$npx -y skills add TabooHarmony/roblox-brain --skill roblox-networkingUse when validating RemoteEvent or RemoteFunction arguments, adding rate limits, designing server-authoritative systems, or preventing exploits.
| 1 | # roblox networking |
| 2 | |
| 3 | ## When to Load |
| 4 | |
| 5 | Load when adding a remote, handling untrusted client input, implementing cooldowns, or deciding which side owns a gameplay result. |
| 6 | |
| 7 | ## Quick Reference |
| 8 | |
| 9 | - Treat every client argument as attacker-controlled input. |
| 10 | - Validate type, size, ownership, state, distance, and cooldown on the server. |
| 11 | - Look up prices, damage, rewards, and permissions from server-owned definitions. |
| 12 | - Choose the authority model before designing movement or continuous simulation. Server Authority uses client input prediction and server rollback; it is not the same thing as handing a part to a client with `SetNetworkOwner`. |
| 13 | - For simulation-affecting input in Server Authority, use `InputAction`/`InputContext` and `RunService:BindToSimulation()` rather than feeding continuous input through a `RemoteEvent`. |
| 14 | - Use events for most gameplay requests. Keep `RemoteFunction` calls short and bounded. |
| 15 | - Use `RemoteEvent` for reliable state changes within its event channel. Do not assume a RemoteEvent is ordered with property or attribute replication; use one explicit state channel or version the state when ordering matters. Use `UnreliableRemoteEvent` only for replaceable or ephemeral data such as VFX and continuous snapshots. |
| 16 | - Unreliable does not mean automatically faster: delivery is unordered, packets may be dropped, and payloads should stay at or below the documented 900-byte limit. |
| 17 | - Measure payload size and fire rate under load. Do not treat a community packet-size estimator as an official wire-format specification. |
| 18 | - Validate numeric inputs for NaN and infinity before applying range checks. `NaN` makes ordinary `<` and `>` checks return false. |
| 19 | - Rate limits protect the server, but validation must still reject invalid requests. |
| 20 | - Record suspicious behavior and use thresholds. Do not punish a player for one malformed packet. |
| 21 | |
| 22 | **Need the details?** Load `references/full.md` for reusable validation and throttling patterns. |