Build with the full power of Meridian LuaVM.

Start Meridian before Roblox, join a game, and wait for the attachment status to become ready. Press Insert, open LuaVM from the navbar, then create or select a script. Each press of Run new starts a clean Lua 5.4 state on its own worker. Up to eight scripts can run together.

-- Open Meridian with Insert, select LuaVM, then press Run new.
local runtime, version = identifyexecutor()
print(runtime, version)

meridian.setsetting("esp max distance", 1500)
meridian.setfeature("esp", true)

for _, player in ipairs(meridian.players()) do
    print(player.Name, math.floor(player.Distance), player.Health)
end

Every run owns a new Lua state, script ID, cancellation flag, input state, Drawing objects, and native UI resources. Stop beside an active script cancels only that worker; Stop all cancels the set. Compile and runtime failures appear in the identified live console.

print(meridian.script.id, meridian.script.name)
print(meridian.runtime.apiVersion)           -- 1.2.0
print(meridian.runtime.luaVersion)           -- 5.4.8
print(meridian.runtime.maxConcurrentScripts) -- 8
print(meridian.capabilities.taskScheduler)   -- true

The meridian table is the primary high-level surface. It works with the same shared feature state, player cache, command system, and config store as Meridian's native interface.

-- Names ignore case, spaces, dashes, and underscores.
meridian.setsetting("aimbot fov", 145)
meridian.setsetting("aimbot-prediction", true)

local enabled = meridian.togglefeature("aimbot")
print("Aimbot enabled:", enabled)

-- The command API uses the same language as the command palette.
local ok, message = meridian.execute("speed 30")
print(ok, message)

Direct helpers include enableaimbot, disableaimbot, toggleaimbot, equivalent helpers for triggerbot and ESP, plus fly/unfly/togglefly, noclip, desync, and infjump variants.

Feature names are aimbot, triggerbot, esp, fly, noclip, desync, infjump, walkspeed, jumppower, animationchanger, teamcheck, and keybindhud.

Player functions use Meridian's shared live cache. A PlayerSnapshot contains Address, CharacterAddress, HumanoidAddress, RootPartAddress, Name, Health, MaxHealth, Distance, EquippedItem, Position, and ClassName.

meridian.refreshplayers()

local target = meridian.findplayer("alex")
if target then
    print(target.Name, target.Health, target.EquippedItem)
    print(target.Position, target.RootPartAddress)

    meridian.view(target)
    wait(2)
    meridian.unview()
end

Instance.new(address) still wraps a known engine address. With Roblox compatibility mode enabled, Instance.new("ClassName", parent?) also creates script-owned virtual Instances. Screen GUI classes are translated live into Meridian Drawing objects instead of being inserted into Roblox.

local players = game:GetService("Players")
local localPlayer = players.LocalPlayer
local character = localPlayer and localPlayer.Character

if character then
    local root = character:FindFirstChild("HumanoidRootPart")
    if root and root:IsA("BasePart") then
        print(root:GetFullName(), root.Position)
    end
end

local ui = Instance.new("ScreenGui")
ui.Name = "ExistingScriptUI"
ui.Parent = game:GetService("CoreGui")

local panel = Instance.new("Frame", ui)
panel.Position = UDim2.fromOffset(32, 80)
panel.Size = UDim2.fromOffset(280, 150)
panel.BackgroundColor3 = Color3.fromRGB(24, 26, 38)
Instance.new("UICorner", panel).CornerRadius = UDim.new(0, 12)

local button = Instance.new("TextButton", panel)
button.Position = UDim2.fromOffset(20, 92)
button.Size = UDim2.fromOffset(240, 38)
button.Text = "Enable ESP"
button.MouseButton1Click:Connect(function()
    meridian.togglefeature("esp")
end)

Globals and services

Reachable discovery is available through getinstances(), getscripts(), and getloadedmodules(). getnilinstances() returns script-owned virtual Instances without a parent; externally unreachable Roblox nil instances cannot be discovered.

Low-level address API

Meridian opens Lua's standard libraries, then removes direct host filesystem, process, and package loading surfaces. The compatibility layer is focused on common script patterns without pretending to be Roblox's internal Luau VM.

Synthetic input state is independent for every running script. It defaults on for compatibility with existing Meridian scripts; call setrobloxinput(false) when a script no longer needs to send input. Disabling it in one VM does not affect another.

setrobloxinput(true)

if isrbxactive() then
    mousemoveabs(640, 360)
    mouse1click()
end

setrobloxinput(false)

The file API gives scripts useful persistence without exposing the rest of the computer. Allowed data extensions are .txt, .lua, .luau, .json, .cfg, .dat, .ini, and .mrd.

-- All paths resolve inside scripts\workspace.
makefolder("my-tool")
writefile("my-tool/settings.json", '{"enabled":true}')
appendfile("my-tool/log.txt", "started\n")

for _, path in ipairs(listfiles("my-tool")) do
    print(path)
end

-- Module paths must include .lua or .luau.
local helpers = require("my-tool/helpers.lua")

Meridian supplies Lua implementations of the geometry types most external scripts need. typeof() reports their Meridian type names and arithmetic returns typed values.

Enum includes the common input, GUI, easing, rendering, material, and humanoid-state categories used by compatibility scripts. Enum items are cached values with Roblox-style names such as Enum.KeyCode.F and Enum.UserInputType.MouseButton1.

Drawing objects render in Meridian's DirectX overlay. Create one with Drawing.new(type), set its properties, and call :Remove() or :Destroy() when finished.

local label = Drawing.new("Text")
label.Position = Vector2.new(32, 32)
label.Text = "Meridian LuaVM"
label.FontSize = 18
label.Color = Color3.fromHex("#9b8cff")
label.Outline = true
label.Visible = true

wait(3)
label:Remove()

Drawing.Fonts defines UI = 0, System = 1, SystemBold = 2, and Monospace = 3 for compatibility. Text currently uses Meridian's overlay font renderer.

MeridianUI, newui, and meridian.ui refer to the same native library. The bundled meridian_ui.lua module returns it, so scripts can use a familiar require pattern without downloading UI code. Several scripts can display interfaces simultaneously; each owns its windows and event queue.

local ui = require("meridian_ui.lua")

local window = ui:CreateWindow({
    Title = "Movement kit",
    Subtitle = "Powered by Meridian",
    Width = 820,
    Height = 580,
    ShowLoader = true,
    LoadingDuration = 0.9,
})

local movement = window:AddTab({ Title = "Movement", Icon = "zap" })
local controls = movement:AddSection("Controls")

controls:AddToggle({
    Title = "Fly",
    Description = "Camera-relative movement",
    Keybind = "F",
    Mode = "Toggle",
    Callback = function(enabled)
        meridian.setfeature("fly", enabled)
    end,
})

local speed = controls:AddSlider({
    Title = "Fly speed", Min = 1, Max = 500, Default = 75,
    Callback = function(value) meridian.setsetting("fly speed", value) end,
})

ui:Notify({
    Title = "Movement kit ready",
    Content = "Controls loaded successfully",
    Type = "Success",
    Duration = 4,
})

ui:OnUnload(function() meridian.setfeature("fly", false) end)
while true do
    ui:Step() -- dispatches native events to Lua callbacks
    wait(0.02)
end

Window and layout

Control and library methods

Tab Icon names render through Meridian's native Lucide-style icon set. Supported names include shield, eye, move, terminal, settings, sparkles, radar, crosshair, user, orbit, and zap. Unknown names fall back to sparkles instead of a letter.

Keybind names accept A-Z, 0-9, F1-F24, Insert, Delete, Home, End, Page Up/Down, Space, Tab, LMB/RMB/MMB, Mouse 4/5, Shift, Ctrl, Alt, Enter, Escape, and arrow keys. Modes are Toggle, Hold, and Press. During capture, Backspace unbinds and Escape keeps the current key.

Raw process access is disabled by default and hidden behind the LuaVM's Unsafe memory API switch. Calls fail unless Roblox is attached. Keep it off for scripts that only use supported Meridian, player, Instance, Drawing, or UI APIs.

-- Requires Unsafe memory API and an active attachment.
local base = getbase()
local oldValue = getfflag("PhysicsSenderMaxBandwidthBps")

local ok, err = pcall(function()
    setfflag("PhysicsSenderMaxBandwidthBps", 0)
end)

if not ok then warn(err) end
-- Restore values you change as soon as your script no longer needs them.
setfflag("PhysicsSenderMaxBandwidthBps", oldValue)

The verified FFlag allowlist currently contains PhysicsSenderMaxBandwidthBps and PhysicsSenderMaxBandwidthBpsScaling. Other names raise an explicit error.

Meridian is an external Lua 5.4 host, not Roblox's internal Luau VM. It reproduces useful behaviour only where the external can do so truthfully. Code that relies on engine-owned garbage collection, bytecode, or signals must use a verified game-specific adapter instead.