Capability locks and security

Capability locks and security

mcpfabric deliberately gives an AI operator-level control of Minecraft: arbitrary commands, world edits, player management, input control and the screen. Read this page before you run it, and especially before you run it on a server other people play on.

What protects the bridge

• It listens on 127.0.0.1 only by default.
• Every request needs the bearer token from config/mcpfabric.config.json. The token is never printed to the log.
• POST /rpc requires Content-Type: application/json (otherwise 415), and any request that carries an Origin header is refused (403), so a web page in your browser cannot talk to it.
• Event streams (GET /events) are capped at 16 at a time.

Treat the token like a password. Do not expose the bridge to other interfaces or forward the port without an authenticated reverse proxy in front of it; whoever holds the token can do anything an operator can.

Capability locks

Four flags in mcpfabric.config.json switch off whole groups. They default to true.

Flag	Switches off
enableWorldWrite	world edits: set_block, fill_blocks, time and weather, entity summon and removal
enableCommands	run_command and the player admin tools (they run operator-level commands)
enablePlayerControl	movement, looking, item use, interaction, inventory changes, navigation, containers, crafting
enableVision	screenshot and describe_scene

get_status and list_capabilities report which groups are available, so the model can see what it is allowed to do. A call into a switched-off group fails with unavailable and a message naming the flag.

Suggested starting points:

Setup	Flags
Playing yourself with an AI companion	all on, bridge on loopback
Shared or public server	enableCommands off unless you trust the AI fully; keep the bridge on loopback
Read-only observer	enableWorldWrite, enableCommands and enablePlayerControl off

Telemetry

The mod sends no usage analytics. See the telemetry policy.

Reporting a vulnerability

Please report privately through GitHub's private vulnerability reporting. Do not open a public issue for anything exploitable. The security policy has the details.