Skip to main content
Glama
okenjioxx

Roblox Executor MCP Server

by okenjioxx
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

Find string VALUES stored in GC tables (runtime string data scan)

find-string-in-tables
Read-onlyIdempotent

Search live Luau GC tables for string values containing or exactly matching your query to uncover runtime data strings like server responses or dynamic remote names.

Instructions

Walk every live Luau GC table and report each string VALUE that matches query. This is the runtime-DATA complement to find-string-xrefs (which scans closures' bytecode constants): it finds strings that exist as actual table data at this moment — server responses, built-up chat/UI text, dynamically constructed remote names, cached config strings, decoded tokens — which may never appear as a source literal. By default contains=true performs a plain (non-pattern) substring search; set contains=false for exact equality. Each hit is recorded as { table, key, value } where 'table' is the container address (tostring), 'key' is the field (tostring), and 'value' is the matched string truncated to its first 200 characters. Pivot from a hit with read-path-value / write-path-value (or find-table-references to see who owns the container). Each table's pairs() iteration is pcall-guarded so locked/proxy tables never abort the scan; GC objects examined are capped by maxScan and results by limit, with a 'truncated' flag. Requires getgc (falls back from getgc(true) to getgc()). Returns { query, contains, matchCount, scannedObjects, truncated, matches } or { error }. Signature: { query: string, contains: any?, limit: any?, maxScan: any?, threadContext: number? }. Phase: observe; cost=medium; idempotency=read-only. Requires: active-client. Produces: bounded-candidates. Safety: read-only. On failure: inspect tool-schema for exact fields, defaults, constraints, and an invocation example.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of matching strings to return (default 150). Hitting this sets truncated=true.
queryYesThe string to search for among table VALUES, e.g. 'GodMode', 'http', 'BuyItem', a token prefix, or any substring of runtime text. With contains=true (default) any string value containing this matches; with contains=false only string values exactly equal to this match. Case-sensitive, plain text (not a Lua pattern).
maxScanNoMaximum number of GC objects to examine before stopping (default 40000). Hitting this sets truncated=true. Raise for a deeper sweep at the cost of time; lower if scans are slow.
containsNoWhen true (default), match any string value that CONTAINS `query` as a plain substring (string.find with plain=true). When false, require exact string equality. Use exact to pin one specific value.
threadContextNoOptional Roblox thread identity for this call; omit it to use the server default.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv2.0.0-spies.2

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only/idempotent/no-destruct, but the description adds substantial behavior beyond them: pairs() iteration is pcall-guarded so locked/proxy tables never abort the scan, GC objects are capped by maxScan and results by limit with a 'truncated' flag, getgc(true) falls back to getgc(), and it declares phase/cost. This is rich, non-redundant operational context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and sibling contrast are front-loaded, and the sentences carry dense, useful detail. It is long and includes some redundancy — read-only is asserted in the description body, the 'idempotency=read-only' line, and 'Safety: read-only' — which is partly duplicated by the annotations, but nothing is padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description carries the return contract and does so fully ('Returns { query, contains, matchCount, scannedObjects, truncated, matches }'), plus the per-hit shape { table, key, value } with truncation to 200 chars and the failure shape { error }. For a medium-cost, 5-parameter scan tool this leaves no material gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and every parameter already documents its own default and semantics, so the baseline is 3. The description corroborates the contains behavior (plain substring vs exact, case-sensitive, not a Lua pattern) but adds little beyond what the schema already states for limit/maxScan/threadContext.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Walk every live Luau GC table and report each string VALUE that matches query') and explicitly differentiates itself from the sibling find-string-xrefs by scope (runtime data vs bytecode constants). An agent can route between the two without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Names the alternative (find-string-xrefs) and the exact condition that selects this tool ('runtime-DATA complement... strings that exist as actual table data at this moment'), and gives concrete examples of when this is the right choice. It also explains the contains=true/false branch as a usage decision and offers pivot tools (read-path-value / write-path-value) for follow-up.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools