mcpField
R
roblox-code-review

roblox-code-review

github.com/tabooharmonyTesting & quality138669 installsUpdated 2w ago
Repository

About roblox-code-review

A review skill for Roblox and Luau code that routes changes to relevant domain checks and produces a structured report. It emphasizes tracing execution paths and distinguishing static signals from verified behavior.

Key features

  1. 01Routes reviews to domain-specific skills
  2. 02Checks security, networking, data, and performance
  3. 03Traces player-facing changes end to end
  4. 04Separates static findings from runtime evidence
  5. 05Structures findings by severity and impact

Use cases

  1. 01Reviewing a Roblox or Luau code change
  2. 02Auditing remotes, data saving, or security
  3. 03Assessing performance and architecture risks

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/tabooharmony/roblox-brain --skill roblox-code-review

After installing, type/roblox-code-reviewin Claude Code to confirm it loaded.

Details

From the project README

Roblox Code Review

Route a Roblox code review to the right domain skills and produce a structured report. Apply relevant lenses based on what changed, not all every time.

When to Load

  • User asks for code review on Roblox/Luau code
  • User asks to audit security, performance, networking, monetization, or data persistence
  • User asks about Roblox best practices for remotes, data saving, or code organization

Quick Reference

Routing: Load These Skills for Each Lens
LensLoad
Security auditroblox-security
Remote validationroblox-networking
Data persistenceroblox-data
Cross-server stateroblox-server-data
Monetizationroblox-monetization
Performanceroblox-performance
Luau correctnessroblox-luau-core, roblox-luau-types
Architectureroblox-architecture
Static-Analysis Limits
  • Static scans can flag numeric require calls, dynamic-code markers, obfuscation-like names, cleanup tokens, and duplicate files; these are provenance or review signals, not verdicts.
  • Trace the containing function, authority boundary, reachability, and lifecycle before assigning severity.
  • Label search-only findings separately from observed runtime behavior, test results, and unavailable evidence.
  • Vertical slice review: For a player-facing change, trace input → UI/world feedback → remote or simulation → authoritative state → persistence → cleanup. Review the real path; file or class co-occurrence is not proof that a runtime connection exists.
Output Format
  1. READY / NOT READY
  2. Critical blockers (security, data loss, crashes)
  3. Warnings (leaks, bottlenecks, deprecated APIs)
  4. Unverified risks and unavailable evidence
  5. Findings with specific fixes

Severity: Critical / High / Medium / Low. For each finding: file + line, what's wrong, impact, and the smallest correct fix. The routed domain skill owns detailed checks.

Comments

Markdown supported