(params, 'slotName') ?? 'DefaultSlot';
                 const startTime = extractOptionalNumber(params, 'startTime') ?? 0;
                 const save = extractOptionalBoolean(params, 'save') ?? true;
@@ -359,7 +446,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'length' },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const sectionName = extractString(params, 'sectionName');
                 const startTime = extractOptionalNumber(params, 'startTime');
                 const length = extractOptionalNumber(params, 'length');
@@ -386,7 +478,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'notifyName' },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const notifyClass = extractString(params, 'notifyClass');
                 const time = extractOptionalNumber(params, 'time') ?? 0;
                 const trackIndex = extractOptionalNumber(params, 'trackIndex') ?? 0;
@@ -413,7 +510,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'blendOption', default: 'Linear' },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const blendTime = extractOptionalNumber(params, 'blendTime') ?? 0.25;
                 const blendOption = extractOptionalString(params, 'blendOption') ?? 'Linear';
                 const save = extractOptionalBoolean(params, 'save') ?? true;
@@ -436,7 +538,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'blendOption', default: 'Linear' },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const blendTime = extractOptionalNumber(params, 'blendTime') ?? 0.25;
                 const blendOption = extractOptionalString(params, 'blendOption') ?? 'Linear';
                 const save = extractOptionalBoolean(params, 'save') ?? true;
@@ -459,7 +566,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'toSection', required: true },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const fromSection = extractString(params, 'fromSection');
                 const toSection = extractString(params, 'toSection');
                 const save = extractOptionalBoolean(params, 'save') ?? true;
@@ -555,8 +667,18 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'sampleValue', required: true },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
-                const animationPath = extractString(params, 'animationPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidationAsset = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidationAsset.valid) {
+                    return pathValidationAsset.error;
+                }
+                const assetPath = pathValidationAsset.sanitized;
+                const rawAnimationPath = extractString(params, 'animationPath');
+                const pathValidationAnim = validatePath(rawAnimationPath, 'animationPath');
+                if (!pathValidationAnim.valid) {
+                    return pathValidationAnim.error;
+                }
+                const animationPath = pathValidationAnim.sanitized;
                 const sampleValue = params['sampleValue'];
                 const save = extractOptionalBoolean(params, 'save') ?? true;
                 const res = (await executeAutomationRequest(tools, 'manage_animation_authoring', {
@@ -581,7 +703,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'gridDivisions' },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const axis = extractString(params, 'axis');
                 const axisName = extractOptionalString(params, 'axisName');
                 const minValue = extractOptionalNumber(params, 'minValue');
@@ -610,7 +737,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'targetWeightInterpolationSpeed', default: 5.0 },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const interpolationType = extractOptionalString(params, 'interpolationType') ?? 'Lerp';
                 const targetWeightInterpolationSpeed = extractOptionalNumber(params, 'targetWeightInterpolationSpeed') ?? 5.0;
                 const save = extractOptionalBoolean(params, 'save') ?? true;
@@ -657,8 +789,18 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'pitch', required: true },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
-                const animationPath = extractString(params, 'animationPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidationAsset = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidationAsset.valid) {
+                    return pathValidationAsset.error;
+                }
+                const assetPath = pathValidationAsset.sanitized;
+                const rawAnimationPath = extractString(params, 'animationPath');
+                const pathValidationAnim = validatePath(rawAnimationPath, 'animationPath');
+                if (!pathValidationAnim.valid) {
+                    return pathValidationAnim.error;
+                }
+                const animationPath = pathValidationAnim.sanitized;
                 const yaw = extractOptionalNumber(params, 'yaw') ?? 0;
                 const pitch = extractOptionalNumber(params, 'pitch') ?? 0;
                 const save = extractOptionalBoolean(params, 'save') ?? true;
@@ -675,12 +817,14 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                 }
                 return ResponseFactory.success(res, res.message ?? 'Aim offset sample added');
             }
-            case 'create_anim_blueprint': {
+            case 'create_anim_blueprint':
+            case 'create_animation_bp':
+            case 'create_animation_blueprint': {
                 const params = normalizeArgs(args, [
                     { key: 'name', required: true },
-                    { key: 'path', aliases: ['directory'], default: '/Game/Blueprints' },
+                    { key: 'path', aliases: ['directory', 'savePath'], default: '/Game/Blueprints' },
                     { key: 'skeletonPath', required: true },
-                    { key: 'parentClass', default: 'AnimInstance' },
+                    { key: 'parentClass', aliases: ['parent'], default: 'AnimInstance' },
                     { key: 'save', default: true },
                 ]);
                 const name = extractString(params, 'name');
@@ -707,7 +851,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'stateMachineName', required: true },
                     { key: 'save', default: true },
                 ]);
-                const blueprintPath = extractString(params, 'blueprintPath');
+                const rawBlueprintPath = extractString(params, 'blueprintPath');
+                const pathValidation = validatePath(rawBlueprintPath, 'blueprintPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const blueprintPath = pathValidation.sanitized;
                 const stateMachineName = extractString(params, 'stateMachineName');
                 const save = extractOptionalBoolean(params, 'save') ?? true;
                 const res = (await executeAutomationRequest(tools, 'manage_animation_authoring', {
@@ -730,10 +879,19 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'isEntryState', default: false },
                     { key: 'save', default: true },
                 ]);
-                const blueprintPath = extractString(params, 'blueprintPath');
+                const rawBlueprintPath = extractString(params, 'blueprintPath');
+                const pathValidation = validatePath(rawBlueprintPath, 'blueprintPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const blueprintPath = pathValidation.sanitized;
                 const stateMachineName = extractString(params, 'stateMachineName');
                 const stateName = extractString(params, 'stateName');
-                const animationPath = extractOptionalString(params, 'animationPath');
+                const rawAnimationPath = extractOptionalString(params, 'animationPath');
+                const animationPath = rawAnimationPath ? validatePath(rawAnimationPath, 'animationPath') : undefined;
+                if (animationPath && !animationPath.valid) {
+                    return animationPath.error;
+                }
                 const isEntryState = extractOptionalBoolean(params, 'isEntryState') ?? false;
                 const save = extractOptionalBoolean(params, 'save') ?? true;
                 const res = (await executeAutomationRequest(tools, 'manage_animation_authoring', {
@@ -741,7 +899,7 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     blueprintPath,
                     stateMachineName,
                     stateName,
-                    animationPath,
+                    animationPath: animationPath?.sanitized,
                     isEntryState,
                     save,
                 }));
@@ -758,7 +916,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'toState', required: true },
                     { key: 'save', default: true },
                 ]);
-                const blueprintPath = extractString(params, 'blueprintPath');
+                const rawBlueprintPath = extractString(params, 'blueprintPath');
+                const pathValidation = validatePath(rawBlueprintPath, 'blueprintPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const blueprintPath = pathValidation.sanitized;
                 const stateMachineName = extractString(params, 'stateMachineName');
                 const fromState = extractString(params, 'fromState');
                 const toState = extractString(params, 'toState');
@@ -788,7 +951,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'automaticTriggerTime' },
                     { key: 'save', default: true },
                 ]);
-                const blueprintPath = extractString(params, 'blueprintPath');
+                const rawBlueprintPath = extractString(params, 'blueprintPath');
+                const pathValidation = validatePath(rawBlueprintPath, 'blueprintPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const blueprintPath = pathValidation.sanitized;
                 const stateMachineName = extractString(params, 'stateMachineName');
                 const fromState = extractString(params, 'fromState');
                 const toState = extractString(params, 'toState');
@@ -823,7 +991,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'y', default: 0 },
                     { key: 'save', default: true },
                 ]);
-                const blueprintPath = extractString(params, 'blueprintPath');
+                const rawBlueprintPath = extractString(params, 'blueprintPath');
+                const pathValidation = validatePath(rawBlueprintPath, 'blueprintPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const blueprintPath = pathValidation.sanitized;
                 const blendType = extractString(params, 'blendType');
                 const nodeName = extractOptionalString(params, 'nodeName');
                 const x = extractOptionalNumber(params, 'x') ?? 0;
@@ -849,7 +1022,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'cacheName', required: true },
                     { key: 'save', default: true },
                 ]);
-                const blueprintPath = extractString(params, 'blueprintPath');
+                const rawBlueprintPath = extractString(params, 'blueprintPath');
+                const pathValidation = validatePath(rawBlueprintPath, 'blueprintPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const blueprintPath = pathValidation.sanitized;
                 const cacheName = extractString(params, 'cacheName');
                 const save = extractOptionalBoolean(params, 'save') ?? true;
                 const res = (await executeAutomationRequest(tools, 'manage_animation_authoring', {
@@ -869,7 +1047,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'slotName', required: true },
                     { key: 'save', default: true },
                 ]);
-                const blueprintPath = extractString(params, 'blueprintPath');
+                const rawBlueprintPath = extractString(params, 'blueprintPath');
+                const pathValidation = validatePath(rawBlueprintPath, 'blueprintPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const blueprintPath = pathValidation.sanitized;
                 const slotName = extractString(params, 'slotName');
                 const save = extractOptionalBoolean(params, 'save') ?? true;
                 const res = (await executeAutomationRequest(tools, 'manage_animation_authoring', {
@@ -889,7 +1072,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'layerSetup' },
                     { key: 'save', default: true },
                 ]);
-                const blueprintPath = extractString(params, 'blueprintPath');
+                const rawBlueprintPath = extractString(params, 'blueprintPath');
+                const pathValidation = validatePath(rawBlueprintPath, 'blueprintPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const blueprintPath = pathValidation.sanitized;
                 const layerSetup = extractOptionalArray(params, 'layerSetup');
                 const save = extractOptionalBoolean(params, 'save') ?? true;
                 const res = (await executeAutomationRequest(tools, 'manage_animation_authoring', {
@@ -911,7 +1099,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'value', required: true },
                     { key: 'save', default: true },
                 ]);
-                const blueprintPath = extractString(params, 'blueprintPath');
+                const rawBlueprintPath = extractString(params, 'blueprintPath');
+                const pathValidation = validatePath(rawBlueprintPath, 'blueprintPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const blueprintPath = pathValidation.sanitized;
                 const nodeName = extractString(params, 'nodeName');
                 const propertyName = extractString(params, 'propertyName');
                 const value = params['value'];
@@ -961,7 +1154,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'parentControl' },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const controlName = extractString(params, 'controlName');
                 const controlType = extractOptionalString(params, 'controlType') ?? 'Transform';
                 const parentBone = extractOptionalString(params, 'parentBone');
@@ -989,7 +1187,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'settings' },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const unitType = extractString(params, 'unitType');
                 const unitName = extractOptionalString(params, 'unitName');
                 const settings = extractOptionalObject(params, 'settings');
@@ -1016,7 +1219,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'targetPin', required: true },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const sourceElement = extractString(params, 'sourceElement');
                 const sourcePin = extractString(params, 'sourcePin');
                 const targetElement = extractString(params, 'targetElement');
@@ -1091,7 +1299,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'goal' },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const chainName = extractString(params, 'chainName');
                 const startBone = extractString(params, 'startBone');
                 const endBone = extractString(params, 'endBone');
@@ -1144,7 +1357,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                     { key: 'targetChain', required: true },
                     { key: 'save', default: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const sourceChain = extractString(params, 'sourceChain');
                 const targetChain = extractString(params, 'targetChain');
                 const save = extractOptionalBoolean(params, 'save') ?? true;
@@ -1164,7 +1382,12 @@ export async function handleAnimationAuthoringTools(action, args, tools) {
                 const params = normalizeArgs(args, [
                     { key: 'assetPath', required: true },
                 ]);
-                const assetPath = extractString(params, 'assetPath');
+                const rawAssetPath = extractString(params, 'assetPath');
+                const pathValidation = validatePath(rawAssetPath, 'assetPath');
+                if (!pathValidation.valid) {
+                    return pathValidation.error;
+                }
+                const assetPath = pathValidation.sanitized;
                 const res = (await executeAutomationRequest(tools, 'manage_animation_authoring', {
                     subAction: 'get_animation_info',
                     assetPath,