CE_MCP_Demo_2.mp4

Cheat Engine MCP Bridge

Let multibillion $ AI datacenters analyze the program memory for you.

Create mods, trainers, security audits, game bots, accelerate RE, or do anything else with any program and game in a fraction of a time.

Note

Thanks everyone for the stars, much appreciated! <3

---

The Problem

You're staring at gigabytes of memory. Millions of addresses. Thousands of functions. Finding that one pointer, that one structure takes days or weeks of manual work.

What if you could just ask?

"Find the packet decryptor hook."
"Find the OPcode of character coordinates."
"Find the OPcode of health values."
"Find the unique AOB pattern to make my trainer reliable after game updates."

That's exactly what this does.

- Stop clicking through hex dumps and start having conversations with the memory.

---

What You Get:

Before (Manual)	After (AI Agent + MCP)
Day 1: Find packet address	Minute 1: "Find RX packet decryption hook"
Day 2: Trace what writes to it	Minute 3: "Generate unique AOB signature to make it update persistent"
Day 3: Find RX hook	Minute 6: "Find movement OPcodes"
Day 4: Document structure	Minute 10: "Create python interpreter of hex to plain text"
Day 5: Game updates, start over	Done.

Your AI can now:

• Read any memory instantly (integers, floats, strings, pointers)
• Follow pointer chains: [[base+0x10]+0x20]+0x8 → resolved in ms
• Auto-analyze structures with field types and values
• Identify C++ objects via RTTI: "This is a CPlayer object"
• Disassemble and analyze functions
• Debug invisibly with hardware breakpoints + Ring -1 hypervisor
• And much more!

---

How It Works

flowchart TD
    AI[AI Agent: Claude/Cursor/Copilot]
    
    AI -->|MCP Protocol - JSON-RPC over stdio| MCP
    
    MCP[mcp_cheatengine.py - Python MCP Server]
    
    MCP <-->|Named Pipe - Async| PIPE
    
    PIPE["\\.\\pipe\\CE_MCP_Bridge_v99"]
    
    PIPE <--> CE
    
    subgraph CE[Cheat Engine - DBVM Mode]
        subgraph LUA[ce_mcp_bridge.lua]
            WORKER[Worker Thread - Blocking I/O]
            MAIN[Main Thread - GUI + CE API]
            WORKER <-->|Sync| MAIN
        end
    end
    
    MAIN -->|Memory Access| TARGET[Target .exe]

Loading

---

Installation

pip install -r MCP_Server/requirements.txt

Or manually:

pip install mcp pywin32

Note

Windows only - Uses Named Pipes (pywin32)

For local mock/unit tests that do not require Cheat Engine:

pip install -r MCP_Server/requirements-dev.txt
python -m pytest -q tests

For a deterministic Windows target process, use the fixture in fixtures/windows_memory_fixture/.

---

Quick Start

1. Load Bridge in Cheat Engine

1. Enable DBVM in CheatEngine.
2. File → Execute Script → Open ce_mcp_bridge.lua → Execute

Look for: [MCP v11.4.1] MCP Server Listening on: CE_MCP_Bridge_v99

2. Configure MCP Client

Add to your MCP configuration (e.g., mcp_config.json). See examples/mcp_config.example.json for templates.

{
  "mcpServers": {
    "cheatengine": {
      "command": "python",
      "args": ["C:/path/to/MCP_Server/mcp_cheatengine.py"]
    }
  }
}

Restart the IDE to load the MCP server config.

3. Verify Connection

Use the ping tool to verify connectivity:

{"success": true, "version": "11.4.1", "process_id": 12345, "message": "CE MCP Bridge v11.4.1 alive"}

4. Start Asking Questions

"What process is attached?"
"Read 16 bytes at the base address"
"Disassemble the entry point"

---

51 MCP Tools Available

Process

Tool	Description
list_processes, attach_process	Enumerate visible processes and attach by PID or name
get_bridge_status, get_process_info	Inspect bridge state and current target details

Memory

Tool	Description
read_memory, read_integer, read_string	Read any data type
read_pointer_chain	Follow [[base+0x10]+0x20] paths
write_memory_with_backup, restore_memory	Patch bytes with rollback
list_backups, cleanup_all	Inspect backups and clear active bridge resources
scan_all, next_scan, cancel_scan, aob_scan	Find values and byte patterns

Analysis

Tool	Description
disassemble, analyze_function	Code analysis
dissect_structure	Auto-detect fields and types
get_rtti_classname	Identify C++ object types
find_references, find_call_references	Cross-references

Debugging

Tool	Description
set_breakpoint, set_data_breakpoint	Hardware breakpoints
start_dbvm_watch	Ring -1 invisible tracing

And many more at AI_Context/MCP_Bridge_Command_Reference.md

---

Critical Configuration

BSOD Prevention

Caution

You MUST disable: Cheat Engine → Settings → Extra → "Query memory region routines"

Enabled: Causes CLOCK_WATCHDOG_TIMEOUT BSODs due to conflicts with DBVM/Anti-Cheat when scanning protected pages.

Local Pipe Access

The bridge exposes memory reads/writes, breakpoints, AutoAssembler, and Lua execution to local MCP clients. Set the same CE_MCP_AUTH_TOKEN environment variable for Cheat Engine and the Python MCP server to require a shared token on the named-pipe protocol.

Safety Mode

The bridge starts in read-only safety mode. Tools that attach to a process, write memory, clear bridge state, cancel scans, set/remove breakpoints, run AutoAssembler/Lua, or use DBVM tracing are blocked unless CE_MCP_ENABLE_DANGEROUS=1 is set for both the Python MCP server and the Cheat Engine Lua runtime.

---

Example Workflows

Finding a value:

You: "Scan for gold: 15000"  →  AI finds 47 results
You: "Gold changed to 15100"  →  AI filters to 3 addresses
You: "What writes to the first one?"  →  AI sets hardware BP
You: "Disassemble that function"  →  Full AddGold logic revealed

Understanding a structure:

You: "What's at [[game.exe+0x1234]+0x10]?"
AI: "RTTI: CPlayerInventory"
AI: "0x00=vtable, 0x08=itemCount(int), 0x10=itemArray(ptr)..."

---

Project Structure

MCP_Server/
├── mcp_cheatengine.py      # Python MCP Server (FastMCP)
├── ce_mcp_bridge.lua   # Cheat Engine Lua Bridge
└── test_mcp.py # Test Suite

AI_Context/
├── MCP_Bridge_Command_Reference.md   # MCP Commands reference
├── CE_LUA_Documentation.md   # Full CheatEngine 7.6 official documentation
└── AI_Guide_MCP_Server_Implementation.md  # Full technical documentation for AI agent

fixtures/
└── windows_memory_fixture/
    ├── fixture.py   # Tiny ctypes target process for Windows/Cheat Engine checks
    └── README.md    # Manual attach and validation steps

---

Testing

Linux-safe mock tests:

python -m py_compile MCP_Server/mcp_cheatengine.py MCP_Server/test_mcp.py fixtures/windows_memory_fixture/fixture.py
python -m pytest -q tests

Windows integration tests require Python 3.10+, pywin32, Cheat Engine with ce_mcp_bridge.lua loaded, and an attached target process. The repo includes a small fixture target for this:

py -3 fixtures\windows_memory_fixture\fixture.py

Attach Cheat Engine to the printed fixture PID, execute MCP_Server\ce_mcp_bridge.lua, then run:

py -3 MCP_Server\test_mcp.py

By default the integration suite skips high-impact tests that clear breakpoints, run AutoAssembler, or start DBVM watches. Use explicit flags when needed:

py -3 MCP_Server\test_mcp.py --skip-scan
$env:CE_MCP_ENABLE_DANGEROUS = "1"
py -3 MCP_Server\test_mcp.py --dangerous

DBVM and signature-generation tests may be skipped depending on Cheat Engine configuration and target process state.

A manual workflow, .github/workflows/windows-ce-preflight.yml, is available for self-hosted Windows runners. It checks Python syntax, verifies the fixture starts, confirms the configured Cheat Engine executable exists, and can optionally run MCP_Server/test_mcp.py --skip-scan after a human attaches Cheat Engine and loads the Lua bridge in an interactive desktop session.

---

The Bottom Line

You no longer need to be an expert. Just ask the right questions.

⚠️ EDUCATIONAL DISCLAIMER

This code is for educational and research purposes only. It's created to show the capabilities of the Model Context Protocol (MCP) and LLM-based debugging. I do not condone the use of these tools for malicious hacking, cheating in multiplayer games, or violating Terms of Service. This is a demonstration of software engineering automation.