# rblxtool

A performance-first Roblox API toolkit: a native Rust core that does all of the
networking, and a WinUI 3 desktop shell that never touches the network itself.

```
crates/rblx-core   engine: http, auth, api surface, ops, encrypted account vault
crates/rblx-cli    rblxtool / rblxtool.exe - full featured command line client
crates/rblx-ffi    rblx_core.dll / librblx_core.so - C ABI for the desktop shell
ui/RblxTool        WinUI 3 (Windows App SDK 1.6, Native AOT) desktop application
```

## Why it is fast

- **Pooled HTTP/2 over rustls.** One `hyper` client, ALPN negotiated h2, adaptive
  flow control windows, keep-alive pings, connection reuse across every Roblox
  host. No per-request TLS handshakes.
- **Header driven rate control.** Every response is inspected for
  `x-ratelimit-limit` / `x-ratelimit-remaining`; the per-host token bucket
  retunes itself to the quota Roblox actually granted this IP and this session.
  That is the difference between 2 of 40 requests succeeding and 40 of 40.
- **SIMD JSON decoding.** `simd-json` with a `serde_json` fallback: ~690 MB/s and
  ~25 us per 60 item catalog page on a single core.
- **Pipelined ops.** The sweep runs catalog paging, 120 item detail batching and
  purchasing as three independently bounded concurrent stages joined by channels,
  so scanning never waits on buying.
- **mimalloc**, fat LTO, one codegen unit, panic abort.

## Accounts

Three ways in, in order of capability:

1. **Session cookie** - paste `.ROBLOSECURITY`. Full purchasing surface, no
   captcha, survives restarts. This is the recommended path.
2. **Username, password, 2FA** - `auth.roblox.com/v2/login`, then the two step
   challenge and `v3/.../two-step-verification/login`. Roblox frequently answers
   with a FunCaptcha challenge, which the tool surfaces (challenge id, Arkose
   public key, data blob) instead of pretending it succeeded.
3. **OAuth 2.0 authorize** with PKCE - Open Cloud. Works, but the granted scopes
   are read only, so sweeps, snipes and group claims stay disabled on these
   accounts. Included because it was asked for, not because it is useful here.

Accounts are stored in an AES-256-GCM vault, key derived with Argon2id. Supply a
passphrase or let it use a `0600` local key file.

## Command line

```
rblxtool account add-cookie [cookie] [--label name]
rblxtool account login <user> [--password p] [--code c]
rblxtool account list | use <id> | remove <id> | verify

rblxtool sweep [--dry-run] [--no-buy] [--max-price 0] [--categories Accessories:Hat]
rblxtool snipe --targets 1234,5678:750 [--under-rap 0.7] [--watch-releases]
rblxtool groups hunt [--start 1] [--end 200000] [--claim] [--min-members 1]

rblxtool item <assetId> | search <keyword> | user <name> | group <id> | me
rblxtool bench [--rounds 12] [--parse-rounds 20000]
```

Every command takes `--json` for machine readable output.

## Building

Core, CLI and the shared library, on Linux or Windows:

```
cargo build --release
cargo build --release --target x86_64-pc-windows-gnu
```

The desktop shell needs Windows with the .NET 8 SDK and Windows App SDK 1.6:

```
pwsh ui/build.ps1
```

`build.ps1` compiles the Rust core, drops `rblx_core.dll` next to the app and
publishes a self contained Native AOT build.

## Rate limits you will actually hit

Measured from a datacenter IP, unauthenticated:

| endpoint | quota |
| --- | --- |
| `catalog.roblox.com/v1/search/items` | 1 request / 60 s |
| `groups.roblox.com/v2/groups` (100 ids per call) | 1 request / s |
| `users.roblox.com/v1/users/{id}` | 30 requests / 60 s |

Signed in, from a residential IP, these open up substantially. The limiter reads
the headers and adapts either way; the sweep is close to useless anonymously and
works properly on a real session.

## Notes

Automating purchases and group claims against your own account is at your own
risk: Roblox may rate limit or action accounts that behave like bots. The tool
defaults to conservative concurrency and honours every throttle it is told about.