BloxForge is a local development tool. It runs entirely on your machine and communicates with Roblox Studio over a localhost HTTP bridge. No cloud service, no telemetry, no external network calls for core functionality.

• The MCP server binds to 127.0.0.1 by default. A non-loopback --host is rejected unless BLOXFORGE_SESSION_TOKEN is set.
• Bridge callbacks use per-plugin bearer session tokens issued by /ready. /ready is the unauthenticated bootstrap route; /poll, /response, /ack, /reconcile, /stream, and /disconnect require that plugin token.
• Server-client routes (/proxy, /instances, /cancel, request-status lookup, /mcp, and /mcp/*) require the configured server token. Local diagnostics (/health, /status, and /dashboard*) are public only in the zero-configuration loopback mode and are protected whenever server authentication is configured.
• Machine-control routes accept JSON only and reject browser Origin requests. CORS alone is not treated as CSRF protection. MCP_CONTROL_BODY_LIMIT controls small control bodies; MCP_HTTP_BODY_LIMIT controls large MCP and response payloads.
• The AI agent operates Roblox Studio with the permissions of the Studio plugin — same as any plugin from the Toolbox.
• execute_luau runs arbitrary Luau code in the plugin context. Only use this on places you own.
• The safety layer (dry-run, confirmation gating, backups, limits) is a defense-in-depth measure, not a guarantee.

If you find a security issue, please do not open a public issue. Instead, report it privately to the maintainer through GitHub's security advisory system:

https://github.com/princeofscale/bloxforge/security/advisories/new

BloxForge separates lazy schema discovery from authorization. Loading a toolset only changes schema visibility; it never grants a tool denied by the active profile or capability policy.

To restrict capabilities further, use the --profile flag when starting the server:

• --profile core: Standard permissions; only the initial schema set is small.
• --profile inspector: Studio and local-file reads only. Studio writes, arbitrary Luau, local-file writes, local process execution, external network access, uploads, and playtest control are disabled.
• --profile builder: Allows building operations but restricts arbitrary script execution, including assertion expressions and assertion-bearing playtest episodes.
• --profile tester: Allows runtime environment interactions, script execution, and scene reads, but disables pure asset building.
• --profile full: Authorizes and preloads all available tool domains.

Invalid profile names fail startup. The dedicated inspector package filters on declared effects rather than the legacy read/write category, so a tool such as sync_pull cannot enter the package merely because it does not mutate Studio.

Prefer environment variables for secrets. The compatibility flags --session-token, --open-cloud-key, and --pollinations-key remain available but warn because command-line values may be visible in shell history and process listings.

Quality-tool file arguments are canonicalized inside BLOXFORGE_PROJECT_ROOT; escaping symlinks, traversal, absolute paths outside the root, and option-shaped file names are rejected before an external command starts.

Rojo source tools use the same canonical, symlink-aware boundary. Source writes require optimistic content hashes, use an atomic temporary-file rename, and create recovery backups for deletion or reverse synchronization. Managed rojo serve processes bind to loopback only, have bounded logs, and are stopped with BloxForge. Studio-to-files synchronization is preview-first and never silently overwrites a conflicting local edit.

Plugin downloads require credential-free HTTPS, follow a bounded redirect chain, enforce timeout and size limits, and verify the compiled plugin variant and version before atomically replacing an installed file. Repository builds do not install plugins unless MCP_PLUGINS_DIR is explicitly set.

1. Use --profile inspector for browsing or debugging — it has no write capability.
2. Dry-run before confirming mutations when possible.
3. Keep Roblox Studio and this project updated.
4. Only connect to places you own.
5. Review what the AI proposes before confirming destructive steps.
6. Commit your Roblox Studio place to version control or save backups frequently.