# Tripwire
**Category:** 📂 Browser Automation
**Repository:** https://github.com/aliboIly/Tripwire
**Views:** 0
**Installs:** 0
**Upvotes:** 0
**Directory Page:** https://allmcps.com/mcp/tripwire
## Description
MCP for Roblox Studio and Open Cloud: drive Studio, run headless tests, and review game security.
## Claude Desktop Quick Installation
Heuristic fallback — verify the package name and runner against the repository README before running it. Uses `npx` (confidence: low):
```json
"mcpServers": {
"tripwire": {
"command": "npx",
"args": ["-y","tripwire"]
}
}
```
## Documentation & README
# Tripwire
**made by alibolly**
[](https://www.npmjs.com/package/tripwire-roblox)
[](https://github.com/aliboIly/Tripwire/actions/workflows/ci.yml)
[](https://registry.modelcontextprotocol.io)
[](LICENSE)
An MCP server that gives an AI coding agent real control of Roblox Studio and Roblox Open Cloud,
with a test-and-security layer no other Studio MCP has.
Tripwire lets an assistant read, write, and edit the data model, drive playtests with simulated
input, run tests-as-code headlessly in the real engine, flag client-trust exploits in game code,
and call the Open Cloud APIs (DataStores, MessagingService, Memory Stores, and more). The Studio
tools need no API key; the headless test, asset, and Open Cloud tools use an Open Cloud key.
---
## Requirements
- An MCP client: Claude Code, Codex, Gemini, or any client that speaks MCP over stdio.
- Roblox Studio, for the Studio tools. These need no API key.
- Node.js, only if you run the server with `npx`. The prebuilt binary needs no Node.
- For the headless test, asset, and Open Cloud tools: a published place and a Roblox Open Cloud API key. See [Open Cloud setup](#open-cloud-setup).
## Quickstart
Tripwire is for Roblox developers who drive Studio through an AI coding agent.
1. Wire the server into your MCP client (one command or a small config block, see [Install](#install) below).
2. Install the Studio plugin so the Studio tools can reach Studio (see the plugin step in Install).
3. Open your place in Studio, turn on Game Settings > Security > Allow HTTP Requests, then click the Tripwire toolbar button and press Connect in the panel. The panel shows Connected and the Output prints `[Tripwire v...] connected`.
4. Ask your agent to run `studio_status`. A connected Studio confirms the bridge works.
5. Optional: add an Open Cloud key for the headless test, asset, and Open Cloud tools (see Open Cloud setup).
---
## Install
Tripwire's server is a single binary. The easiest way to run it is with `npx`, which fetches the
prebuilt binary for your platform, so there is no Rust toolchain to install. Prefer a manual binary
or a source build? See the Alternatives at the end of this section.
Claude Code
One command:
```bash
claude mcp add --transport stdio tripwire -- npx -y tripwire-roblox
```
Or add it to a project `.mcp.json` (or `~/.claude.json`):
```json
{
"mcpServers": {
"tripwire": {
"type": "stdio",
"command": "npx",
"args": ["-y", "tripwire-roblox"]
}
}
}
```
Codex
Add to `~/.codex/config.toml`:
```toml
[mcp_servers.tripwire]
command = "npx"
args = ["-y", "tripwire-roblox"]
```
Or: `codex mcp add tripwire -- npx -y tripwire-roblox`
Gemini
Add to `~/.gemini/settings.json` (or a project `.gemini/settings.json`):
```json
{
"mcpServers": {
"tripwire": {
"command": "npx",
"args": ["-y", "tripwire-roblox"]
}
}
}
```
Or: `gemini mcp add tripwire npx -y tripwire-roblox`
Other MCP clients
Any client that speaks MCP over stdio can run it:
```
command: npx
args: ["-y", "tripwire-roblox"]
```
Alternatives: prebuilt binary, or build from source
**Prebuilt binary (no Node).** Download the archive for your platform from the
[Releases](https://github.com/aliboIly/Tripwire/releases) page (for example
`tripwire-server-vX.Y.Z-aarch64-apple-darwin.tar.gz`), extract it, and point your client's
`command` at the extracted `tripwire-server` with empty `args`.
**Build from source** (needs [Rust](https://rustup.rs)):
```bash
git clone https://github.com/aliboIly/Tripwire.git
cd Tripwire/server
cargo build --release # produces server/target/release/tripwire-server
```
Then point your client's `command` at that binary path.
Studio plugin (required for the Studio tools)
The Studio tools reach Studio through a small plugin that long-polls the local server. Grab
`Tripwire.rbxmx` from the [Releases](https://github.com/aliboIly/Tripwire/releases) page, or build it:
```bash
cd Tripwire/plugin
npm install
npx rbxtsc
rojo build --output Tripwire.rbxmx
cp Tripwire.rbxmx ~/Documents/Roblox/Plugins/ # macOS; Windows: %LOCALAPPDATA%\Roblox\Plugins
```
Restart Studio, enable **Game Settings > Security > Allow HTTP Requests**, then click the
**Tripwire** toolbar button and press **Connect** in the panel. The panel shows Connected and
the Output prints `[Tripwire v...] connected`.
Open Cloud key (for headless tests, assets, and Open Cloud tools)
The Studio tools need no key. The Open Cloud tools do. See [Open Cloud setup](#open-cloud-setup)
below for the full walkthrough.
---
## Open Cloud setup
Most of Tripwire needs no credentials. These tools do, because they call Roblox Open Cloud:
`run_luau`, the headless tests (`run_tests`, `run_test_file`, `list_tests`), `upload_asset`,
`publish_place`, and the DataStore, Ordered DataStore, MessagingService, Memory Store, platform,
and engagement tools. They authenticate with a Roblox Open Cloud API key.
> **Use at your own risk.** An Open Cloud key is a real credential with real power over your
> experience. Depending on the scopes you grant it, it can read and overwrite your live DataStores,
> publish new versions of your place, upload assets to your account, and message your servers. Treat
> it like a password: grant only the scopes you actually use, restrict it to your own IP, never
> commit it, and revoke it if it leaks. You are responsible for what you do with it. Tripwire is not
> affiliated with or endorsed by Roblox.
### 1. Create the key
1. Go to [create.roblox.com/dashboard/credentials](https://create.roblox.com/dashboard/credentials) and sign in.
2. Click **Create API Key** and name it (for example `Tripwire`).
3. Under **Access Permissions**, add only the API systems for the tools you want, and grant each the operation it needs, scoped to your experience:
- **Luau Execution** (write): `run_luau` and the headless tests.
- **universe-places** (write): `publish_place`.
- **Assets** (read + write): `upload_asset`.
- **DataStores** and **Ordered DataStores**: the data-store tools.
- **Messaging Service** (publish) and **Memory Stores**: those tools.
- **User/Group/Inventory/Subscription/Notification**: the platform and engagement tools.
4. Under **Security**, set **Accepted IP Addresses** to your machine's IP, or `0.0.0.0/0` to allow any (simplest for local use). Set an expiration if you want.
5. Click **Save & Generate Key** and copy the key string. It is shown only once.
### 2. Find your universe and place IDs
In the Studio command bar (View, then Command Bar), run:
```lua
print("universe", game.GameId, "place", game.PlaceId)
```
`GameId` is your `ROBLOX_UNIVERSE_ID`; `PlaceId` is your `ROBLOX_PLACE_ID`. The place must be
**published** to Roblox for Open Cloud to act on it.
### 3. Give Tripwire the credentials
Create a `.env` at the repo root. It is gitignored and the server loads it automatically:
```bash
ROBLOX_OPEN_CLOUD_KEY=paste_the_key_here
ROBLOX_UNIVERSE_ID=000000
ROBLOX_PLACE_ID=000000
ROBLOX_CREATOR_USER_ID=000000 # only for upload_asset (your user id)
```
Or put the same variables in your MCP client's `env` block instead (those take precedence).
Reconnect the MCP server after changing either. Each tool works when the key grants its scope and
returns Roblox's own error if a scope is missing, so you can add scopes as you go.
---
## Tools
### Connection
studio_status
Whether a Studio is connected, the active place, and any other connected studios.ping_studio
Round-trip a ping through the plugin to confirm the live bridge works.list_studios
List every connected (or recently seen) Studio: place, whether it is active, last-seen, and playtest state.set_active_studio
Choose which connected Studio the tools target (by id, id prefix, or place name). Automatic with one Studio.get_file_tree
List the instance tree from a path (default the whole game), bounded by depth.get_instance_children
List the direct children (name and class) of an instance.get_instance_properties
Read an instance's name, class, full path, attributes, and a curated set of common engine properties (Position, Size, Color, Material, Anchored, Text, and so on).search_objects
Find instances whose name contains a query, optionally filtered by exact class or by class-and-subclasses (isA).search_by_property
Find instances whose property equals a value, optionally filtered by exact class or by class-and-subclasses (isA).get_script_source
Read the source of a Script, LocalScript, or ModuleScript.grep_scripts
Search script sources for a substring; returns path, line number, and line.get_output_log
Recent Studio Output entries (message, type, timestamp).get_selection
The instances currently selected in Studio.get_class_info
Look up a Roblox class's members (properties, methods, events) with their types, inherited members folded in. Answered from a bundled API reflection dump, so it needs no Studio and no key.raycast
Cast a ray and report the first hit (instance, position, normal, material, distance) or no hit, with an optional excluded subtree.get_bounding_box
The world-space bounding box (center and size) of a Model or BasePart.find_spawns
List the SpawnLocations under a path: position, whether each is enabled, and whether it is neutral.capture_screenshot
Capture the Studio viewport as a JPEG image so the agent can see the scene. Needs the plugin connected and Allow Mesh / Image APIs enabled (Game Settings, Security). Edit mode only.create_instance
Create an instance of a class with an optional name and initial properties.delete_instance
Destroy an instance and its descendants.set_property
Set one typed property (primitive, Vector3, Color3, UDim2, CFrame, EnumItem, or an instance reference).update_script_source
Replace a script's source through the script editor (the supported write path).insert_model
Insert an asset by id, with optional reposition or unpack.mass_create
Create many instances in one undo step (atomic, or best-effort with per-item results).mass_set_property
Set one property on many instances in one undo step (atomic or best-effort).start_playtest
Start an F5 playtest (server and client DataModels with a player); injects the in-play runner.stop_playtest
Stop the F5 playtest (best-effort; F5 teardown can outlast the confirmation).start_simulation
Start an F8 run (server-only simulation, no client or player).stop_simulation
Stop the F8 run (clean).simulate_mouse_input
Click or move the mouse at screen coordinates during an F5 playtest.simulate_keyboard_input
Press a key (tap/press/release) or type text during an F5 playtest.character_navigation
Walk the local character toward a world position; reports whether it reached the goal.get_playtest_output
The running playtest's output log, aggregated across the server and client peers. Pass the cursor from the previous call as since to get only new lines; the buffer is bounded so long sessions do not freeze it.reset_playtest_output
Clear the playtest's output buffers so the next read starts fresh, without restarting Studio.run_luau_live
Evaluate Luau in the live F5 playtest server and return the result, so you can inspect the running game (a Humanoid's state, an NPC's position, a path's waypoints) without adding a print and replaying. Needs an active playtest and ServerScriptService.LoadStringEnabled on in the test place. Distinct from run_luau, which is headless against the published place.run_luau
Run a Luau script headlessly in the published place; returns the results and logs.run_tests
Run the headless test suite in the published place and report passed/failed with messages.run_test_file
Run a single spec by name, headlessly.list_tests
List the spec files and their cases discovered in the published place.write_test
Write a roblox-ts test spec to disk; rebuild and publish, then run_tests picks it up.review_security
Review the game source for client-trust and unvalidated-remote issues, each with a suggested server-side fix.scan_remotes
List server remote handlers and the client-controlled parameters of each.scan_client_trust
Flag server handlers that use client-supplied values without validating them.upload_asset
Upload a local file as a Roblox asset (Decal, Audio, Model, Animation, or Video); returns the assetId.publish_place
Publish a local place file (.rbxl/.rbxlx) as a new version of the experience.list_datastores
List the standard data stores in the universe.list_datastore_entries
List entry keys in a data store.get_datastore_entry
Read an entry's value and metadata.set_datastore_entry
Create or overwrite an entry (value plus optional users/attributes).delete_datastore_entry
Soft-delete an entry (purged after 30 days).increment_datastore_entry
Atomically add an integer to a numeric entry.list_ordered_entries
List ordered data store entries by value, ascending or descending.get_ordered_entry
Read one ordered data store entry.set_ordered_entry
Set (upsert) an ordered data store entry to a non-negative integer.increment_ordered_entry
Atomically add to an ordered data store entry.publish_message
Publish a message to a MessagingService topic (reaches running production servers).memory_sorted_map_set
Set (upsert) a Memory Store sorted-map item, with TTL and sort keys.memory_sorted_map_get
Read a Memory Store sorted-map item.memory_sorted_map_list
List sorted-map items in sort order.memory_sorted_map_delete
Delete a sorted-map item.memory_queue_add
Add an item to a Memory Store queue, with priority and TTL.memory_queue_read
Read items from a queue; returns a readId for the discard call.memory_queue_discard
Permanently remove a read batch by its readId.get_universe
The configured universe's metadata.get_place
The configured place's metadata.get_user
A user's public profile.get_group
A group's metadata.list_inventory
A user's inventory items, filterable by type or id.send_notification
Send an experience notification to a user (from a Creator Dashboard template).get_subscription
Read a user's subscription to a subscription product.