mcpField
R
roblox-networking

roblox-networking

github.com/tabooharmonySecurity1382.0k installsUpdated 2w ago
Repository

About roblox-networking

roblox-networking is a skill for developers building Roblox networked gameplay. It focuses on validating untrusted client input, choosing authority models, and handling remotes safely.

Key features

  1. 01Validate client input on the server
  2. 02Select an authority model
  3. 03Choose remotes for gameplay requests
  4. 04Limit request rates and payloads
  5. 05Mock networking during edit-mode play

Use cases

  1. 01Adding a remote to a Roblox game
  2. 02Securing gameplay requests against tampering
  3. 03Testing network code in edit mode

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/tabooharmony/roblox-brain --skill roblox-networking

After installing, type/roblox-networkingin Claude Code to confirm it loaded.

Bundled filesreferences/full.md

Details

From the project README

roblox networking

When to Load

Load when adding a remote, handling untrusted input, adding cooldowns, or assigning authority.

Quick Reference

  • Every client argument is attacker-controlled; validate type, size, ownership, state, distance, cooldown on the server.
  • Look up prices, damage, rewards, permissions from server-owned definitions.
  • Choose the authority model first: Server Authority uses client prediction + server rollback, and is not SetNetworkOwner.
  • Under Server Authority, simulation input uses InputAction/BindToSimulation() + UseFixedSimulation, not a remote.
  • Events for most gameplay requests; keep RemoteFunction calls short and bounded.
  • RemoteEvent for reliable state; not ordered vs property/attribute replication — one explicit channel or version state. UnreliableRemoteEvent only for replaceable data; droppable, 1000-byte cap.
  • Engine ceiling: each remote type has ~500 FireServer req/s/client, pooled across same-type remotes — a ceiling, not a target.
  • Measure payload and fire rate under load; budget rate × bytes × recipients; snapshot on join, diffs after.
  • Hit timestamps are untrusted context, never proof. Bound freshness and validate server history; see full.md §3a.
  • Typed schemas do not replace security checks. Pin generators and verify generated output in CI.
  • Check NaN/infinity first (x ~= x, math.abs(x) == math.huge): NaN defeats </>. utf8.len catches malformed UTF-8 that fails a DataStore save.
  • Serialization: functions arrive nil, metatables stripped, mixed keys mangled, nil truncates tables, tables are copies — validate field by field, share state via server-owned snapshots/ids.
  • Server Authority needs AuthorityMode = Server + its bundle; misprediction/rollback are normal (full.md).
  • Rate limits protect the server; validation still rejects invalid requests. Bindables are same-side only: tables copied, metatables stripped, Invoke yields until OnInvoke returns.
  • Record suspicion with thresholds; never punish one malformed packet.
  • Edit-mode play: wrap the network layer so RunContext:IsEdit() gets a loopback mock (full.md).

Need details? references/full.md has validation, throttling, and mock patterns.

Comments

Markdown supported