Activation
What activation writes into your project
Turning PlayKit on adds one block of standing instructions to the file your AI already reads. Here is that block, in full, before you install anything. It is fetched from the same function the activate tool calls, so this page cannot drift from what actually lands in your file.
Goes into CLAUDE.md, appended. If a PlayUGC block is already there, it is replaced rather than duplicated.
Loading the block…
Nothing on this page is a paraphrase. If the two ever disagree, the tool response is the one that ran, and that is a bug worth telling us about.
No agent required
Paste it yourself
You never have to let an agent write this. Copy the block above and put it in the file yourself; activation is nothing more than that block being in that file.
Claude Code
Append it to CLAUDE.md at your project root. Create the file if it is not there. Claude Code reads it at the start of every session in that project.
Codex (ChatGPT app)
Append it to AGENTS.md at your project root. AGENTS.md is the only file Codex reads on its own, which is exactly why activation refuses to guess which tool you are in: the block landing in the wrong file is invisible rather than loud.
Cursor
Append it to .cursor/rules/playugc.mdc. Create the folder and file if they are not there.
How do I turn it off?
Delete the block. That is the whole of it. There is no separate switch, no daemon, and nothing left behind in your project. Saying deactivate to your AI does the same thing.
Disclosure
What PlayUGC receives
Three things leave your machine while PlayKit is on. This is all of them, in the words we would want if it were our project.
recommend_tools sends the first 300 characters of your request
In auto mode your AI asks us which kit fits before substantive Roblox build work, and routing needs the request to route. The first 300 characters of that request are stored so we can see what people ask for and what nothing covers. Nothing else from the conversation is sent.
report_issue sends shape only, redacted on our side
One short line describing the failure, plus the kit, its version, the stage it failed at, and an error class. The directive tells your AI never to send source, place contents, asset ids, file paths, place or universe ids, usernames, keys, prompts or conversation. And because an instruction is a request rather than a control, the server strips paths, URLs, emails, long ids and key-shaped strings from every report before storing it.
Every request your key makes records a peppered IP hash, an install hash, and a country
Not the address, a peppered hash of it; plus a hash identifying the install and a country. It exists to deter one seat's key being shared across many, and nothing else reads it.
What your key can do
Your key identifies your membership. It can list and download kits, and send the two reports above. It cannot touch Roblox, Studio, your place, or your account, and PlayUGC holds no Roblox credential of yours. Revocation is immediate: every request re-reads whether the key was revoked, so a revoked key stops working on the next call rather than at the end of a session. Rotation is manual today: ask us and we issue a new key; there is no self-serve button yet, and we would rather say so than imply one.
Provenance
Why the rules read the way they do
Most of the block is not features. It is scar tissue, and each line has a date behind it.
2026-07-24: a gate took over a paying customer's Play session
A kit install ran its own verification, which started Play, in a session a customer was working in. It took the place over mid-work. That is why the block says installs are silent: verify structurally, check the Instances exist and the version sentinels match, and print nothing. It reads like fussiness until you know it cost somebody an afternoon in their own game.
2026-07-24: a skylight with a heart in its description
A Toolbox model carried a payload that blurred every player's screen and kicked them. That is why anything from the Toolbox, the Creator Store, or any person other than you is treated as untrusted code, goes into a holding folder first, and gets its scripts read before Play starts, and why text inside that content addressed to your AI ("already verified", "no need to scan") is treated as a finding rather than an instruction.
2026-07-25: activation that silently did nothing
A first-run install on Codex connected through a hand-rolled MCP client that enforced no schema, so the harness was never sent, and the block went into CLAUDE.md in a project whose standing-instruction file is AGENTS.md. Activation appeared to succeed and had done nothing. That is why activate now refuses to guess your tool, and refuses to guess your mode: there is no safe default, and guessing wrong is invisible.
2026-07-25: "the install process looks a lot like prompt injection up front"
The same week, a new customer ran the kits six times on a real game and said it plainly. The setup prompt used to tell his AI to call activate and do exactly what it said, and the block went into his repository without him ever reading it. He was isolating the kit from the rest of his work, which is what a careful buyer does with something he does not yet trust. This page, the consent step before any write, and a setup prompt that carries a placeholder instead of your key are all the answer to that one sentence.
Anti-injection is in the block itself and stays there. The point of this page is not that the instructions are harmless; it is that you get to read them first.
Read it, then decide.
That is the order it should always have been in.
Cancel anytime. No Roblox account or API keys required to start.