Cheat Engine MCP Bridge exposes Cheat Engine to an AI coding assistant over the Model Context Protocol (MCP), so memory analysis and reverse-engineering steps can be driven in natural language instead of through the graphical interface. Stated use cases include building mods and trainers, security audits, game bots, and capture-the-flag work.
The design has three parts: a Python MCP server (mcpcheatengine.py, built on FastMCP), a Lua bridge loaded into Cheat Engine (cemcp_bridge.lua) that runs a worker thread for blocking I/O alongside the main GUI thread, and a named pipe between them. Native pipe mode is Windows-only because it uses pywin32; a TCP relay transport lets the MCP server run elsewhere — another process, a virtual machine, a container, a Linux host, or WSL — while Cheat Engine and the Lua bridge stay on Windows.
Roughly 180 tools are exposed, grouped by area: memory reads and scans, pointer-chain resolution, disassembly and function analysis, structure dissection, RTTI class identification, cross-references, hardware breakpoints, DBVM ring -1 tracing, process lifecycle, memory allocation and protection, code injection, symbol management, assembly and C compilation, window and input automation, cheat-table load and save, and kernel-mode DBK/DBVM operations.
Two environment variables control behaviour: CEMCPTIMEOUT sets the per-call timeout in seconds (default 30), and CEMCPALLOWSHELL must be set to 1 before the runcommand and shellexecute tools are available, which the project marks as an arbitrary-code-execution risk. Because anyone who can reach the TCP relay can control the bridge, the relay is meant to be bound to trusted interfaces only. Cheat Engine's "Query memory region routines" setting must be disabled to avoid CLOCKWATCHDOG_TIMEOUT crashes when scanning protected pages. The project states it is for educational and research purposes.
Features
- Memory access: read integers, floats, strings, and pointers, follow chains such as [[base+0x10]+0x20], and run value or byte-pattern scans
- Code analysis: disassemble, analyse functions, dissect structures into fields and types, and find call and data cross-references
- Type identification: resolve C++ object types through RTTI
- Debugging: hardware and data breakpoints, plus DBVM ring -1 tracing
- Process control: attach to or enumerate processes, launch a process under Cheat Engine, and pause or resume execution
- Memory management: allocate and free memory in the target and change page protection
- Code injection: inject a DLL, run shellcode, or execute Cheat Engine Lua methods remotely
- Assembly and compilation: assemble single x86/x64 instructions, compile C into injected shellcode, and generate auto-assembler API hook templates
- Symbols: register and query named symbols and enable PDB symbol resolution
- Automation: locate windows, post WM_* messages, sample pixels, and query or simulate keyboard input
- Cheat tables: load and save .CT files and enumerate address-list entries
- Transports: a Windows named pipe by default, or a TCP relay so the MCP server can run on another host
