registry / @weppy/roblox-mcp / 2.10.4

@weppy/roblox-mcp@2.10.4

MCP (Model Context Protocol) server for Roblox Studio integration - enables AI coding agents to interact with Roblox Studio in real-time

AI Security Review

scanned 2h ago · by lpm-firewall-ai

LPM treats this as warn-only first-party agent extension lifecycle risk. A user-run MCP server automates Roblox Studio over a local bridge and automatically installs its bundled Roblox Studio plugin. It also performs runtime licensing and telemetry-related network activity. No install-time malicious behavior is established.

Static reason

No blocking static signals were detected.

Trigger

Explicit execution of `weppy-roblox-mcp` or `roblox-mcp`.

Impact

Can alter an attached Roblox Studio project and persist its package-owned Studio plugin.

Mechanism

Local MCP/Roblox bridge, first-party plugin copy, and vendor license/analytics clients.

Rationale

The package is not concretely malicious, but it has meaningful user-invoked automation and automatic first-party extension setup at runtime. Warn rather than block so the capability and persistence behavior are surfaced.

Evidence

package.jsondist/index.jsREADME.mdroblox-plugin/WeppyRobloxMCP.rbxm

Network endpoints1

roblox-license-api.hope841026.workers.dev

Decision evidence

public snapshot

AI called this Suspicious at 88.0% confidence as Dangerous Capability with low false-positive risk.

@weppy/roblox-mcp@2.10.4

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code