The Studio MCP server can call Open Cloud APIs on your behalf. After you connect an MCP client, it can upload assets, manage developer products and game passes, change game settings, and more without an API key.
You choose which actions the client can take. Studio saves those permissions to your Roblox account for each game and enforces them on every request.
Prerequisites
Before you use Open Cloud with the Studio MCP server:
- Enable the Studio MCP server and connect your client. For more information, see Connect to the Roblox Studio MCP server.
- Open a place that belongs to a published game. Permissions are saved per game, so unpublished local places can't use them.
- Have permission to manage the game. If a group owns the game, your group role must allow the actions you grant to the client.
How it works
The Studio MCP server exposes an open_cloud_invoke tool that sends Open Cloud requests with an access token managed by Studio. The token includes only the scopes you've enabled for the current game. Your MCP client never sees or handles credentials.
| Parameter | Description |
|---|---|
| method | GET, POST, PUT, PATCH, or DELETE. |
| endpoint | The path under https://apis.roblox.com, including any query string. For example, /cloud/v2/universes/123. |
| body | A JSON-encoded request body. Omit for GET and DELETE. |
| scopes | The scopes the endpoint requires, such as ["universe:read"]. Optional, but returns a clear error if a required scope isn't enabled. |
| files | Local files for multipart/form-data endpoints, such as asset uploads. Files must be in an approved upload folder. |
Permissions are per person. Collaborators each set their own permissions. Enabling a permission for yourself doesn't enable it for anyone else. These permissions apply only to external MCP clients. They don't change what Assistant can do inside Studio.
Manage permissions
To manage permissions for the game you have open:
- Open Assistant.
- Click … ⟩ Settings.
- Select the MCP Permissions tab.
- Enable or disable permissions. Changes apply to the client's next request.
Permission sections
Permissions are grouped by the actions they allow. Each section maps to one or more Open Cloud scopes or script capabilities.
| Section | What it allows | Scopes |
|---|---|---|
| Look at your game | Read game and place settings, version history, analytics, and instances. | universe:read, universe.place:read, universe.analytics:read, universe.place.instance:read |
| Edit your game | Change game and place settings, publish, restart servers, and edit instances remotely. | universe:write, universe.place:write, universe.place.instance:write |
| Players & social | Read profiles and inventories, send notifications, manage groups and forums, manage events, and read saved Creator Store items. | user.*, group:*, group-forum:read, universe.event:*, creator-store-save:* |
| Save & load data | Use DataStoreService and MemoryStoreService from execute_luau. | universe-datastores.*, universe.ordered-data-store.*, memory-store.* |
| Connect to the internet | Make HTTP requests from Luau to domains you allow, and publish cross-server messages. | Network capability, universe-messaging-service:publish |
| Publish & manage assets | Upload assets and check their status, share assets, manage Creator Store listings, publish place versions, and manage thumbnails. | asset:*, asset-permissions:write, creator-store-product:*, universe-places:write, universe.thumbnail:* |
| Money & monetization | Create and edit developer products, game passes, and ad campaigns, and read subscriptions. | developer-product:*, game-pass:*, ad.campaign:*, ad.billing:read, universe.subscription-product.subscription:read |
| Player consequences | Read, create, and remove bans. | universe.user-restriction:* |
| Security & credentials | Read secret names and create secrets, and run Luau in the cloud. | universe.secret:*, universe.place.luau-execution-session:* |
Some permissions can cost Robux, affect players, or publish changes to your live game. These include Money & monetization, Player consequences, Security & credentials, universe:write, and universe-places:write. Enable them only for tasks that require them, and disable them when you finish.
Upload folders
The client can upload files only from folders you approve. Add a folder before you ask the client to upload assets, and keep exports in that folder.
The client can't copy or move files into an approved folder to bypass this restriction. If a file is elsewhere, move it yourself or approve its folder.
Data stores and memory stores
The client accesses data stores and memory stores through DataStoreService and MemoryStoreService in execute_luau, not through Open Cloud. To use them:
- Enable the scopes you need under Save & load data. Reads require universe-datastores.objects:read. Writes require universe-datastores.objects:update.
- In Game Settings ⟩ Security, enable Enable Studio Access to API Services. This game setting is separate from your MCP permissions.
Studio uses your live data stores. Writes from the client change real player data. Test against a separate game first when possible.
HTTP requests
To let scripts that the client runs make HTTP requests with HttpService:
- Add each domain the client needs to the HTTP domain allow list.
Studio denies requests to any domain that isn't on the list.
Unavailable permissions
Some scopes can't be granted to an MCP client. These include badge scopes, universe-datastores.control:*, universe-datastores.objects:create, analytics alerts, and all legacy-* scopes. Use the Creator Dashboard or an API key for these tasks.
Some endpoints also reject the token Studio uses, even when the matching scope is enabled. If that happens, the client reports the error and suggests another way to complete the task.
Import a 3D model
A common workflow is to import assets from Blender, Maya, or another 3D tool. The client exports the model, uploads it, inserts it into Studio, then compares the result to the source and fixes differences introduced by the import.
To import a model:
- Enable Publish & manage assets ⟩ asset:read and asset:write.
- Approve the folder that contains your exports.
- Open the model in your 3D tool, or export it as .glb or .fbx into the approved folder.
- Prompt your client. For example, Import the castle from my open Blender file into Studio, next to the spawn point.
The client confirms before uploading, then:
- Checks each mesh against the triangle limit and asks whether to split or simplify any that exceed it.
- Uploads the model and waits for moderation.
- Inserts the model and fixes scale, rotation, missing textures, colors, and anchoring.
- Places the model on the ground, clear of other objects and spawn points.
Uploads create permanent assets owned by the game's creator. Open Cloud can't archive or delete them. To remove an asset, use the Creator Dashboard.
For supported asset types, formats, and size limits, see the Usage guide for assets.
Skills
The following skills teach the client how to use these permissions. The client loads them with the skill tool.
| Skill | Description |
|---|---|
| rbx-open-cloud-usage | Calls Open Cloud with open_cloud_invoke, selects the correct endpoint, and handles errors. |
| rbx-permissions | Determines which permissions a task needs, checks which are enabled, and asks you for only the missing ones. |
| rbx-import-asset | Imports a model from an external 3D tool, then checks and fixes it in Studio. |
Skills are plain text files. You can copy them, adapt them to your workflow, and add them to your client.
Troubleshooting
When a request is blocked, the client reports what's missing. It never bypasses a permission you've disabled.
| Error | Cause | Fix |
|---|---|---|
| Scope '<scope>' has not been granted | The scope is disabled, or the name is misspelled. | Enable the scope in the matching section. |
| HTTP 403 or 401, with the scope enabled | The endpoint doesn't accept the MCP token. | Use the Creator Dashboard or an API key for this task. |
| lacking capability <capability> | A script needs a capability that isn't granted. | Enable Connect to the internet for Network. Other capabilities can't be granted. |
| domain <domain> is not in the Assistant HTTP allowlist | The domain isn't on your allow list. | Add it under Connect to the internet ⟩ HTTP domain allow list. |
| 502 … Access forbidden from a data store call | The matching Save & load data scope is disabled. | Enable the read or update scope. |
| Studio access to APIs is not allowed | Studio API access is disabled for this game. | Enable Game Settings ⟩ Security ⟩ Enable Studio Access to API Services. |
| InternalError from a memory store call | The memory-store.* scopes are disabled. | Enable the memory store scopes under Save & load data. |
| File not in an approved upload directory | The file is outside your approved folders. | Approve the folder, or move the file into one. |