registry / roblox-mcp-difz / 1.4.5

roblox-mcp-difz@1.4.5

Universal MCP server for Roblox game control, reverse engineering, and exploitation — supports Claude Code, Claude Desktop, Cursor, Windsurf, and any MCP-compatible AI.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 22 file(s), 1.02 MB of source, external domains: 127.0.0.1, assetgame.roblox.com, registry.npmjs.org

Source & flagged code

5 flagged

dist/cli.jsView file

Lines 17-57javascript

17 o["default"] = v;

18});

19var __importStar = (this && this.__importStar) || (function () {

20 var ownKeys = function(o) {

21 ownKeys = Object.getOwnPropertyNames || function (o) {

22 var ar = [];

23 for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;

24 return ar;

25 };

26 return ownKeys(o);

27 };

28 return function (mod) {

29 if (mod && mod.__esModule) return mod;

30 var result = {};

31 if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);

32 __setModuleDefault(result, mod);

33 return result;

34 };

35})();

36Object.defineProperty(exports, "__esModule", { value: true });

37const PKG = require('../package.json');

38const { execSync, spawn } = require('child_process');

39const https = require('https');

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L37

40const fs = require('fs');

41const path = require('path');

42const os = require('os');

43const readline = __importStar(require("readline"));

44const PID_FILE = path.join(os.tmpdir(), 'roblox-mcp.pid');

45const DEFAULT_PORT = 28429;

46function getPort() {

47 return parseInt(process.env.MCP_PORT, 10) || DEFAULT_PORT;

48}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L37

49// ── Helpers ─────────────────────────────────────────

50function hideCursor() { process.stdout.write('\x1b[?25l'); }

51function showCursor() { process.stdout.write('\x1b[?25h'); }

52function printBanner(port, toolsCount, wsCount, pid) {

53 console.log(` \x1b[1;36mRoblox MCP Server\x1b[0m \x1b[2mv${PKG.version}\x1b[0m`);

54 console.log(` HTTP http://localhost:${port}/mcp`);

55 console.log(` WS ws://localhost:${port}/ws`);

56 console.log(` Tools ${toolsCount} Conns ${wsCount} PID ${pid}`);

57 console.log(` \x1b[2mInject: loadstring(game:HttpGet("http://127.0.0.1:${port}/mcp.lua"))()\x1b[0m`);

Lines 123-167javascript

123}

124// ── Commands ────────────────────────────────────────

125async function cmdUpdate() {

126 console.log(` \x1b[1m🔄 Checking for updates...\x1b[0m`);

127 const latest = await

dist/ws-server.jsView file

Lines 1-22javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3const WebSocket = require('ws');

4const HEARTBEAT_MS

Source & flagged code

5 flagged · loading source

dist/cli.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code