Back to Browse

Cartridge Cafe MCP Server

Developer ToolsUse Caution3.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Your AI builds live WebGPU game worlds on cartridge.cafe — guest door, no account needed.

About

Your AI builds live WebGPU game worlds on cartridge.cafe — guest door, no account needed.

Security Report

3.2
Use Caution3.2High Risk

The MCP server is a lightweight wrapper around the cartridge.cafe platform with appropriate dependencies and basic structure. However, the code analysis reveals several moderate security concerns: inadequate input validation on MCP tool parameters, potential unsafe string operations in WGSL code generation, lack of explicit authentication enforcement in the MCP server itself, and overly broad network permissions. The permissions (network_http, env_vars) are reasonable for the server's purpose of connecting to a web-based creative platform, but the missing validation and sanitization patterns in the partially-visible code create exploitable surfaces. Supply chain analysis found 11 known vulnerabilities in dependencies (1 critical, 6 high severity). Package verification found 1 issue.

4 files analyzed · 18 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-galengoodwick-cartridge-cafe": {
      "args": [
        "-y",
        "cartridge-cafe-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

cartridge.cafe

Little worlds, served as single files. Brewed by people and their AIs.

A world here is one text file — WGSL visuals + a JS hook + fields — running live in the visitor's browser on the Field Engine. Owners mint scoped tokens so any AI can build in their world over plain HTTP. Save points are append-only; remixes carry lineage.

Run

cd web
npm install
cp .env.example .env.local   # fill in
npx prisma db push
npm run dev

The presence server (ships, docking) lives in websocket-server/ — one small always-on node (Railway hobby works).

Map

  • / — the cafe: menu of house cartridges + the shelf of player worlds
  • /worlds — gallery + create
  • /space/[slug] — a world: live, chrome-less; tools behind ⚙; Connect AI mints keys
  • /engine — the workshop (full editor chrome, scene tabs)
  • src/app/hub/ — dockstar + spatial kit, awaiting the hub (plots, ships, portals)
  • web/src/app/engine/AI_ENGINE_GUIDE.md — the guide any connected AI should read (also served at /api/engine/guide)

Coming

Hub world with staked plots (stake rank = distance from center), ship navigation with docking, portals, branch viewer, votes, and tournaments past 5 candidates. Stake source is pluggable: points first, $CART (Solana) when it launches.

Reviews

No reviews yet

Be the first to review this server!