Tripwire

Tripwire

made by alibolly

An MCP server that gives an AI coding agent real control of Roblox Studio and Roblox Open Cloud, with a test-and-security layer no other Studio MCP has.

Tripwire lets an assistant read, write, and edit the data model, drive playtests with simulated input, run tests-as-code headlessly in the real engine, flag client-trust exploits in game code, and call the Open Cloud APIs (DataStores, MessagingService, Memory Stores, and more). The Studio tools need no API key; the headless test, asset, and Open Cloud tools use an Open Cloud key.

Requirements

• An MCP client: Claude Code, Codex, Gemini, or any client that speaks MCP over stdio.
• Roblox Studio, for the Studio tools. These need no API key.
• Node.js, only if you run the server with npx. The prebuilt binary needs no Node.
• For the headless test, asset, and Open Cloud tools: a published place and a Roblox Open Cloud API key. See Open Cloud setup.

Quickstart

Tripwire is for Roblox developers who drive Studio through an AI coding agent.

1. Wire the server into your MCP client (one command or a small config block, see Install below).
2. Install the Studio plugin so the Studio tools can reach Studio (see the plugin step in Install).
3. Open your place in Studio, turn on Game Settings > Security > Allow HTTP Requests, then click the Tripwire toolbar button and press Connect in the panel. The panel shows Connected and the Output prints [Tripwire v...] connected.
4. Ask your agent to run studio_status. A connected Studio confirms the bridge works.
5. Optional: add an Open Cloud key for the headless test, asset, and Open Cloud tools (see Open Cloud setup).

Install

Tripwire's server is a single binary. The easiest way to run it is with npx, which fetches the prebuilt binary for your platform, so there is no Rust toolchain to install. Prefer a manual binary or a source build? See the Alternatives at the end of this section.

Claude Code

One command:

claude mcp add --transport stdio tripwire -- npx -y tripwire-roblox

Or add it to a project .mcp.json (or ~/.claude.json):

{

"mcpServers": { "tripwire": { "type": "stdio", "command": "npx", "args": ["-y", "tripwire-roblox"] } } }

Codex

Add to ~/.codex/config.toml:

[mcp_servers.tripwire]

command = "npx" args = ["-y", "tripwire-roblox"]

Or: codex mcp add tripwire -- npx -y tripwire-roblox

Gemini

Add to ~/.gemini/settings.json (or a project .gemini/settings.json):

{

"mcpServers": { "tripwire": { "command": "npx", "args": ["-y", "tripwire-roblox"] } } }

Or: gemini mcp add tripwire npx -y tripwire-roblox

Other MCP clients

Any client that speaks MCP over stdio can run it:

command: npx

args: ["-y", "tripwire-roblox"]

Alternatives: prebuilt binary, or build from source

Prebuilt binary (no Node). Download the archive for your platform from the Releases page (for example tripwire-server-vX.Y.Z-aarch64-apple-darwin.tar.gz), extract it, and point your client's command at the extracted tripwire-server with empty args.

Build from source (needs Rust):

git clone https://github.com/aliboIly/Tripwire.git

cd Tripwire/server cargo build --release # produces server/target/release/tripwire-server

Then point your client's command at that binary path.

Studio plugin (required for the Studio tools)

The Studio tools reach Studio through a small plugin that long-polls the local server. Grab Tripwire.rbxmx from the Releases page, or build it:

cd Tripwire/plugin

npm install npx rbxtsc rojo build --output Tripwire.rbxmx cp Tripwire.rbxmx ~/Documents/Roblox/Plugins/ # macOS; Windows: %LOCALAPPDATA%\Roblox\Plugins

Restart Studio, enable Game Settings > Security > Allow HTTP Requests, then click the Tripwire toolbar button and press Connect in the panel. The panel shows Connected and the Output prints [Tripwire v...] connected.

Open Cloud key (for headless tests, assets, and Open Cloud tools)

The Studio tools need no key. The Open Cloud tools do. See Open Cloud setup below for the full walkthrough.

Open Cloud setup

Most of Tripwire needs no credentials. These tools do, because they call Roblox Open Cloud: run_luau, the headless tests (run_tests, run_test_file, list_tests), and every tool in the Open Cloud sections below (assets, publishing, data stores, messaging, memory, universe and servers, the Engine Instance API, moderation, secrets, monetization, Creator Store, groups, analytics, platform, and open_cloud_request). They authenticate with a Roblox Open Cloud API key.

Use at your own risk. An Open Cloud key is a real credential with real power over your

experience. Depending on the scopes you grant it, it can read and overwrite your live DataStores,

publish new versions of your place, upload assets to your account, and message your servers. Treat

it like a password: grant only the scopes you actually use, restrict it to your own IP, never

commit it, and revoke it if it leaks. You are responsible for what you do with it. Tripwire is not

affiliated with or endorsed by Roblox.

1. Create the key

1. Go to create.roblox.com/dashboard/credentials and sign in.
2. Click Create API Key and name it (for example Tripwire).
3. Under Access Permissions, add only the API systems for the tools you want, and grant each the operation it needs, scoped to your experience. Every system the dashboard offers has a tool; the map is in Permissions to tools below. The short version:

• Luau Execution (write): run_luau and the headless tests.
• universe-places (write): publish_place.
• Assets (read + write) and Asset Permissions: the asset tools.
• DataStores and Ordered DataStores: the data-store tools.
• Messaging Service (publish) and Memory Stores: those tools.
• Universe, Place, Instance, User Restrictions, Secrets, Analytics: the universe, server, instance, moderation, secrets, and analytics tools.
• Developer Products, Game Passes, Creator Store: the monetization and store tools.
• User/Group/Inventory/Subscription/Notification: the platform, group, and engagement tools.
• Anything else (the legacy and experimental systems): open_cloud_request.

1. Under Security, set Accepted IP Addresses to your machine's IP, or 0.0.0.0/0 to allow any (simplest for local use). Set an expiration if you want.
2. Click Save & Generate Key and copy the key string. It is shown only once.

2. Find your universe and place IDs

In the Studio command bar (View, then Command Bar), run:

print("universe", game.GameId, "place", game.PlaceId)

GameId is your ROBLOX_UNIVERSE_ID; PlaceId is your ROBLOX_PLACE_ID. The place must be published to Roblox for Open Cloud to act on it.

3. Give Tripwire the credentials

Create a .env at the repo root. It is gitignored and the server loads it automatically:

ROBLOX_OPEN_CLOUD_KEY=paste_the_key_here

ROBLOX_UNIVERSE_ID=000000 ROBLOX_PLACE_ID=000000 ROBLOX_CREATOR_USER_ID=000000 # only for upload_asset (your user id)

Or put the same variables in your MCP client's env block instead (those take precedence). Reconnect the MCP server after changing either. Each tool works when the key grants its scope and returns Roblox's own error if a scope is missing, so you can add scopes as you go.

Tools

Connection

studio_status Whether a Studio is connected, the active place, and any other connected studios. ping_studio Round-trip a ping through the plugin to confirm the live bridge works. list_studios List every connected (or recently seen) Studio: place, whether it is active, last-seen, and playtest state. set_active_studio Choose which connected Studio the tools target (by id, id prefix, or place name). Automatic with one Studio.

Read and inspect

get_file_tree List the instance tree from a path (default the whole game), bounded by depth. get_instance_children List the direct children (name and class) of an instance. get_instance_properties Read an instance's name, class, full path, attributes, and a curated set of common engine properties (Position, Size, Color, Material, Anchored, Text, and so on). search_objects Find instances whose name contains a query, optionally filtered by exact class or by class-and-subclasses (isA). search_by_property Find instances whose property equals a value, optionally filtered by exact class or by class-and-subclasses (isA). get_script_source Read the source of a Script, LocalScript, or ModuleScript. grep_scripts Search script sources for a substring; returns path, line number, and line. get_output_log Recent Studio Output entries (message, type, timestamp). get_selection The instances currently selected in Studio. get_class_info Look up a Roblox class's members (properties, methods, events) with their types, inherited members folded in. Answered from a bundled API reflection dump, so it needs no Studio and no key.

Spatial (read-only)

raycast Cast a ray and report the first hit (instance, position, normal, material, distance) or no hit, with an optional excluded subtree. get_bounding_box The world-space bounding box (center and size) of a Model or BasePart. find_spawns List the SpawnLocations under a path: position, whether each is enabled, and whether it is neutral. capture_screenshot Capture the Studio viewport as a JPEG image so the agent can see the scene. Needs the plugin connected and Allow Mesh / Image APIs enabled (Game Settings, Security). Edit mode only.

Edit (each is one undo step)

create_instance Create an instance of a class with an optional name and initial properties. delete_instance Destroy an instance and its desc