miscusi-peek/cheatengine-mcp-bridgeConnect your favorite AI agents directly to Cheat Engine via MCP. Automate reverse engineering, pointer scanning, and memory analysis using natural language.
Let multibillion $ AI datacenters analyze the program memory for you.
Create mods, trainers, security audits, game bots, accelerate RE, or do anything else with any program and game in a fraction of a time.
[!NOTE] Thanks everyone for the stars, much appreciated! <3
Specially a big thank you to all the contributors!!
@libangli218, @lauralex, @iamtyroon, @HachiroSan, @Attacktive
You're staring at gigabytes of memory. Millions of addresses. Thousands of functions. Finding that one pointer, that one structure takes days or weeks of manual work.
What if you could just ask?
"Find the packet decryptor hook."
"Find the OPcode of character coordinates."
"Find the OPcode of health values."
"Find the unique AOB pattern to make my trainer reliable after game updates."
That's exactly what this does.
- Stop clicking through hex dumps and start having conversations with the memory.
| Before (Manual) | After (AI Agent + MCP) |
|---|---|
| Day 1: Find packet address | Minute 1: "Find RX packet decryption hook" |
| Day 2: Trace what writes to it | Minute 3: "Generate unique AOB signature to make it update persistent" |
| Day 3: Find RX hook | Minute 6: "Find movement OPcodes" |
| Day 4: Document structure | Minute 10: "Create python interpreter of hex to plain text" |
| Day 5: Game updates, start over | Done. |
Your AI can now:
[[base+0x10]+0x20]+0x8 → resolved in msflowchart TD
AI[AI Agent: Claude/Cursor/Copilot]
AI -->|MCP Protocol - JSON-RPC over stdio| MCP
MCP[mcp_cheatengine.py - Python MCP Server]
MCP <-->|Named Pipe - Async| PIPE
PIPE["\\.\\pipe\\CE_MCP_Bridge_v99"]
PIPE <--> CE
subgraph CE[Cheat Engine - DBVM Mode]
subgraph LUA[ce_mcp_bridge.lua]
WORKER[Worker Thread - Blocking I/O]
MAIN[Main Thread - GUI + CE API]
WORKER <-->|Sync| MAIN
end
end
MAIN -->|Memory Access| TARGET[Target .exe]
pip install -r MCP_Server/requirements.txt
Or manually:
pip install mcp pywin32
[!NOTE] Native pipe mode is Windows only because it uses Named Pipes (
pywin32). Use TCP relay transport when the MCP server runs outside the Windows environment that hosts Cheat Engine and cannot open the named pipe directly.
File -> Execute Script -> open MCP_Server/ce_mcp_bridge.lua -> Execute.File -> Execute Script, use Table -> Show Cheat Table Lua Script, paste the dofile(...) line below, and execute it:dofile([[C:\path\to\cheatengine-mcp-bridge\MCP_Server\ce_mcp_bridge.lua]])
Look for: [MCP v12.0.0] MCP Server Listening on: CE_MCP_Bridge_v99
Add to your MCP configuration (e.g., mcp_config.json):
{
"servers": {
"cheatengine": {
"command": "python",
"args": ["C:/path/to/MCP_Server/mcp_cheatengine.py"]
}
}
}
Restart the IDE to load the MCP server config.
For Codex, add a TOML server block to ~/.codex/config.toml:
[mcp_servers.cheatengine]
command = "python"
args = ['C:\path\to\cheatengine-mcp-bridge\MCP_Server\mcp_cheatengine.py']
Use single quotes for the Windows path so TOML treats backslashes literally.
The TCP relay lets mcp_cheatengine.py talk to Cheat Engine through a TCP socket instead of opening the Windows named pipe itself. Cheat Engine and the Lua bridge still run on Windows, while the MCP server can run anywhere that can reach the relay: another Windows process, a VM, a container, a Linux host, or a remote machine. This can also be used with WSL without changing the Lua bridge.
MCP_Server/ce_mcp_bridge.lua in Cheat Engine as usual.python C:\path\to\cheatengine-mcp-bridge\MCP_Server\ce_tcp_relay.py --host 127.0.0.1 --port 9876
pywin32, then run/configure the MCP server with TCP transport:python3 -m pip install -r MCP_Server/requirements-tcp.txt
CE_MCP_TRANSPORT=tcp \
CE_MCP_HOST=127.0.0.1 \
CE_MCP_PORT=9876 \
python3 /path/to/cheatengine-mcp-bridge/MCP_Server/mcp_cheatengine.py
For MCP client configs that support environment variables:
{
"servers": {
"cheatengine": {
"command": "python3",
"args": ["/path/to/cheatengine-mcp-bridge/MCP_Server/mcp_cheatengine.py"],
"env": {
"CE_MCP_TRANSPORT": "tcp",
"CE_MCP_HOST": "127.0.0.1",
"CE_MCP_PORT": "9876"
}
}
}
}
Set --host on the relay and CE_MCP_HOST on the MCP server to addresses that match your network setup. Keep the relay bound to trusted interfaces only, because anyone who can reach it can control the Cheat Engine bridge.
Use the ping tool to verify connectivity:
{"success": true, "version": "12.0.0", "message": "CE MCP Bridge Active"}
"What process is attached?"
"Read 16 bytes at the base address"
"Disassemble the entry point"
| Tool | Description |
|---|---|
read_memory, read_integer, read_string | Read any data type |
read_pointer_chain | Follow [[base+0x10]+0x20] paths |
scan_all, aob_scan | Find values and byte patterns |
| Tool | Description |
|---|---|
disassemble, analyze_function | Code analysis |
dissect_structure | Auto-detect fields and types |
get_rtti_classname | Identify C++ object types |
find_references, find_call_references | Cross-references |
| Tool | Description |
|---|---|
set_breakpoint, set_data_breakpoint | Hardware breakpoints |
start_dbvm_watch | Ring -1 invisible tracing |
| Tool | Description |
|---|---|
open_process, get_process_list | Attach to or enumerate running processes |
create_process | Launch a new process under CE's control |
pause_process, unpause_process | Suspend / resume target execution |
| Tool | Description |
|---|---|
allocate_memory, free_memory | Reserve and release memory in the target |
set_memory_protection, full_access | Adjust page protection flags |
| Tool | Description |
|---|---|
inject_dll | Load a DLL into the target process |
execute_code, execute_method | Run shellcode or CE Lua methods remotely |
| Tool | Description |
|---|---|
register_symbol, get_symbol_info | Create and query named symbols |
enable_windows_symbols | Enable PDB symbol resolution |