Skip to main content
Glama

Roblox Executor MCP Server

An advanced Model Context Protocol (MCP) server that allows AI agents to interact with running Roblox game clients. This server enables code execution, script decompilation, instance hierarchy querying, remote event spying and firing, and real-time log streaming.


πŸš€ Key Features

  • Code Execution β€” Run Luau code on the client dynamically, with optional return value yielding.

  • Script Inspection β€” Decompile scripts, search across sources, and perform semantic searches.

  • Instance Search & Manipulation β€” Use CSS-like selectors, traverse the instance hierarchy tree, and query dynamic properties/attributes.

  • Remote Spy & Fire β€” Intercept, log, block, ignore, and fire RemoteEvents / RemoteFunctions (backed by Cobalt).

  • Real-Time Log Streaming β€” Capture client console outputs dynamically via WebSockets and view them live.

  • GUI Interaction β€” Automate input by clicking buttons and typing text into UI elements.

  • OS Integrations β€” Retrieve list of Roblox processes and capture client window screenshots (Windows only).

  • Multi-Client Routing β€” Coordinate between multiple running clients with automatic Primary/Secondary promotion and relaying.

  • Local Script Hub β€” Save, load, and execute pre-configured Luau scripts.


Related MCP server: Roblox Executor MCP

πŸ–₯️ Local Web Dashboard

The Roblox Executor MCP includes a rich, responsive local web dashboard hosted at:

http://localhost:16384/

Use the dashboard to monitor connected clients, debug executables, and inspect games:

  1. Console Tab (New): A real-time stream of the Roblox client console logs (LogService.MessageOut), color-coded by log levels: Info (White), Warning (Yellow), and Error (Red).

  2. Executor Tab (New): A developer-focused suite to write Luau code directly, toggle "Get Return Value" to yield and print results, and instantly execute scripts saved in the user-scripts/ hub.

  3. Tools Tab: A control center to run all registered MCP tools manually and review inputs/outputs.

  4. Scripts Tab: Explore local and decompiled scripts, search sources, index game hierarchies, and set up semantic vector search.


πŸ› οΈ Complete Tool Catalog

The server registers a comprehensive list of tools for connected AI agents:

1. Client Management

  • list-clients β€” Lists all currently connected Roblox game clients.

  • set-active-client β€” Selects the active target client for subsequent tool operations.

2. Execution Tools

  • execute β€” Executes raw Luau code on the active Roblox client.

  • execute-file β€” Executes a Luau file from the server's local path.

  • teleport-player (New) β€” Relocates the player to specific coordinates, offsets, or target players.

  • set-player-property (New) β€” Modifies character stats (e.g., WalkSpeed, JumpPower, HipHeight, Gravity) or toggles Noclip.

3. Inspection & Search Tools

  • get-script-content β€” Retrieves the source/decompiled code of a specific script.

  • get-data-by-code β€” Queries client metadata using a Luau lookup script.

  • get-console-output β€” Returns the history of client console prints and warnings.

  • search-instances β€” Finds instances using selectors or names.

  • get-descendants-tree β€” Dumps the child hierarchy tree of a specific instance.

  • script-grep β€” Performs text searches across all loaded script sources.

  • semantic-search-scripts β€” Performs vector-based search on script contents (requires Ollama setup).

  • get-game-info β€” Queries game details (e.g., PlaceId, JobId, Player count).

  • get-executor-environment (New) β€” Returns a checklist of custom APIs supported by the connected Roblox executor (e.g., getgc, hookfunction).

  • get-instance-properties (New) β€” Probes attributes, CollectionService tags, and properties of an instance dynamically.

4. Remote Spy & Network Tools

  • ensure-remote-spy β€” Starts the Cobalt-backed remote spy pipeline.

  • get-remote-spy-logs β€” Retreives captured remote calls.

  • clear-remote-spy-logs β€” Clears captured logs.

  • block-remote β€” Blocks a specific RemoteEvent or RemoteFunction.

  • ignore-remote β€” Filters a remote out of the active log stream.

  • fire-remote (New) β€” Fires a RemoteEvent or invokes a RemoteFunction. Supports dynamically evaluated arguments starting with loadstring:.

5. GUI & OS Tools

  • click-button β€” Fires clicks on specific GUI buttons on the screen.

  • type-text-box β€” Focuses and sends text inputs to game TextBoxes.

  • list-roblox-windows β€” Lists active Roblox OS window handles.

  • screenshot-window β€” Caps and saves screenshots of the game client (Windows only).


πŸ“‹ Prerequisites

  • Node.js β‰₯ 18

  • Bun β‰₯ 1.3 (used for the interactive OpenTUI harness installer)

  • Roblox Executor β€” Any executor supporting loadstring, request, and (preferably) WebSocket.


⚑ Quick Start

1. Clone the Repository

git clone https://github.com/notpoiu/roblox-executor-mcp.git
cd roblox-executor-mcp

2. Run the Harness Installer

The installer handles server building, configuration generation for your AI client of choice, and prints your loader script:

npm run install:harnesses
TIP

If your terminal has issues rendering the interactive OpenTUI picker, run it in plain-text prompt mode:

npm run install:harnesses -- --plain

To automatically place the Roblox loader into the autoexec folder of a detected executor (e.g. MacSploit, or supported Windows executors), run:

npm run getscript -- --autoexec

3. Connect from Roblox

Paste this script into your executor or place it in your autoexec folder:

local bridgeUrl = getgenv().BridgeURL or "localhost:16384"
loadstring(game:HttpGet("http://" .. bridgeUrl .. "/script.luau"))()

Optional Environment Configuration

Configure these globals before running the loader script to customize behavior:

getgenv().BridgeURL = "10.0.0.4:16384"                  -- Default: localhost:16384
getgenv().DisableWebSocket = true                        -- Forces HTTP fallback polling
getgenv().DisableInitialScriptDecompMapping = true       -- Skips initial project script indexing

βš™οΈ Client Configuration & Manual Setup

If you prefer to configure your AI interface manually, refer to the guides below:

Client

Configuration Guide

Cursor

Setup Guide

Claude Desktop

Setup Guide

Claude Code

Setup Guide

Codex CLI

Setup Guide

Windsurf

Setup Guide

Antigravity

Setup Guide


πŸ› οΈ Developer Commands

Maintain, run, or update the server using these project scripts:

  • Build the project (compiles TypeScript and copies assets to dist/):

    npm run build
  • Start the server:

    npm run start
  • Update existing install (pulls updates, stops running processes, and rebuilds):

    npm run update

πŸ”’ Security & Safe Operation

CAUTION

This server allows arbitrary local code execution. Only connect trusted AI clients. Port 16384 does not enforce authenticationβ€”never expose this port to the public internet. For cross-machine or LAN setups, secure connections with a local VPN or an SSH tunnel.


πŸ“„ License

This project is licensed under the MIT License.

Available Tools

26 tools
block-remoteBlock or unblock a remoteA

Block or unblock a Roblox remote by exact name and direction. Requires ensure-remote-spy first; use get-remote-spy-logs to discover candidates.

Inputs: direction (required), remoteName (required), shouldBlock.

clear-remote-spy-logsClear all remote spy logsA

Clear all captured Cobalt remote spy logs. Requires ensure-remote-spy first.

Inputs: no named parameters.

click-buttonClick a GuiButtonA

Click a Roblox TextButton or ImageButton by firing its GUI signals. Use when direct UI activation is needed inside the active client.

Inputs: path (required), action.

ensure-remote-spyEnsure the Cobalt remote spy is loadedA

Load or verify the Cobalt remote spy in the active Roblox client. Call before reading, clearing, blocking, or ignoring remote spy logs.

Inputs: no named parameters.

executeExecute Code in the Roblox Game ClientA

Execute Luau in the active Roblox client without returning output. Use get-data-by-code instead when you need returned values.

Inputs: code (required), threadContext.

execute-fileExecute a Luau file in the Roblox Game ClientA

Execute a local .luau or .lua file in the active Roblox client without returning output. Use get-data-by-code instead when you need returned values.

Inputs: filePath (required), threadContext.

fire-remoteFire or invoke a RemoteEvent or RemoteFunctionB

Execute network calls by firing RemoteEvents (FireServer) or invoking RemoteFunctions (InvokeServer) with custom arguments.

Inputs: path (required), args, isFunction.

get-console-outputGet the roblox developer console output from the Roblox Game ClientC

Read recent Roblox developer console logs from the active client. Use limit and logsOrder to control volume and ordering.

Inputs: limit, filter, logsOrder.

get-data-by-codeGet data by codeB

Execute Luau in the active Roblox client and return serialized raw Lua values. The code must return values; do not manually JSON-encode them.

Inputs: code (required), timeout, threadContext.

get-descendants-treeGet the descendants tree of a Roblox instanceA

Get a depth-limited hierarchy of descendants under a Roblox instance. Use for broad structure exploration; use search-instances for selector-based filtering.

Inputs: root (required), maxDepth, classFilter, maxChildren.

get-executor-environmentGet Roblox Executor Environment InformationB

Check and retrieve the capabilities, custom globals, and identification metadata of the running Roblox exploit/executor environment.

Inputs: no named parameters.

get-game-infoGet information about the current Roblox gameA

Get current Roblox place and universe metadata such as PlaceId, GameId, and PlaceVersion.

Inputs: no named parameters.

get-instance-propertiesGet properties, attributes and tags of a Roblox instanceB

Inspect a Roblox Instance by path or debug ID to retrieve its properties, attributes, and tags.

Inputs: root, debugId, properties.

get-remote-spy-logsGet captured remote spy logs from CobaltA

List captured Cobalt remote and bindable call logs. Requires ensure-remote-spy first; supports direction and name filters to narrow noisy logs.

Inputs: limit, direction, remoteNameFilter, maxCallsPerRemote.

get-script-contentGet the content of a script in the Roblox Game ClientA

Get decompiled source for a Roblox script by path, script proxy, or getter code. Use startLine/endLine for a focused range when the full script is large.

Inputs: endLine, startLine, scriptPath, scriptGetterSource.

ignore-remoteIgnore or unignore a remoteA

Ignore or unignore logging for a Roblox remote by exact name and direction. Requires ensure-remote-spy first; ignored remotes still fire.

Inputs: direction (required), remoteName (required), shouldIgnore.

list-clientsList connected Roblox clientsA

List connected Roblox game clients with clientId and session metadata. Use before set-active-client when multiple clients are connected or the target client is unknown.

Inputs: no named parameters.

list-roblox-windowsList visible Roblox windowsA

List visible Roblox OS windows with PIDs. Use before screenshot-window when multiple Roblox windows may be open.

Inputs: no named parameters.

screenshot-windowTake a screenshot of a Roblox windowA

Capture an actual OS screenshot of a Roblox window via Windows APIs. Provide pid when multiple windows are open; secondary servers relay capture to the primary host.

Inputs: pid.

script-grepGrep across all scripts in the gameA

Search decompiled Roblox scripts with JavaScript regex or literal string matching. Use for exact identifiers or code patterns; use semantic-search-scripts when behavior is known but names are not.

Inputs: query (required), limit, literal, maxResults, +3 more.

search-instancesSearch for instances in the gameB

Search Roblox instances with QueryDescendants selector syntax. Use for class, name, tag, property, and attribute queries against a chosen root.

Inputs: selector (required), root, limit.

semantic-search-scriptsSemantically search scripts in the gameA

Find decompiled Roblox scripts by behavior using semantic embeddings. Use when exact identifiers are unknown; use script-grep for exact text or regex.

Inputs: query (required), limit, minScore.

set-active-clientSet active Roblox clientA

Route future Roblox tool calls to the specified connected client. Use list-clients first if you need available clientIds.

Inputs: clientId (required).

set-player-propertySet properties of the player characterB

Modify character stats or physics properties including WalkSpeed, JumpPower, JumpHeight, HipHeight, Gravity, and Noclip.

Inputs: noclip, gravity, hipHeight, jumpPower, +2 more.

teleport-playerTeleport the player characterB

Teleport the LocalPlayer's character to a specified player, set of coordinates, or relative offset, optionally facing a specific lookAt target.

Inputs: lookAt, coordinates, targetPlayer, relativeOffset.

type-text-boxType into a TextBoxA

Enter text into a Roblox TextBox by path. Can simulate keystrokes or set Text directly based on useKeyPress.

Inputs: path (required), text (required), enter, useKeyPress.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    A3.7/5.0

    Scored across 26 tools

    Disambiguation4/5

    Most tools have clearly distinct purposes and the descriptions cross-reference alternatives (e.g. execute vs get-data-by-code, script-grep vs semantic-search-scripts). A few boundaries are fuzzy: execute/execute-file/get-data-by-code all run Luau with differing output behavior, and ignore-remote vs block-remote both act on remotes, though descriptions do clarify the distinction.

    Naming Consistency4/5

    Nearly all tools follow a consistent kebab-case verb_noun pattern (get-script-content, set-active-client, clear-remote-spy-logs, fire-remote). Minor deviations exist in noun-first names like script-grep and semantic-search-scripts, but the overall convention is readable and predictable.

    Tool Count4/5

    At 26 tools this sits at the upper edge of the ideal range, but the domain is unusually broad (client routing, code execution, player control, script decompilation/search, instance introspection, remote spy, GUI automation, screenshots), so most tools earn their place rather than being redundant.

    Completeness5/5

    The surface covers the full exploitation lifecycle: client discovery/routing, execution, player manipulation, script reading and both grep/semantic search, instance and game introspection, remote spying/firing/blocking, GUI interaction, and OS-level screenshots. No obvious dead ends for the stated purpose.

    Maintenance

    ActivityInactive
    ResponsivenessNo recent community issues

    Related MCP Connectors

    Related MCP Servers

    • A
      license
      Not graded
      quality
      B
      maintenance
      MCP server for controlling and reverse engineering Roblox games, providing 132 tools across 8 categories for instance exploration, property inspection, input simulation, and more.
      431 npm
      12
      MIT
    • A
      license
      Not graded
      quality
      D
      maintenance
      An MCP server that enables AI agents to execute Lua code, inspect scripts, spy on remotes, and interact with running Roblox game clients, including support for mobile executors on Android and iOS.
      66 npm
      2
      MIT