marcfisc

Amazing story and work!

You mentioned Claude not being able to see the games. What I really like for this is the Claude Code Chrome Extension. You can easily make godot build a web version, and then have Claude debug it interactively in the browser.

Sadly, these ideas have been explored before, e.g.: https://simonwillison.net/2022/Sep/17/prompt-injection-more-...

Also, OpenAI has proposed ways of training LLMs to trust tool outputs less than User instructions (https://arxiv.org/pdf/2404.13208). That also doesn't work against these attacks.

Cool work! Thanks for citing our (InvariantLabs) blog posts! I really like the identify-as feature!

We recently launched a similar tool ourselfs, called mcp-scan: https://github.com/invariantlabs-ai/mcp-scan

Author here. Happy to answer any questions you have.