BASIC-BIT/vrchat-mcp
github TypeScript analyzed 714da3a
MCP server for VRChat friends, worlds, groups, events, notifications, and VRCX history.
BASIC-BIT/vrchat-mcp is an MCP server distributed on github, maintained by BASIC-BIT, tracked here since June 2026. It has shipped 16 releases and exposes 18 tools. Tools include vrchat_delete, vrchat_read, vrchat_write, vrchat_boop, vrchat_events_upcoming, vrchat_friend_details, and 12 more. Its composite risk grade is A — an inferred review prompt computed from observed signals, not a verdict.
what we found
Reading the source raised one review prompt — exfiltration combo — each a pattern worth a human look rather than a finding of fault.
Since the previous scan on 2026-10-14: 2 tools added.
full security breakdown →tools
-
vrchat_deletefor available DELETE operations; pass operationId, params, and optional JSON payloads under body. -
vrchat_readfor available GET operations; pass operationId plus path/query/header/cookie values under params. -
vrchat_writefor available POST/PUT/PATCH operations; pass operationId, params, and JSON payloads under body. -
vrchat_boop -
vrchat_events_upcoming -
vrchat_friend_details -
vrchat_friend_request -
vrchat_friends_overview -
vrchat_friends_search -
vrchat_gallery_image_upload -
vrchat_group_invite -
vrchat_group_profile -
vrchat_instance_link_event -
vrchat_invite -
vrchat_me -
vrchat_notifications_recent -
vrchat_worlds_search -
vrcx_instances_recent
release cadence · 90d
2026-07-19 2026-09-01 now
recent releases
| version | date | src |
|---|---|---|
| v0.1.15 | 2026-09-11 | github |
| v0.1.14 | 2026-09-08 | github |
| v0.1.13 | 2026-09-02 | github |
| v0.1.12 | 2026-09-01 | github |
| v0.1.11 | 2026-09-01 | github |
| v0.1.10 | 2026-08-03 | github |
| v0.1.9 | 2026-07-31 | github |
| v0.1.8 | 2026-07-24 | github |
| v0.1.7 | 2026-06-13 | github |
| v0.1.6 | 2026-06-03 | github |