mcpField
R
roblox-security-economy

roblox-security-economy

github.com/ashexplainedSecurity38108 installsUpdated 17w ago
Repository

About roblox-security-economy

roblox-security-economy is a security review skill for Roblox game developers, focused on valuable state such as currency, items, trades, rewards, and purchases. It sets out server-authority rules and an MCP-based review workflow to examine trust boundaries and abuse risks.

Key features

  1. 01Map high-risk economy flows
  2. 02Require server-side reward calculation and validation
  3. 03Structure saves and purchase receipt handling
  4. 04Check trade confirmation and atomic commits
  5. 05Review risks with script inspection and playtests

Use cases

  1. 01Audit currency and item grant flows
  2. 02Check purchase receipts and duplicate-grant risks
  3. 03Assess trade and gifting safety
  4. 04Test value-related logic in a playtest

MCP support

The skill describes a workflow using MCP tools to review Roblox projects, including searching and reading scripts, inspecting game instances, editing code, and running playtests. It does not state that it provides an MCP server.

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/ashexplained/roblox-skills --skill roblox-security-economy

After installing, type/roblox-security-economyin Claude Code to confirm it loaded.

Details

From the project README

Roblox Security Economy

Goal

Protect valuable game state while keeping the player loop fair. Anything that grants, spends, trades, saves, or purchases value must be server-authoritative.

High-Risk Surfaces

  • Currency and premium currency.
  • Inventory, pets, skins, tools, boosts, and quest rewards.
  • Trading, gifting, crafting, upgrades, prestige, and loot rolls.
  • Developer product receipts and game pass checks.
  • Daily rewards, streaks, event rewards, and group rewards.
  • Client remotes that request grants, damage, teleport, placement, or progression.

Server Authority Rules

  • Calculate rewards on the server.
  • Validate player eligibility on the server.
  • Store canonical balances and inventory on the server.
  • Treat client UI as display and intent only.
  • Use idempotency for purchases and valuable grants.
  • Reject malformed, replayed, impossible, or too-frequent remote requests.

DataStore And Receipt Patterns

  • Save compact canonical state, not UI state.
  • Use versioned data schemas and migration guards.
  • Queue or debounce saves during active sessions.
  • Bind saves to player leaving and server shutdown paths.
  • For developer products, grant through receipt processing and record processed purchase IDs before considering the transaction complete.

Trading And Gifting

  • Use server-owned trade sessions.
  • Lock offered items while a trade is pending.
  • Require both parties to confirm the exact final offer.
  • Revalidate ownership immediately before commit.
  • Commit atomically from server state where possible.
  • Log valuable trades and grant paths for later investigation.

MCP Review Workflow

  1. Use script_grep for remotes, currency names, DataStore usage, receipt handlers, and grant functions.
  2. Read every script that touches value with script_read.
  3. Inspect relevant instances with search_game_tree and inspect_instance.
  4. Patch with multi_edit only after mapping source-to-sink flow.
  5. Playtest purchase-free paths and console errors with start_stop_play and get_console_output.

Output

Report:

  • Assets or values protected.
  • Trust boundary.
  • Server validation rules.
  • Abuse cases prevented.
  • Remaining risks or manual Roblox purchase tests.

Next

Verify the protected flows in a playtest with roblox-playtest-qa, and confirm the save path is safe with roblox-datastore-persistence.

Comments

Markdown supported