roblox-mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited roblox-mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Official sources:
The official Roblox Studio MCP server lets a connected AI client inspect and edit an open place. It provides tools for scripts, instances, Luau execution, assets, and playtesting.
Roblox Studio implements a Model Context Protocol (MCP) server using stdio transport. The server runs as a local process on your machine and proxies requests from a supported AI client into the active Studio session. It is the bridge between your editor's agent and Studio: Script Sync handles disk-to-Studio file syncing, while MCP handles everything else (Explorer selection, instance inspection, script editing, Luau execution, play mode, input simulation, and asset insertion).
stdio transport.If you do not see MCP options, restart Studio after updating to the latest version.
Choose the method that matches your client:
Quick connect supports Antigravity, Codex CLI, Claude Code, Claude Desktop, Cursor, Gemini CLI, and Visual Studio Code.
For clients that read an mcp.json or similar config file, see references/setup-and-connection.md for per-OS, copy-paste configurations.
For clients that need a raw CLI command, see references/setup-and-connection.md for Windows and macOS commands.
After connecting, verify with:
Use the Roblox MCP to read the current game tree in Roblox Studio. List what's in Workspace.
The server exposes tools in several categories. The current tool names and usage guidance are in references/tool-reference.md.
| Category | Examples |
|---|---|
| Scripts | script_read, multi_edit, script_search, script_grep |
| Data model | search_game_tree, inspect_instance, subagent (explore) |
| Luau execution | execute_luau |
| Asset generation & insertion | generate_mesh, generate_material, generate_procedural_model, wait_job_finished, search_asset, insert_asset, upload_image, store_image |
| Playtesting | start_stop_play, get_studio_state, get_console_output, screen_capture, subagent (playtest) |
| Input simulation | character_navigation, user_keyboard_input, user_mouse_input |
| Documentation | http_get, skill |
| Instance discovery | list_roblox_studios; pass studio_id on subsequent calls |
Script Sync maps folders on disk (ServerScriptService/, ReplicatedStorage/, StarterPlayerScripts/, etc.) to Studio services, so .luau files you edit locally appear in Studio automatically. MCP covers everything Script Sync cannot reach: editing StarterGui, inserting models, running commands, playtesting, and inspecting instances.
Typical agent loop:
StarterGui).See references/script-sync-integration.md for the full setup and a starter-project layout.
Call list_roblox_studios to discover connected windows, their Studio instance IDs, and place IDs. Local places without a place ID are listed by name. Pass the selected instance's studio_id on every subsequent tool call; do not rely on a shared active window or infer the target from an object path. Re-list instances when a window closes or the target changes.
MCP clients can read and modify your open places. Treat MCP connections like any privileged integration:
.rbxlx and other place files out of Git (use the starter .gitignore).execute_luau as privileged code: it can publish places, write to DataStores, make HTTP requests, and access credentials loaded in Studio.See references/security-and-troubleshooting.md for the full security checklist and troubleshooting steps.
script_read or search_game_tree returns the current place structure.execute_luau can run a simple print and return output.start_stop_play enters/exits play mode successfully.scripts/MCPReadyChecker.lua: a diagnostic snippet you can run with execute_luau to verify Script Sync status and basic model health.scripts/StudioModelProbe.lua: a reusable utility for summarizing the game tree, useful as a pattern for agent exploration prompts.execute_luau call.<!-- catalog:references:start -->
<!-- catalog:references:end -->
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.