Roqer MCP Server

Findings (33)

• highHigh. Something risky that needs a close look before you install.
  secrets issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  packages/core/src/install-plugin-helpers.ts:83
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  packages/core/src/install-plugin-helpers.ts:89
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  scripts/publish.mjs:13
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/client@2.0.0: 2 known vulnerabilities

  GHSA-6prh-2h8m-c8cw, GHSA-6qxp-vccf-f47h

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/node@2.0.0: 1 known vulnerability

  GHSA-f897-62hf-6gxq

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  @modelcontextprotocol/server@2.0.0: 4 known vulnerabilities

  GHSA-46jr-4wx8-v453, GHSA-f897-62hf-6gxq, GHSA-jm63-cq47-j5jp, GHSA-rvq5-wwqv-78pq

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  body-parser@1.20.8: 1 known vulnerability

  GHSA-27r3-jxmh-p828

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@1.1.18: 3 known vulnerabilities

  GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@2.1.4: 3 known vulnerabilities

  GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  brace-expansion@5.0.9: 3 known vulnerabilities

  GHSA-6j4f-fj2g-mc7p, GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  electron@44.0.0: 8 known vulnerabilities

  GHSA-2p8c-gr87-2676, GHSA-3qxv-5xgr-q7w9, GHSA-98mx-cjp9-gchm, GHSA-997q-gvvc-jwmx, GHSA-fw47-9c62-h3vw +3 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  source-map-js@1.2.1: 1 known vulnerability

  GHSA-68fv-2mgg-jv7q

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@6.28.1: 5 known vulnerabilities

  GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-9fm3-97px-rjf6, GHSA-qrxm-fqhp-jwvm, GHSA-xjj6-f33q-929c

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@7.29.0: 18 known vulnerabilities

  GHSA-2gqq-gqf2-x968, GHSA-2jfj-6hjv-fm6j, GHSA-2m5v-pch6-74hx, GHSA-3wwx-pv8p-q78v, GHSA-3xpg-4rpp-hhhm +13 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  vite@8.2.2: 6 known vulnerabilities

  GHSA-587h-7wmj-h5pm, GHSA-698v-4r3x-3vcv, GHSA-9jrq-w75r-8gcw, GHSA-r825-w8mm-5pxw, GHSA-rq7h-c2jc-7f22 +1 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@4.4.3: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  apps/desktop/agent/skills/roblox-physics/references/full.md:286
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  apps/desktop/runtime/custom-provider.test.ts:64
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  apps/desktop/runtime/mcp-server-store.test.ts:78
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  5 matches in this file

  apps/desktop/runtime/model-api/model-api.test.ts:90
• lowLow. Minor, or common in normal tools. Shown for information.
  @hono/node-server@1.19.17: 1 known vulnerability

  GHSA-rmxm-3fg6-px4f

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  deepmerge@4.3.1: 1 known vulnerability

  GHSA-gcqx-w48m-w2h4

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  fast-uri@3.1.7: 5 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-hrr3-gc8f-f4qj, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  hono@4.13.9: 1 known vulnerability

  GHSA-5r4p-p66f-jhc7

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.6: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@9.0.9: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  qs@6.16.0: 1 known vulnerability

  GHSA-6pq8-jhm2-2vcw

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  fast-uri@3.1.8: 4 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h

  studio-plugin/package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)
• lowLow. Minor, or common in normal tools. Shown for information.
  Contacted these domains while starting up (no manifest to compare against)

  registry.npmjs.org

Network activity

Tools exposed (52)

• get_place_info

  Use when you need the current place's identity or settings.

• search_objects

  Use to find instances by name, class, or property value.

• get_instance_properties

  Use to inspect properties.

• get_project_structure

  Use to inspect a subtree.

• set_properties

  Use to set properties atomically.

• animation

  Use to check, build, publish, wire, or verify animations for R15, R6 or a model, or rig one.

• build_instances

  Use to build, edit, remove, or scatter instances atomically under one root.

• get_script_source

  Use to read script source.

• set_script_source

  Use to replace full script source safely.

• edit_script_lines

  Use for an exact, localized replacement in one script.

• edit_script_batch

  Use for several exact, non-overlapping replacements in one script, applied as one transaction.

• insert_script_lines

  Use to add source after a known line in one script.

• delete_script_lines

  Use to remove a known inclusive line range from one script.

• get_attributes

  Use to inspect every attribute on one instance.

• selection

  Use to get, set, open, or frame Studio context.

• execute_luau

  Use for custom Studio traversal, edits, or peer execution.

• eval_server_runtime

  Use to run Luau in the live server VM with its require cache.

• eval_client_runtime

  Use to run Luau in a live client VM with its require cache.

• grep_scripts

  Use to locate text or Lua pattern matches across script sources.

• manage_instance

  Use to manage Studio processes, list place revisions, or link a Rojo project.

• solo_playtest

  Use to start, stop, or inspect a single-player Studio playtest.

• set_network_profile

  Use to simulate client latency, jitter, or packet loss.

• get_simulation_state

  Use to inspect current network and device simulation.

• reset_simulation_state

  Use to clear network and device simulation state.

• get_device_simulator_state

  Use to inspect device simulation or list device presets.

• set_device_simulator

  Use to manage device simulation in edit or a playtest client.

• capture_device_matrix

  Use to compare viewport screenshots across up to six device settings.

• multiplayer_playtest

  Use to run or inspect a multi-client Studio playtest.

• get_runtime_logs

  Use to read recent Studio output from edit, server, or client peers.

• capture_script_profiler

  Use to find Luau CPU hotspots on a running server or client.

• capture_micro_profiler

  Use to profile engine and game frame time on a live peer.

• breakpoints

  Use to trace script execution with breakpoints or logpoints.

• get_connected_instances

  Use to discover connected places and the roles available in each.

• search_assets

  Use to find public Creator Store assets by type or keyword.

• get_asset_details

  Use to inspect a shortlisted Creator Store asset.

• get_asset_thumbnail

  Use when an asset thumbnail would help with visual review.

• insert_asset

  Use to sanitize and insert a Creator Store asset into a Studio place.

• generate_model

  Use to stage a Roblox model from text or an image.

• preview_asset

  Use to inspect an asset's hierarchy and media without inserting it.

• upload_asset

  Use to upload a local asset or check a previous upload operation.

• capture_screenshot

  Use to capture the Studio viewport or map input coordinates.

• inspect_ui

  Use to inspect or audit semantic UI rendered by a live playtest client.

• interact_ui

  Use to interact with semantic UI on a live playtest client.

• simulate_mouse_input

  Use to click the live playtest viewport at known pixel coordinates.

• simulate_keyboard_input

  Use to send key presses or text to a live playtest client.

• get_memory_breakdown

  Use to compare memory categories across Studio peers.

• get_scene_analysis

  Use to attribute scene cost across instances and content.

• export_rbxm

  Use to save selected DataModel instances as a local .rbxm file.

• import_rbxm

  Use to load a local, remote, or inline .rbxm under a chosen parent.

• find_and_replace_in_scripts

  Use to preview or apply one replacement across scripts.

• get_roblox_skills

  Use to read installed Roblox Studio Assistant skills.

• get_roblox_docs

  Use to read official Roblox engine or Luau references.