What is VRChat MCP?
VRChat MCP, from the GitHub user sawa-zen, lets an MCP client act on a VRChat account through the community-documented VRChat API. Its tools list friends and notifications, search avatars, worlds and groups, and take actions: send friend requests, switch avatar, create instances, join groups, add favourites and request invites.
It is MIT-licensed TypeScript published on npm as vrchat-mcp, with READMEs in English, Japanese and Korean. It has about 71 GitHub stars and 33 npm downloads in the week to 5 November 2026. The last npm release, 0.15.0, came out on 29 April 2025; the only commits since are dependency bumps, the latest on 3 February 2026.
How to install VRChat MCP
npx vrchat-mcpIs VRChat MCP worth it?
VRChat MCP is a small, direct wrapper. The README lists 17 tools across friends, avatars, worlds, instances, groups, favourites, invites and notifications, each a call into the community vrchat SDK that returns the raw JSON. That is enough for questions such as which friends are online, and for simple actions. Several tools change your account rather than read it, so an agent mistake becomes a friend request sent, an avatar switched or a group joined in your name.
Authentication is the main risk. The README has you sign in once with a helper command and paste the resulting auth cookie into VRCHAT_AUTH_TOKEN, and warns that it has a very long lifetime; anyone who reads your MCP config can use your account until it expires. The code also accepts VRCHAT_PASSWORD with VRCHAT_TOTP_SECRET, which puts both your password and your two-factor secret in one place and cancels the point of two-factor sign-in.
The platform risk is just as real. VRChat's Creator Guidelines say it does not document its API for public use, that endpoints change without notice, and that disruptive applications will be moderated along with their users. They ask for rate limiting and back-off on errors, including HTTP 429; in our reading of the source there is no retry or back-off logic, and failures come back as ordinary text rather than flagged errors. The server does name itself in the User-Agent header, as vrc-mcp/0.15.0 followed by your username, though the guidelines also ask for contact details. With no feature work since April 2025, a breaking API change would likely go unfixed for a while.
Where it earns its place
A VRChat regular with a large friends list
See which friends are online and where before putting on the headset
Ask the assistant to list online friends and their instances, then request an invite to one. Free; the auth token in the config is the cost in risk.
A VRChat event organiser
Find and bookmark candidate worlds for a weekly meetup
Search worlds by keyword, review the JSON the server returns, and add the shortlist to favourites. Keep the number of calls low, as VRChat asks for rate limiting.
Before you commit
- Setup
- Run npx vrchat-auth-token-checker to sign in and get an auth token, then add npx vrchat-mcp to Claude Desktop or another client with VRCHAT_USERNAME and VRCHAT_AUTH_TOKEN set. A few minutes.
- Integrations
- VRChat's community-documented API through the vrchat npm SDK. Stdio only.
- Data and privacy
- Runs locally and talks to VRChat's servers with your session cookie. Friends lists, notifications and invite messages go to your model provider. The auth token is long-lived; treat the config file like a password.
- Cost at scale
- Free under MIT; there is no paid tier or hosted version.
- Limits
- Unofficial API that can change without notice; no retry or back-off; errors returned as plain text. Last npm release 0.15.0 on 29 April 2025.
What’s good
- 17 tools covering friends, worlds, avatars, groups and invites
- One-line npx install
- Sends a named, versioned User-Agent header
- READMEs in English, Japanese and Korean
What’s not
- Long-lived auth token stored in the MCP config
- Optional password and TOTP secret in environment variables
- Built on an unofficial API VRChat does not support
- No release since 0.15.0 in April 2025; no rate limiting
Best for
VRChat regulars comfortable with the account risk who want to ask an assistant who is online, find worlds or manage favourites in plain language.
VRChat MCP: common questions
- Is VRChat MCP worth it?
- It works as a thin bridge to your VRChat account, but it is barely maintained, rests on an API VRChat does not support, and needs a session token that is as good as your password. We rate it 3.0 out of 5.
- How much does VRChat MCP cost?
- Free and open source (MIT). Needs a VRChat account.
- What are the downsides of VRChat MCP?
- Long-lived auth token stored in the MCP config; optional password and TOTP secret in environment variables; built on an unofficial API VRChat does not support; no release since 0.15.0 in April 2025; no rate limiting.
- Who is VRChat MCP best for?
- VRChat regulars comfortable with the account risk who want to ask an assistant who is online, find worlds or manage favourites in plain language.
- How much does VRChat MCP cost for a team or in production?
- Free under MIT; there is no paid tier or hosted version.
- Is VRChat MCP safe for company data?
- Runs locally and talks to VRChat's servers with your session cookie. Friends lists, notifications and invite messages go to your model provider. The auth token is long-lived; treat the config file like a password.
Answers checked Nov 6, 2026.