Fullstack LuaVM · Pro

LuaVM

Write Lua 5.4 with live Roblox data, supported Instance editing, Drawing, HTTPS, workspace modules, input, tasks, and checked memory.

Lua 5.4API 1.3Heap 64 MBHTTP HTTPS only

Language guide

Understand the runtime before the API.

Start with the part you need. Each section explains what LuaVM provides and links into the exact reference category.

Language and executionLuaVM runs Lua 5.4 and includes the compatibility helpers most external Roblox scripts expect.

Lua 5.4

Standard Lua functions, modules, metatables, coroutines and ordinary Lua syntax.

Luau compatibility

Common math, table, string, environment and timing helpers are available where they map cleanly to Lua 5.4.

Fresh runs

Each Execute starts a new VM. Stop ends its tasks, signals, drawings and owned runtime state.

Capability checks

getcapabilities() shows what the current external runtime supports before a script uses it.

Open related API

Classes and servicesThe global game model exposes live Roblox state alongside Nova-provided service behavior.

Live model

game, Workspace, Players, Lighting and reachable Instances read from the attached client.

Runtime services

RunService, HttpService, UserInputService, TweenService and StarterGui expose supported external behavior.

Instance classes

Instance.new creates supported classes available in the attached Roblox client.

Properties and events

Readable properties, checked edits and supported signals use the same Instance objects throughout LuaVM.

Open related API

DatatypesNova implements the Roblox-style values used by properties, Drawing and common scripts.

Vectors and colors

Vector2, Vector3 and Color3 include their normal constructors, properties and common operations.

Transforms

CFrame supports construction, orientation, interpolation and world/object-space transforms.

Layout values

UDim, UDim2, Rect and NumberRange can be created and passed to compatible properties.

Runtime values

Instance, EnumItem and Drawing objects keep their own readable type names through typeof().

Open related API

EnumsEnum values use the familiar Enum.Group.Item shape across properties, input and UI code.

Enum access

Read an enum with paths such as Enum.KeyCode.Insert or Enum.HighlightDepthMode.AlwaysOnTop.

Property values

Enum items can be read from supported properties and assigned back when the property accepts that enum.

Input names

Keyboard APIs accept virtual-key values, familiar key names and supported Enum.KeyCode values.

Open related API

Tasks, signals and DrawingLong-running scripts can schedule work, observe supported state and keep overlays alive between frames.

Tasks

task.spawn, defer, delay and wait return cancellable work that stays owned by the current run.

Signals

Connect, Once, Wait and Disconnect are available on Nova-owned and supported live signals.

Drawing

Create lines, text, shapes and images with pointer events, hit testing and world-to-screen projection.

Open related API

Permissions and boundariesPowerful host access stays explicit, and unsupported injected-only behavior is reported honestly.

Per-function access

HTTP, workspace, host input, clipboard and native dialogs each have their own permission.

Protected Roblox access

Memory and supported Instance changes use Nova's normal plan, session and target checks.

External runtime

LuaVM does not claim injected closure hooks, internal engine events or other capabilities it cannot provide reliably.

Open related API

LuaVM workspace

More than a script box.

Editor, startup, community and Explorer tools stay grouped here until you choose what to open.

Editor and consoleA focused Lua workspace with completion, diagnostics, script tabs, output filters and run controls.

Live completion

Suggestions combine the LuaVM API catalog with reachable Instance paths and supported properties.

Editing tools

Line numbers, find, smart indentation, pair closing, occurrence highlights and syntax diagnostics stay built in.

Run controls

Execute, Stop and Clear keep script output and owned runtime work easy to manage.

Managed autoexecRun reviewed scripts automatically at the right point in Nova's startup flow.

Global and per-game

Keep shared scripts separate from scripts that belong to the current place.

Readiness choices

Wait for attachment, the game, or the local player instead of relying on a fixed startup delay.

Review and quarantine

Nova shows what will run and isolates scripts that no longer meet the saved review state.

Community scriptsFind scripts from inside Nova without turning the editor into an unfiltered paste bin.

Moderated catalog

Browse verified and unverified views, search the catalog and inspect a script before opening it.

Open in editor

Bring source into your own tab so you can read, adjust and run it on your terms.

Community submissions

Submit useful scripts for review directly from the LuaVM workspace.

Live ExplorerMove through the current DataModel and understand the Instances LuaVM can reach.

Hierarchy

Search the live tree and copy exact Instance names, paths or addresses.

Properties

Inspect supported values and edit writable properties from a focused property view.

Shared context

Explorer paths and properties feed the Lua editor's live suggestions.

Script source viewerRead supported in-game script source in a dedicated, syntax-highlighted view.

Supported scripts

Open available LocalScript, ModuleScript and Script source from Explorer.

Readable layout

Line structure, long strings and comments remain clear in the focused source window.

Copy when useful

Copy the visible source into your own workspace without crowding the Explorer tree.

Download gameExport the current place into an RBXL snapshot for offline inspection.

Place structure

Preserve supported Instances, parts and properties in a standard place file.

Scripts and assets

Include available script source and supported appearance assets where Nova can read them.

Safe replacement

Nova finishes the new snapshot before replacing an existing export.

Build by example

Learn one pattern at a time.

Open a focused recipe, run it as-is, then follow its reference link when you want the complete API.

Read live state and drawStart with services, Instances, Roblox-style datatypes and one retained Drawing object.

What this teachesServices · Instance paths · Vector2 · Color3 · Drawing

print(identifyexecutor())

local Players = game:GetService("Players")
local localPlayer = Players.LocalPlayer
local character = localPlayer and localPlayer.Character

if character then
    local root = character:FindFirstChild("HumanoidRootPart")
    print("Root position:", root and root.Position)
end

local marker = Drawing.new("Circle")
marker.Position = Vector2.new(280, 220)
marker.Radius = 24
marker.NumSides = 48
marker.Thickness = 2
marker.Color = Color3.fromRGB(242, 97, 115)
marker.Visible = true

Open related API

React to players and charactersConnect live signals, handle players already in the server and wait for a character part.

What this teachesSignals · Connections · WaitForChild · player lifecycle

local Players = game:GetService("Players")

local function watchPlayer(player)
    print(player.Name, "joined")

    player.CharacterAdded:Connect(function(character)
        local root = character:WaitForChild("HumanoidRootPart", 5)
        print(player.Name, root and root.Position)
    end)
end

for _, player in ipairs(Players:GetPlayers()) do
    watchPlayer(player)
end

Players.PlayerAdded:Connect(watchPlayer)

Open related API

Track an Instance on screenCombine live positions, world-to-screen projection and a Drawing object that updates over time.

What this teachesWorldToScreen · task.wait · Drawing.Text · visibility

local Players = game:GetService("Players")
local localPlayer = Players.LocalPlayer
local marker = Drawing.new("Text")

marker.Text = "Target"
marker.TextSize = 14
marker.Center = true
marker.Outline = true
marker.Color = Color3.fromRGB(242, 97, 115)

while task.wait() do
    local target = Players:GetPlayers()[2]
    local character = target and target.Character
    local root = character and character:FindFirstChild("HumanoidRootPart")

    if target ~= localPlayer and root then
        local position, onScreen = WorldToScreen(root.Position)
        marker.Position = position
        marker.Visible = onScreen
    else
        marker.Visible = false
    end
end

Open related API

Load a module and decode JSONSplit shared settings into a workspace module, fetch HTTPS data and decode it with HttpService.

What this teachesrequire · HttpGet · HttpService · permissions

-- workspace/settings.lua
return {
    accent = Color3.fromRGB(242, 97, 115),
    maximumDistance = 850,
}

-- workspace/main.lua
local settings = require("settings.lua")
local HttpService = game:GetService("HttpService")

local body = game:HttpGet("https://example.com/profile.json")
local profile = HttpService:JSONDecode(body)

print(profile.name, settings.maximumDistance)

Open related API

Editor

Context-aware completion and indentation

Suggestions combine Nova's API 1.3 catalog with the current Explorer snapshot. Dotted paths such as game.Workspace. and game.Workspace.Tree. offer live child names; the selected instance also contributes its reflected properties.

Live path suggestionsPrefix ranking, current hierarchy members, reflected properties, local identifiers, signatures, and Tab cycling.

Smart indentationUnderstands Lua blocks, delimiters, closers, multiline strings, and long comments without treating their contents as code.

Editing safeguardsSelection indent and outdent, matching delimiters, paired quotes and brackets, occurrence highlighting, and delayed syntax checks.

Native instances

Create, edit, Destroy, Undo, and Redo

Instance.new resolves the requested class from the attached Roblox client instead of a fixed list. Dot-property access, GetProperties, SetProperty, and Explorer use the same reflected descriptors. Destroy can retain a created or validated live object and returns a receipt that restores or removes it again.

-- Approve Roblox target-memory writes for this exact script.
local Players = game:GetService("Players")
local localPlayer = Players.LocalPlayer
local target

for _, player in ipairs(Players:GetPlayers()) do
    if player ~= localPlayer and player.Character then
        target = player.Character
        break
    end
end

assert(target, "No other loaded character is available")
assert(Instance.IsSupported("Highlight"), "Native Highlight creation is unavailable")

local highlight = Instance.new("Highlight")
highlight.Name = "NovaHighlight"
highlight.FillColor = Color3.fromRGB(255, 46, 112)
highlight.OutlineColor = Color3.fromRGB(255, 255, 255)
highlight.FillTransparency = 0.35
highlight.OutlineTransparency = 0
highlight.DepthMode = Enum.HighlightDepthMode.AlwaysOnTop
highlight.Enabled = true
highlight.Parent = target -- Parent last.

local properties = highlight:GetProperties()
print(properties.FillTransparency.Type,
      properties.FillTransparency.Writable,
      highlight.FillTransparency)

wait(3)
local action = highlight:Destroy()
print(action.State, action.CanUndo) -- Destroyed, true

wait(2)
action:Undo()
print(action.State, action.CanRedo) -- Restored, true

wait(2)
action:Redo()
wait(2)
action:Undo()

Live class supportCreate classes available in the attached client and receive a clear error when a class cannot be created.

Reversible actionsDestroy returns an action with State, CanUndo, CanRedo, Instance, Undo, and Redo.

Automatic cleanupObjects and reversible changes stay owned by the current run and clean up when that run ends.

Set Highlight appearance before Parent.

Assign FillColor, OutlineColor, transparency, DepthMode, and Enabled while detached, then set Parent last so Roblox sees the final appearance on the first rendered frame.

Property support stays visible.

GetProperties() shows which values can be read or changed. Read-only and unsupported properties return a clear error instead of pretending the change worked.

Tasks + events

Build persistent scripts

Scheduled work returns a cancellable handle, signals support complete connection controls, and supported live Instance events arrive as their state changes.

local Players = game:GetService("Players")

local joined = Players.PlayerAdded:Connect(function(player)
    print("Joined:", player.Name)
end)

local worker = task.spawn(function()
    while true do
        local elapsed = task.wait(0.25)
        print("Scheduler step:", elapsed)
    end
end)

print("Worker:", task.status(worker))
task.delay(2, function()
    joined:Disconnect()
    worker:Cancel()
end)

Signal cleanup is automatic.

Connections belong to the current run and disconnect when it stops, detaches, panics, or is replaced.

Cached entities

Query players without a full tree scan

nova.entities returns a bounded copy of Nova's current player cache, with stable filtering and sorting for overlays, target lists, and diagnostics.

local snapshot, queryError = nova.entities.query({
    includeSelf = false,
    aliveOnly = true,
    maximumDistance = 1000,
    sort = "distance",
    limit = 32,
})

if not snapshot then
    error(queryError)
end

if not snapshot.available then
    warn(snapshot.reason)
    return
end

for _, entity in ipairs(snapshot.entities) do
    print(entity.name, entity.distance, entity.health)
end

Snapshot state is included.

Every result reports whether it is available or stale. appearanceVisible describes transparency, not line of sight.

Permissions

Approve only what a script needs

Network, workspace, input, clipboard, dialogs, and protected Roblox access stay independently controlled for each script.

Network and workspaceHTTP GET, POST, request, file reads, inspection, writes, listing, and deletion are individually gated.

Windows accessInput observation, input injection, clipboard changes, and native dialogs have separate permissions.

Protected Roblox accessMemory and supported Instance edits use Nova's plan, session, target, foreground, and range protections, with script approval before changes are made.

GET requests can transmit data too.

File contents or game data can be encoded into a URL query string, so HttpGet is gated alongside POST and request.

Remote source

`HttpGet` with `loadstring`

With HttpGet enabled, LuaVM can fetch Lua source, compile it, and run it while keeping compile and runtime errors distinct.

-- Enable HttpGet in LuaVM > Settings > Security first.
local source = game:HttpGet("https://example.com/script.lua")
local chunk, compileError = loadstring(source, "@remote-script.lua")

if not chunk then
    error("Compile failed: " .. tostring(compileError))
end

local ok, result = pcall(chunk)
if not ok then
    error("Runtime failed: " .. tostring(result))
end

return result

Checked access

Memory APIs

LuaVM exposes session-bound reads, range checks, region metadata and checked writes under Nova's normal target policy.

local base = memory.base()
local region = memory.query(base)

print("Base:", string.format("0x%X", base))
print("Readable:", region and region.Readable)

-- Writes follow Nova's protected-target policy.
-- Always validate a dynamic address before writing.
if region and memory.is_writable(base, 4) then
    -- memory.write("u32", address, value)
end

LuaVM uses Lua 5.4.

Common Luau helpers are included, while Luau-only grammar and injected-only APIs remain outside the runtime. Use getcapabilities() when a script depends on optional behavior.

Reference

API reference

Open a category or search for an exact class, datatype, function, property, or method.

LanguageLua 5.4 syntax and runtime behavior, with selected Luau compatibility helpers.6

Lua 5.4

Uses standard Lua 5.4 syntax, operators, scope, control flow, functions, tables, metatables, and coroutines.

local / function / if / for / while / repeat

Standard Lua declarations and control-flow statements work normally.

tables and metatables

Tables support array and keyed access, iteration, length, unpacking, and ordinary metatable behavior.

coroutine.create / resume / yield / wrap

Standard Lua coroutines are available alongside Nova's task scheduler.

require(path.lua | path.luau)

Loads a verified module from Nova's script workspace and caches it for the current run.

Luau compatibility

Common helper functions are included, while Luau-only grammar such as type annotations, +=, continue, and generalized iteration must be converted.

Runtime and compatibilityIdentify Nova, compile Lua 5.4 code, inspect capabilities, and use common Lua/Luau compatibility helpers.16

identifyexecutor() -> name, version

Returns Nova and its executor API version. Alias: getexecutorname().

isrbxactive() -> boolean

True only while the attached Roblox process owns the foreground. Alias: isgameactive().

loadstring(source, chunkName?) -> function?, error?

Compiles Lua 5.4 text without running it. Call the returned function to execute it.

load(source, chunkName?)

Lua-compatible source compiler; text chunks only.

getgenv() -> table

Returns the current run's global environment. Each Execute starts a fresh VM.

shared

A compatibility table shared only inside the current run; Execute, Stop, detach, and panic clear it.

getfenv(value?) / setfenv(value, env)

Compatibility environment helpers for Lua 5.1-style scripts.

getcapabilities() -> table

Reports API version, limits, supported external features, and unsupported injected-only operations.

getbase() / getpid()

Returns the session-bound Roblox module base address or process ID.

tick() / time() / os.clock()

Time helpers in seconds.

typeof(value) -> string

Returns Roblox-style names for Nova datatypes and Lua names for ordinary values.

newproxy(meta?) / gcinfo()

Compatibility userdata and Lua heap-size helpers.

math.clamp / round / sign

Common Luau math helpers.

table.find / clear / create / clone

Common Luau table helpers.

string.split(value, separator?)

Splits a string into an array.

getrawmetatable / setrawmetatable

Reads or replaces a table or userdata metatable without __metatable protection.

Console and host outputWrite to Nova's console or request explicit host-side feedback.5

print(...) / printl(...)

Writes space-separated values to the LuaVM console.

warn(...) / errorl(...)

Writes warning or error-styled output; errorl does not throw.

notify(message, title?)

Shows a Nova notification and mirrors it in the console.

setclipboard(text)Unsafe

Replaces Windows clipboard text when its individual unsafe permission is enabled. Alias: toclipboard().

messagebox(text, title?)Unsafe

Shows a native message box when unsafe actions are enabled.

Scheduler and signalsSchedule cancellable work and react to supported runtime or Instance events.11

wait(seconds?) -> elapsed

Yields the current coroutine. task.wait is the preferred alias.

spawn(fn, ...) / delay(seconds, fn, ...)

Legacy scheduling aliases.

task.wait / spawn / defer / delay

Yield or schedule work. spawn, defer, and delay return task handles.

handle:Cancel() / task.cancel(handle | thread)

Cancels scheduled work. Handles expose Id, Thread, Status, Done, Cancelled, and Error.

task.status(handle | thread) / task.stats()

Reads task state or the current task, connection, and safety-limit counters.

scheduler limits

Each run is capped at 4,096 tasks, 2,048 connections, 512 total watchers, 16 tree watchers, and 4 descendant watchers.

signal:Connect(fn) / Once(fn) / Wait() / DisconnectAll()

Connects, connects once, waits from a managed task, or disconnects every listener on a Nova-owned signal.

connection:Disconnect / Enable / Disable / Fire / Defer

Controls one listener. Connected, Enabled, Function, LuaConnection, ForeignState, and Signal are readable.

getconnections(signal) / firesignal(signal, ...)

Inspects or fires only Nova-owned signals; Roblox's internal connection graph is not exposed.

RunService.RenderStepped / Heartbeat / Stepped

Per-frame signals that run until the script is stopped.

RunService:IsClient() / IsRunning()

Client/runtime compatibility checks; IsServer and IsStudio are false.

Classes and servicesUse the live DataModel, supported Roblox classes, and LuaVM runtime services.15

game / workspace

The live DataModel and Workspace for the attached Roblox session.

game:GetService(name) / service(name)

Returns Players, Workspace, Lighting, RunService, HttpService, UserInputService, TweenService, or StarterGui when supported.

game.Players.LocalPlayer

The local player, or nil before a playable character exists.

Players:GetPlayers()

Returns the live player array.

player.Character / player:GetMouse()

Reads the character model or returns Nova's external mouse proxy.

HttpService:JSONEncode / JSONDecode

Serializes JSON-compatible Lua values or parses JSON text.

HttpService:GenerateGUID(braces?)

Generates a GUID string.

HttpService:UrlEncode(value)

Percent-encodes a URL component.

TweenService:Create(instance, info, properties)

Returns a compatibility tween proxy; it does not mutate Roblox UI instances.

Instance.new(className, parent?)

Creates a supported Roblox Instance and optionally assigns its Parent.

Instance.IsSupported(className)

Checks whether the attached client can create the requested class.

Enum.Group.Item

Returns an EnumItem-style value for properties, input, and compatibility code.

UDim.new / UDim2.new / Rect.new / NumberRange.new

Creates values accepted by matching current-client reflected property setters.

Ray / BrickColor / NumberSequence / ColorSequence and other shims

Constructor-compatible placeholders for scripts; a reflected write still fails clearly when Nova cannot encode that client type safely.

Random.new(seed?)

Random number, integer, and unit-vector helpers.

Instances and live propertiesBrowse live Instances, read supported properties, make checked changes, and observe supported events.29

inst:FindFirstChild(name, recursive?)

Finds a named child, optionally recursively.

inst:FindFirstChildOfClass(className)

Finds the first direct child with the class.

inst:FindFirstChildWhichIsA(className, recursive?)

Finds a matching class, with inheritance-aware naming where available.

inst:WaitForChild(name, timeout?)

Waits for a child, using a five-second default timeout.

inst:GetChildren() / GetDescendants()

Returns direct children or the externally reachable descendant tree.

inst:FindFirstDescendant(name)

Finds a named descendant through Nova's bounded, cycle-safe traversal.

inst:FindFirstAncestor(name) / OfClass(class) / WhichIsA(class)

Walks parents to find a matching name or class.

inst:IsA(className) / IsDescendantOf(other) / IsAncestorOf(other)

Class and ancestry checks.

inst:GetFullName()

Returns the dotted hierarchy name.

inst:GetPropertyChangedSignal(property) / Changed

Returns a signal for supported live property changes.

inst.ChildAdded / ChildRemoved / DescendantAdded / DescendantRemoving

Signals for supported changes to the reachable Instance tree.

inst.AncestryChanged / Players.PlayerAdded / PlayerRemoving

External hierarchy and player-list change signals.

player.CharacterAdded / CharacterRemoving

External character replacement signals.

inst.Name / ClassName / Parent

Common readable identity properties.

inst.AnyReflectedProperty

Reads or changes a supported live property with normal dot syntax and datatype checks.

inst:GetProperties() -> table

Lists available properties with Type, Readable, Writable, and Value fields.

inst:SetProperty(name, value)

Uses the same reflected setter path as dot assignment and Explorer property editing.

Highlight FillColor / OutlineColor / FillTransparency / OutlineTransparency / Enabled / DepthMode

Readable and writable on a native Highlight. Set appearance while detached, then assign Parent last for reliable first-frame rendering.

inst:Destroy() -> DestroyAction

Removes a supported Instance and returns a reversible action.

action:Undo() / action:Redo()

Restores or reapplies the exact Parent transition. State, CanUndo, CanRedo, and Instance are readable on the action.

inst:UndoDestroy() / inst:RedoDestroy()

Changes that instance's latest compatible Destroy transaction.

Instance.Undo() / Instance.Redo()

Changes the latest compatible Destroy transaction for the run. A new Destroy supersedes the pending redo stack.

inst:ClearAllChildren() -> DestroyAction[]

Creates one reversible Destroy receipt per direct child and rolls completed changes back if the batch cannot finish.

nova.instances

Exposes ownership limits, class support, undo, and redo for the current run.

Humanoid WalkSpeed / JumpPower / Health / MaxHealth

Readable properties with checked numeric writes.

BasePart Position / CFrame / Velocity

Readable vectors and checked position or linear-velocity writes.

BasePart Anchored / CanCollide / Transparency

Readable state with checked supported writes.

Explorer property editing

The native Explorer shows the same readable and writable properties exposed to LuaVM.

Kick, server remotes, injected closures, and unsupported reflected value typesBoundary

These still require Roblox-side execution or an ABI Nova cannot safely represent; the external VM reports a direct unsupported/read-only error instead of pretending success.

DatatypesRoblox-style values for math, properties, Drawing, input, and UI code.14

Vector3.new(x, y, z)

+, -, *, /, unary -, equality, Magnitude, Unit, Dot, Cross, Lerp, Abs, Angle, Ceil, Floor, FuzzyEq, Max, Min, and Sign.

Vector2.new(x, y)

+, -, *, /, unary -, equality, Magnitude, Unit, Dot, Cross, and Lerp.

Color3.new / fromRGB / fromHSV / fromHex

Creates normalized RGB colors, exposes R, G, and B, and supports value equality.

CFrame.new / Angles / fromOrientation / lookAt

Position and orientation construction, value equality, multiplication, addition, subtraction, and vector transforms.

CFrame:Inverse / ToWorldSpace / ToObjectSpace

Inverse and relative-space transformations.

CFrame:PointToWorldSpace / PointToObjectSpace

Transforms points between spaces.

CFrame:VectorToWorldSpace / VectorToObjectSpace

Transforms direction vectors between spaces.

CFrame:GetComponents / Lerp / ToEulerAnglesXYZ / ToOrientation

Component access, interpolation, and orientation conversion.

UDim.new(scale, offset)

Creates one scale-and-offset layout dimension.

UDim2.new(xScale, xOffset, yScale, yOffset)

Creates a two-axis layout value from scale and offset components.

Rect.new(minX, minY, maxX, maxY)

Creates a rectangular value with Min, Max, Width, and Height.

NumberRange.new(min, max?)

Creates a minimum and maximum numeric range.

EnumItem

The value returned by Enum.Group.Item and supported reflected enum properties.

Random.new(seed?)

Creates a random generator with number, integer, and unit-vector helpers.

EnumsEnumItem-style values for properties, input, and Roblox-compatible code.5

Enum.Group.Item

Returns a stable enum value from a familiar group and item path.

Enum.KeyCode.<Key>

Provides key values accepted by supported keyboard and keybind APIs.

Enum.HighlightDepthMode.AlwaysOnTop / Occluded

Controls supported Highlight depth behavior.

reflected enum properties

Supported properties return enum values and accept matching Enum items when changed.

typeof(enumValue) -> EnumItem

Identifies LuaVM enum values without reducing them to plain numbers or strings.

Cached entitiesQuery a fresh, bounded copy of Nova's player cache without rescanning the full DataModel every frame.13

nova.entities.snapshot() -> snapshot

Copies up to 256 valid rows in source order from a maximum of 512 cached entities.

nova.entities.query(options?) -> snapshot

Filters, sorts, and limits a copied snapshot. A query defaults to 128 results and accepts a limit from 1 through 256.

query option validation

Only documented string keys and strict boolean, number, string, or integer value types are accepted; unknown keys raise an error.

includeSelf / aliveOnly / appearanceVisibleOnly / enemyOnly

Boolean filters. enemyOnly returns nil plus an error when Nova cannot resolve the local Team field.

minimumHealth / maximumDistance / nameContains

Optional numeric and case-insensitive name filters. nameContains is limited to 128 bytes.

sort = distance | health | name | source

Selects stable result ordering; distance is the default for query and source order is used by snapshot.

available / stale / reason / ageSeconds

Freshness state. Nova fails closed after 1.5 seconds without a player-cache publication.

entities / count / matchedCount / sourceCount / truncated

Returned rows and cap metadata, with processId, sessionGeneration, treeGeneration, maxSourceEntities, and maxResults.

appearanceVisibilitySemantic

Explicitly identifies appearance visibility as transparency state rather than line of sight.

sourceIndex / name / toolName / player / character / humanoid / rootPart / head / torso / team

One-based cache index, copied identity strings, and session-checked live Instance handles when available.

position / headPosition / torsoPosition / lookDirection

Copied cached Vector3 fields; an unavailable or non-finite vector is nil.

health / maxHealth / healthFraction / distance

Copied finite numeric state; unavailable values are nil.

isSelf / alive / appearanceVisible / teamColorNumber

Copied classification fields. appearanceVisible describes transparency state, not physics line of sight.

DrawingCreate retained overlay primitives. Nova clears every object when the run stops.14

Drawing.new(type) -> drawing

Creates Square, Line, Circle, Text, Triangle, Quad, or Image.

Drawing.clear()

Removes all drawings owned by the current run.

drawing:Remove() / Destroy()

Removes one object.

drawing:Contains(Vector2) -> boolean

Hit-tests a screen point. Alias: HitTest.

Visible / Transparency / Color / ZIndex

Properties common to drawing primitives.

Position / Size / From / To / PointA..PointD / Center

Geometry properties used by each primitive type.

Filled / Thickness / Rounding / Radius / NumSides

Shape fill and stroke controls. Corner aliases Rounding.

Text / TextSize / Font / Center / Outline / OutlineColor

Text appearance. FontSize aliases TextSize; TextBounds is read-only.

Image.Data / Size / Rounding

PNG, JPEG, GIF, or BMP bytes, limited to 4 MB per image and 32 MB per run.

drawing.Draggable = true

Enables Nova's native topmost pointer capture and geometry translation.

Hovered / Pressed / Clicked / Dragging

Read-only pointer state updated by Nova's renderer.

MouseEnter / MouseLeave / MouseButton1Down / MouseButton1Up / MouseButton1Click / Activated

Nova-owned pointer edge signals on Drawing objects.

WorldToScreen(Vector3) -> Vector2, onScreen

Projects a live world point into screen coordinates. Alias: worldtoscreen.

Drawing.Fonts.UI / System / Plex / Monospace

Portable font identifiers with additional compatibility aliases.

HTTP and encodingOutbound HTTPS is disabled until its individual unsafe permission is enabled. GET is gated too because URL query strings can transmit data.4

game:HttpGet(url) -> bodyUnsafe

Fetches and decodes an HTTPS response body. Aliases: httpget and HttpGet.

game:HttpPost(url, body, contentType?, headers?)Unsafe

Posts a body over HTTPS. Aliases: httppost and HttpPost.

request({ Url, Method?, Headers?, Body? }) -> responseUnsafe

Returns Success, StatusCode, StatusMessage, Body, and Headers. Alias: http_request.

base64_encode / base64_decode

Base64 helpers with crypt.base64.encode/decode aliases.

Workspace filesystemEvery read, inspection, mutation, and enumeration has an individual unsafe permission. Paths remain confined to Nova's script workspace; traversal and reparse-point escapes are rejected.8

readfile(path) -> stringUnsafe

Reads a workspace file up to 8 MB.

writefile(path, content)Unsafe

Creates or replaces a workspace file.

appendfile(path, content)Unsafe

Appends to a workspace file.

isfile(path) / isfolder(path)Unsafe

Checks workspace entries; each check has its own permission.

makefolder(path)Unsafe

Creates a workspace folder.

listfiles(path?) -> string[]Unsafe

Lists a workspace directory.

delfile(path) / delfolder(path)Unsafe

Deletes a workspace entry.

require(path.lua | path.luau)Unsafe

Loads and caches a workspace module through readfile, so readfile permission is required.

InputHost input observation and synthetic input have separate unsafe permissions. Internal polling returns an inert state when observation is denied.9

getinputstate() -> tableUnsafe

Returns Active, MousePosition, and the held virtual-key number array.

getmouseposition() -> Vector2Unsafe

Returns the current screen-space pointer position; the Mouse proxy uses the same permission.

iskeydown(key) / iskeypressed(key)Unsafe

Checks a VK number, key name, or Enum.KeyCode.

ismouse1pressed() / ismouse2pressed()Unsafe

Checks mouse button state through separate permissions.

UserInputService.InputBegan / InputEnded / InputChangedUnsafe

Keyboard, mouse-button, pointer-motion, and focus signals require getinputstate permission.

mouse1click / press / release; mouse2*Unsafe

Sends real mouse-button input.

mousemoveabs / mousemoverel / mousescrollUnsafe

Moves or scrolls the real pointer.

keypress / keyrelease / keyclickUnsafe

Sends a VK number, name, character, or Enum.KeyCode.

setrobloxinput(enabled)

Only narrows input delivery for this run; it cannot bypass foreground or per-function permissions.

MemorySession-bound reads and checked writes use Nova's protected-target policy and do not require unsafe mode.8

memory.read(type, address, length?)

Reads i/u8, 16, 32, or 64, ptr, float, double, bool, string, or bytes.

memory.write(type, address, value, terminate?) -> boolean

Performs a checked write under Nova's paid-session, attached-target, foreground, writable-range, and target-write policy.

memory.is_readable(address, size?)

Validates a committed readable target range. Flat alias: memory_is_readable.

memory.is_writable(address, size?)

Checks the current policy and committed target protection. Flat alias: memory_is_writable.

memory.pointer_chain(base, offsets) -> address?

Resolves up to 64 pointer offsets and returns nil on an invalid link.

memory.query(address) -> region?

Returns BaseAddress, RegionSize, State, Protect, Type, Readable, and Writable.

memory.base() / memory.pid()

Returns the same run-bound values as getbase and getpid.

memory_read / memory_write and memory_* aliases

Flat compatibility names map to the same checked memory backend.

Enumeration and support boundariesDiscover externally reachable state and feature-detect operations that require injection.10

getinstances() / getnilinstances()

Enumerates the reachable live DataModel; detached instances cannot be discovered externally.

getscripts() / getrunningscripts()

Enumerates reachable script instances.

getloadedmodules()

Enumerates externally visible ModuleScript instances.

getgamename() / getcallingscript()

Returns the visible game name; getcallingscript is a compatibility value.

getfflag(name) / setfflag(name, value)

Compatibility stubs only; Nova does not mutate Roblox fast flags.

decompile(script: Instance) -> string

Returns client-visible source for a Script, LocalScript, or ModuleScript. Direct source is preserved and bytecode recovery is best-effort; Nova notifies on success and raises an error with a failure notification otherwise.

getgc, getreg, getsenv, bytecodeUnsupported

Injected-VM introspection is unsupported and raises a capability error.

hookfunction / hookmetamethodUnsupported

Injected closure and metamethod mutation is unsupported. getconnections and firesignal work only with Nova-owned signals.

fireclickdetector, firetouchinterest, fireproximitypromptUnsupported

Internal interaction firing is unsupported; use real input when appropriate.

queue_on_teleport, setfpscap, sethiddenproperty, cache mutationUnsupported

Injected lifecycle and internal engine mutation APIs are unsupported.

Understand the runtime before the API.

More than a script box.

Learn one pattern at a time.

Context-aware completion and indentation

Create, edit, Destroy, Undo, and Redo

Build persistent scripts

Query players without a full tree scan

Approve only what a script needs

HttpGet with loadstring

Memory APIs

API reference

`HttpGet` with `loadstring`