rblxtool

Download

What it does

• Free sweep - walks every catalog category and subcategory in parallel, batches 120 items per detail call, and buys everything priced at zero it does not already own. Scan, detail and purchase run as three independently bounded stages so scanning never blocks on buying.
• Limited sniper - polls reseller listings for a target list and buys the moment a listing drops under your ceiling, either an absolute price or a fraction of the item's recent average price. A release watcher can also buy brand new limiteds the moment they appear in the catalog.
• Ownerless group finder - sweeps group id ranges 100 at a time through the batch endpoint, keeps everything with no owner, optionally reads member count and entry policy, and can join and claim ownership automatically.
• Account tools - Robux, RAP, inventory value, collectibles, friends, followers, presence, trades, avatar control, bulk group leaving and bulk favouriting.

Three ways to add an account

• Session cookie - paste .ROBLOSECURITY. Full purchasing surface, no captcha, survives restarts. Recommended.
• Username, password and 2FA - a small login window posts to auth.roblox.com/v2/login, handles the two step challenge, and finishes through the v3 two step login endpoint. When Roblox raises a FunCaptcha the tool surfaces the challenge id and Arkose key rather than pretending it worked.
• OAuth 2.0 authorize with PKCE - the Open Cloud consent flow, like authorising a bot. It works, but the granted scopes are read only, so purchasing and claiming stay disabled on these accounts. Included because it was asked for, flagged because it is the weakest option.

Accounts live in an AES-256-GCM vault keyed with Argon2id.

Why it is fast

• One pooled hyper client over rustls with ALPN negotiated HTTP/2, adaptive flow control windows and keep-alive pings. Connections are reused across every Roblox host, so there are no repeated TLS handshakes.
• The rate limiter reads x-ratelimit-limit and x-ratelimit-remaining off every response and retunes each per-host token bucket to the quota actually granted. On a throttled datacenter IP this took a benchmark from 2 of 40 requests succeeding to 40 of 40.
• simd-json with a serde_json fallback, measured at 689 MB/s and 25 microseconds per 60 item catalog page.
• mimalloc, fat LTO, a single codegen unit, panic abort. The desktop shell publishes with Native AOT and source generated JSON, so there is no JIT warm up and no reflection.

Rate limits, measured

From a datacenter IP with no session, measured directly:

• catalog.roblox.com/v1/search/items - 1 request per 60 seconds
• groups.roblox.com/v2/groups - 1 request per second, 100 group ids per call
• users.roblox.com/v1/users/{id} - 30 requests per 60 seconds

A signed in session from a residential address opens these up substantially. The limiter adapts either way, but the sweep is close to useless anonymously and works properly on a real account.

Layout

• crates/rblx-core - the engine: HTTP, auth, API surface, ops, encrypted vault
• crates/rblx-cli - rblxtool, the full featured command line client
• crates/rblx-ffi - rblx_core.dll / librblx_core.so, the C ABI
• ui/RblxTool - the WinUI 3 desktop application

The CLI and the desktop app are the same engine; the CLI is what gets tested against the live API.

Source

Browse the whole tree in the reader below, or take the archive above.

Open source browser