This page sketches what you can and cannot do when extending Roblox with code. It focuses on Luau scripting Studio plugins Open Cloud and external services. # Core Scripting Model Roblox games are built with Luau a sandboxed dialect of Lua that runs inside the Roblox engine Luau scripts can manipulate the 3D world UI and game logic but cannot reach the host file system or run native code All in game logic lives in - Script and LocalScript instances - ModuleScripts for shared libraries - Services such as DataStoreService HttpService and others There is no way from Luau to run arbitrary operating system commands access local files or load native libraries # Studio Plugins Roblox Studio supports plugins which are Luau scripts that extend the editor not the live game A plugin can - Add custom tools panels and widgets in Studio - Generate or modify parts terrain and lighting in a place - Help import or organise assets and models - Use HttpService to talk to external tools during editing if enabled A plugin cannot - Change how the Roblox client or engine works in live games - Give live servers extra privileges outside the normal API - Break the Luau sandbox and access the developer file system arbitrarily Plugins are distributed through the Creator Store and are installed by creators inside Studio # Open Cloud And External Tools Roblox Open Cloud exposes REST APIs that let external tools manage Roblox resources External services can - Read and write DataStores via authenticated API keys - Upload and update assets such as models decals audio and some other types - Publish and version places as part of a CI pipeline - Read analytics style data and automate creator workflows External tools never run inside the Roblox client or server process They talk to Roblox resources over HTTPS with rate limits and scoped API keys # HttpService From Games Inside a running experience HttpService lets server side Luau scripts call third party HTTPS endpoints Typical uses - Sending gameplay events to analytics backends - Talking to a custom backend for leaderboards or matchmaking - Fetching configuration or content from your own APIs Key constraints - Around 500 HTTP requests per minute per game server before throttling or failures - Only HTTPS not raw TCP or UDP and no direct WebSocket support - No direct authenticated access to Roblox website endpoints such as account APIs - Requests are sent from the server context not from individual player machines This keeps external integration possible but bounded so games remain secure and predictable # What You Can Build Technically Within these boundaries you can build - Complex gameplay systems with thousands of lines of Luau code - Shared libraries of ModuleScripts reused across places - Studio plugins that scaffold Hitchhiker ready worlds and tools - Backend services that track things like Voz or a Hitchhiker Passport - Dashboards that read player progress from DataStores through Open Cloud - Asset pipelines that auto upload models textures and audio into Roblox All of this respects the Roblox sandbox and uses official APIs # What You Cannot Do Some things are out of reach by design - No custom Roblox client forks or native mods distributed through your game - No access to player file systems webcams microphones or hardware beyond what the client already exposes - No arbitrary file I O from Luau such as reading or writing local JSON or world files - No loading arbitrary bytecode or native binaries into the Luau VM - No raw sockets or custom network protocols only HTTPS via HttpService - No direct scraping or privileged access to Roblox web services from in game code If a design depends on changing the engine running your own client or bypassing these limits it does not fit the Roblox extension model # Extension Patterns For Hitchhiker Style Projects For a Hitchhiker style ecosystem the recommended pattern is - Use Luau modules inside each experience for gameplay logic and Guide style UI - Use Studio plugins to help creators Hitchhiker enable their worlds - Use HttpService to send lightweight events to an external Hitchhiker backend - Use Open Cloud to let that backend read write DataStores and manage shared assets With this pattern you can build rich cross game systems while remaining fully inside Roblox technical and policy boundaries