build_graph · Unreal MCP: Risk & Policy

WHAT IT DOES

What build_graph does on Unreal

AI agents invoke build_graph to trigger actions in Unreal. What it does depends on the arguments the agent supplies, and its effects often reach beyond the immediate call — builds kicked off, notifications sent, workflows started.

WHY IT NEEDS A POLICY

Why build_graph needs a policy

BuildGraph scripts control compilation, packaging, and deployment workflows in Unreal Engine's build system. An AI agent with access to this tool could execute arbitrary build operations—compiling code, packaging builds, triggering deployments, or modifying artifacts—with unpredictable side effects depending on the provided XML script.

From the tool's definition 'Execute a BuildGraph XML script for CI/CD automation' indicates the tool runs external scripts (BuildGraph XML) that trigger CI/CD pipelines and automated build processes whose effects depend on the script content and configuration.

Attacks that exploit this kind of access

Recommended rule Ready

Verdict

build_graph Rate-limited

build_graph stays usable, but rate-capped — a runaway agent can't fire it dozens of times a minute. Everything else on the server is denied unless you say otherwise.

View as policy code

policy.json

{
  "version": "1",
  "default": "deny",
  "tools": {
    "build_graph": {
      "limits": [
        {
          "counter": "build_graph_rate",
          "window": "minute",
          "max": 10,
          "scope": "grant"
        }
      ]
    }
  }
}

RATE-LIMIT THIS TOOL →

Instant setup, no code required.

PolicyLayer is an MCP gateway: every tool call is checked against your rule before it reaches Unreal, so you can run agents against it safely.

FAQ

Questions about build_graph

What does the build_graph tool do? +

Execute a BuildGraph XML script for CI/CD automation. It is categorised as a Execute tool in the Unreal MCP Server, which means it can trigger actions or run processes. Use rate limits and argument validation.

How do I enforce a policy on build_graph? +

Register the Unreal MCP server in PolicyLayer and add a rule for build_graph: allow, deny, rate-limit, or require approval. Point your MCP client at the PolicyLayer proxy URL and the rule is enforced on every call, before it reaches Unreal. Nothing to install.

What risk level is build_graph? +

build_graph is a Execute tool with high risk. Execute tools should be rate-limited and have argument validation enabled.

Can I rate-limit build_graph? +

Yes. Add a rate_limit block to the build_graph rule in your PolicyLayer policy. For example, setting max: 10 and window: 60 limits the tool to 10 calls per minute. Rate limits are tracked per agent session and reset automatically.

How do I block build_graph completely? +

Set action: deny in the PolicyLayer policy for build_graph. The AI agent will receive a policy violation error and cannot call the tool. You can also include a reason field to explain why the tool is blocked.

What MCP server provides build_graph? +

build_graph is provided by the Unreal MCP server (sam-david/unreal-mcp). PolicyLayer sits as a proxy in front of this server to enforce policies before tool calls reach the server.