Roblox Bridge Agent (evonar543/roblox_bridge_agent) is an MCP server listed on the M8ven Trust Index. It scores 64 out of 100, grade C. It declares 79 tools. No publisher has claimed this listing.

C
Caution
64/100

Roblox Bridge Agent

A local-first MCP bridge and script operations layer that connects coding agents to authorized Roblox Luau development clients via websocket, enabling live execution, file watching, diagnostics, permission-gated script capsules, crash detection, and a dashboard.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

evonar543

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Tool descriptions don’t match what handlers do
1 tool describes read intent but its handler mutates — rba_script_preflight (line 1923: fs.mkdir(tmpRoot, { recursive: true }))
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
Open source with a license and README
Anyone can audit the code, the license is declared, and the publisher documents what it does.
// tools this server exposes79 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

rba_ws_start

Start the local RBA websocket bridge used by the Lua autoloader.

rba_ws_stop

Stop the local RBA websocket bridge.

rba_ws_status

Show websocket bridge status, connected clients, and recent client events.

rba_connection_info

Return the active RBA websocket host, port, URL, candidate URLs, and published connection-state checks.

rba_events

Read recent websocket/client events captured by RBA.

rba_clear_events

Clear buffered RBA events, optionally only those matching type/client filters.

rba_clients

List connected RBA websocket clients.

rba_health_check

Diagnose the shared RBA bridge, Instance Manager endpoint, connected clients, autoexec targets, recent errors, and optional eval/ping health.

rba_detect_roblox_crash

Read-only Roblox process and RBA heartbeat diagnosis. Reports healthy, bridge_disconnected, not_running, or likely_crashed without changing any process.

rba_restart_roblox

Safely restart RobloxPlayerBeta.exe: discover and verify the current/installed executable path, close only RobloxPlayerBeta processes, then launch the verified executable normally.

rba_development_snapshot

One development-oriented snapshot: RBA health, Roblox crash likelihood, autoexec state, and optional static script preflight. Does not execute the inspected script.

rba_unified_status

Verify the complete local workflow: RBA websocket service, Instance Manager connector endpoint, and every executor autoexec copy.

rba_agent_bootstrap

Prepare RBA for an agent session: start or attach the bridge, sync autoexec, optionally start dashboard, notify clients, and return health.

rba_notify_clients

Show an in-game RBA notification on connected Roblox clients.

rba_set_client_status

Update the in-game RBA status panel on connected Roblox clients.

rba_client_info

Show full details for one connected RBA websocket client.

rba_select_client

Set the default client used when a tool target is omitted.

rba_disconnect_client

Close one connected RBA websocket client.

rba_send_lua

Send Lua source text to connected development clients through the websocket bridge.

rba_send_lua_file

Send a Lua file from the RBA workspace to connected development clients.

rba_eval_lua

Run Lua and wait for structured return values or errors from connected clients.

rba_eval_lua_file

Run a workspace Lua file and wait for structured return values or errors from connected clients.

rba_execute_file

Execute a workspace Lua file in Roblox, either fire-and-forget send or eval with structured results.

rba_execute_bundle

Execute multiple workspace Lua files in order with syntax checks, optional delay, and stop-on-error control.

rba_lua_syntax_check

Run local Lua syntax validation with luac for a workspace file or provided source before sending to Roblox.

rba_ping_clients

Ping connected clients and return round-trip timing plus basic place/job details.

rba_install_debug_runtime

Install debug helpers on connected clients and return an initial runtime snapshot.

rba_probe_runtime

Run a built-in realtime probe such as summary, character, camera, players, environment, or datamodel.

rba_install_console_mirror

Mirror client print/warn output back to RBA events with a Roblox-safe rate limit.

rba_script_preflight

Statically inspect a workspace Lua file or provided source before execution: syntax, metrics, lifecycle/loop checks, dynamic loading, remote calls, and direct transform writes. Never executes the script.

rba_create_script_capsule

Create a named RBA script capsule: a permission-gated policy envelope around one workspace Lua file. Capsules preflight and snapshot source before dispatch; they do not claim to OS-sandbox code inside a Roblox executor.

rba_list_script_capsules

List registered script capsules and their explicit permissions, source file, timestamps, and policy-sandbox limitation.

rba_set_script_capsule_permissions

Replace a script capsule's explicit capability grants. The next capsule run is blocked when static source requirements are not granted.

rba_capsule_snapshot

Create a source snapshot for one script capsule. Use it as a time-travel restore point before an edit or experiment.

rba_list_capsule_snapshots

List time-travel source snapshots for one RBA script capsule.

rba_rollback_script_capsule

Restore a capsule source file from a selected snapshot. RBA captures the current source first as a safety snapshot.

rba_run_script_capsule

Preflight, permission-check, optionally snapshot, and then dispatch a script capsule. Missing required permissions block the run before any Lua reaches a client.

rba_git_status

Inspect the RBA workspace Git repository, selected branch/origin, changed and staged files, and the exact autoloader fingerprint without changing Git state.

rba_git_sync_files

Explicitly commit selected existing RBA workspace files and optionally push the current branch. It refuses to run with a pre-staged index and never uses git add --all, so unrelated scripts are not swept into a sync.

rba_uninstall_console_mirror

Restore print/warn after rba_install_console_mirror.

rba_wait_for_event

Wait briefly for the next websocket event, optionally filtered by type and client id.

rba_context_snapshot

Capture status, clients, recent events, runtime summary, and optional Roblox screenshot in one call.

rba_watch_file

Watch a workspace Lua file and auto-send or eval it in Roblox on change for live editing.

rba_start_live_session

Watch multiple workspace Lua files as one live-editing session and optionally run them once immediately.

rba_unwatch_file

Stop one active RBA file watcher.

rba_stop_all_watchers

Stop every active RBA live-edit file watcher.

rba_list_watchers

List active RBA file watchers.

rba_list_script_profiles

List script profiles from the workspace profile JSON file.

rba_run_script_profile

Run a named script profile from the workspace profile JSON file.

rba_set_autorun

Configure optional profile/file execution that runs automatically when a Roblox client connects.

rba_get_autorun

Show the current RBA autorun-on-connect configuration.

rba_dashboard_start

Start the local RBA dashboard HTTP server.

rba_dashboard_stop

Stop the local RBA dashboard HTTP server.

rba_list_presets

List built-in Lua websocket presets.

rba_run_preset

Run a built-in Lua preset on connected development clients.

rba_get_character_position

Return the local character position and CFrame from connected development clients.

rba_teleport_to_position

Teleport the local character to exact coordinates and remember the previous position.

rba_teleport_to_part

Teleport the local character to a Workspace BasePart or Model path, with an optional local offset.

rba_return_to_last_teleport

Return the local character to its position before the most recent RBA teleport.

rba_teleport_to_place

Teleport the local player to a Roblox place, optionally joining a specific public server job.

rba_write_file

Create or replace a file inside the RBA workspace.

rba_install_autoexec

Install the current RBA autoloader into an executor autoexec path, backing up any existing file first.

rba_sync_autoexec

Sync the workspace unified autoloader to one autoexec target, backing up changed content by default.

rba_sync_all_autoexec

Sync the same unified RBA and Roblox Instance Manager autoloader to every configured executor target.

rba_autoexec_targets

Show every configured executor autoexec target and verify its installed loader hash against the workspace source.

rba_list_autoexec_backups

List sidecar backups created for an autoexec target.

rba_restore_autoexec_backup

Restore an autoexec sidecar backup and preserve the currently installed file first.

rba_append_file

Append text to a file inside the RBA workspace, creating it when needed.

rba_read_file

Read a workspace file, capped to a safe byte limit.

rba_backup_file

Create a timestamped backup of a workspace file under .rba-backups.

rba_list_backups

List workspace file backups, optionally filtered to one original path.

rba_restore_backup

Restore a .rba-backups file, first backing up the current destination when it exists.

rba_batch_files

Run multiple workspace file operations in one call.

rba_list_windows

List visible desktop windows that can be used as screenshot targets.

rba_capture_window_screenshot

Capture a screenshot of a visible Windows process window and return it as an MCP image.

rba_capture_roblox_screenshot

Capture RobloxPlayerBeta.exe and return the screenshot as an MCP image for visual context.

rba_read_image

Read a workspace PNG/JPEG file and return it as an MCP image.

rba_list_files

List files inside the RBA workspace.

rba_search_files

Search text files inside the RBA workspace.

// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
configRBA_AUTOEXEC_INCLUDE_DEFAULTS
configRBA_AUTOEXEC_PATH
configRBA_AUTOEXEC_PATHS
configRBA_CAPSULES_PATH
configRBA_CONTROL_CONNECT_TIMEOUT_MS
configRBA_CONTROL_PROBE_BATCH_SIZE
configRBA_DASHBOARD_PORT
configRBA_EVENT_DATA_MAX_BYTES
configRBA_EVENT_LIMIT
configRBA_EVENT_LOG_FLUSH_MS
configRBA_FILE_IO_CONCURRENCY
configRBA_INSTANCE_MANAGER_SCRIPT_URL
configRBA_LOG_DIR
configRBA_LOG_MAX_FILE_BYTES
configRBA_LOG_ROTATIONS
configRBA_LOG_VALUE_DEPTH
configRBA_MAX_PENDING_LOG_LINES
configRBA_MAX_PORT_CANDIDATES
configRBA_PROFILES_PATH
configRBA_ROOTWorkspace file tools reject traversal outside .
configRBA_SEARCH_MAX_FILE_BYTES
configRBA_SYNC_AUTOEXEC
configRBA_WS_HOST
configRBA_WS_MAX_BUFFERED_BYTES
configRBA_WS_MAX_PAYLOAD_BYTES
configRBA_WS_PORT
configRBA_WS_PORT_RANGE
configRBA_WS_RATE_LIMIT
configRBA_WS_RATE_WINDOW_MS
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

79/79 tools missing one or more hints — rba_ws_start (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); rba_ws_stop (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); rba_ws_status (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +76 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Destructive tools are labelled

7 tools perform destructive updates without destructiveHint — rba_development_snapshot deletes at line 1946 (fs.rm(tempPath, { force: true })); rba_execute_file deletes at line 1946 (fs.rm(tempPath, { force: true })); rba_execute_bundle deletes at line 1946 (fs.rm(tempPath, { force: true }))

Add destructiveHint:true to any tool whose handler calls .delete(), .upsert(), .update(), unlink, rm, DELETE, DROP, REPLACE INTO, or any operation that overwrites existing data.

Descriptions match behaviour

1 tool describes read intent but its handler mutates — rba_script_preflight (line 1923: fs.mkdir(tmpRoot, { recursive: true }))

Rename the tool, rewrite the description, or move the side-effect into a separate clearly-named tool.

Tool inputs are validated

78/79 tool handlers declare input schemas (99%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool test coverage

Only 6/79 tools referenced in tests (8%)

Write tests that reference each tool by name so every tool has at least one test.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 6 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/evonar543/roblox_bridge_agent?variant=verified)](https://m8ven.ai/mcp/evonar543/roblox_bridge_agent)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: ccc5239fe44de34ffa2d9a65856953630693f023
code hash: 3eb22d3a2daf726471639e15dc0a204e1adbb3b3a6af96b4a016879b6dc51be4
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client