Is Cosindra safe? Windows Defender and SmartScreen warnings explained
Yes, when you download it from cosindra.ai. Windows warns because the installer is not code-signed yet, and a full Microsoft Defender scan of every file in the 1.3.3 installer reports no threat.
Updated October 28, 2026
What the desktop app does on your machine
The desktop app is an Electron app plus a local MCP server, resources/unreal-mcp-server.exe. The server runs on your machine and talks to the CosindraMCP plugin inside your Unreal Editor.
All tool executions (spawning actors, modifying blueprints, etc.) happen locally within your Unreal Engine editor. No project files or source code are transmitted to our servers.
The full picture of what is sent where is in the privacy policy.
Why Windows warns
SmartScreen: "Windows protected your PC"
The Windows installer is not code-signed yet, so SmartScreen shows its notice for a new publisher. Choose More info, then Run anyway.
Microsoft Defender: "Trojan:Win32/Gracing.I"
Some Windows 11 machines show this for the bundled server, unreal-mcp-server.exe. A full Microsoft Defender scan with signatures 1.461.231.0 (October 27, 2026) of every file in the 1.3.3 installer (the setup file, Cosindra.exe, unreal-mcp-server.exe and all DLLs) reports no threat. The warning is most likely a reputation check that Microsoft's cloud applies to new, unsigned files.
macOS: no warning
The macOS build is signed with an Apple Developer ID and notarized by Apple.
Check your installer
Download Cosindra only from cosindra.ai. The SHA-256 checksum proves the file you have is exactly the one we published.
- File
- Cosindra-1.3.3-Setup.exe
- Version
- 1.3.3
- Size
- 150,300,750 bytes
- SHA-256
419e48d81e5ebbfe244808602605c10e80b2931d33f37d8c03ffa247770f6331
- Download the installer from cosindra.ai only.
- Open PowerShell in the folder you saved it to and run the command below.
- Compare the Hash it prints with the SHA-256 above. Upper or lower case does not matter; every character must match.
Get-FileHash .\Cosindra-1.3.3-Setup.exe -Algorithm SHA256If Defender quarantined it
You can leave it there. RigMaster, MotionSmith, WorldWeaver, MaterialForge and BlueprintStudio run in the browser without the desktop app; only the Unreal Editor integration needs it.
Restore it only if you downloaded it from cosindra.ai and the checksum matches: open Windows Security, go to Protection history, open the Cosindra entry and choose Restore.
What we are doing
- A code-signing certificate is being obtained. Signed Windows installers will ship as soon as possible.
- We have reported the Defender detection to Microsoft as a false positive.
Questions
Is Cosindra a virus?
No. A full Microsoft Defender scan with signatures 1.461.231.0 of every file in the 1.3.3 installer reports no threat. Windows warns because the installer is not code-signed yet.
Why does Microsoft Defender show Trojan:Win32/Gracing.I for Cosindra?
Some Windows 11 machines show Trojan:Win32/Gracing.I for the bundled local server, unreal-mcp-server.exe. It is most likely a reputation check that Microsoft's cloud applies to new, unsigned files; a full Defender scan of every file in the 1.3.3 installer reports no threat. We have reported it to Microsoft as a false positive.
Why does SmartScreen say "Windows protected your PC"?
The Windows installer is not code-signed yet, so SmartScreen shows its notice for a new publisher. Choose More info, then Run anyway. A code-signing certificate is being obtained and signed installers will ship as soon as possible.
How do I check that my installer is the real one?
Run Get-FileHash .\Cosindra-1.3.3-Setup.exe -Algorithm SHA256 in PowerShell, in the folder you saved it to. The hash must be 419e48d81e5ebbfe244808602605c10e80b2931d33f37d8c03ffa247770f6331 for version 1.3.3.
Defender quarantined Cosindra. What should I do?
You can leave it there. RigMaster, MotionSmith, WorldWeaver, MaterialForge and BlueprintStudio run in the browser without the desktop app; only the Unreal Editor integration needs it. Restore it only if you downloaded it from cosindra.ai and the checksum matches: open Windows Security, go to Protection history, open the Cosindra entry and choose Restore.
Does the desktop app send my project to Cosindra?
No. All tool executions happen locally within your Unreal Engine editor. No project files or source code are transmitted to our servers.
Something does not match?
If the checksum differs, Windows names a different threat, or you are not sure, email [email protected] before you run anything.