# Cmdr: a command framework for Roblox games, with type safety on both ends

> Cmdr is an extensible command framework for Roblox that treats the console as an API surface, with typed argument parsing, autocomplete that understands your own argument types, and a rule that both the client and the server validate every command before it runs.

**evaera/Cmdr** — Extensible command console for Roblox developers

- Repository: https://github.com/evaera/Cmdr
- Website: https://eryn.io/Cmdr/
- Stars: 534 · Forks: 156
- Language: Luau
- License: MIT
- Published: 2026-10-22 · Updated: 2026-10-22 · Language: en
- Canonical page: https://hysenlabs.com/projects/evaera-cmdr

## What Cmdr is for, and where it came from

Cmdr is described as a fully extensible, type-safe command framework for Roblox, and the framing is that you build powerful in-game command systems, developer tools and admin workflows with a framework designed to integrate directly into your experience. The origin story is in the readme and it explains the shape of the project. Originally built as a developer console for debugging and internal tools, Cmdr has evolved into a powerful command system that can be used for anything from gameplay interactions and moderation tools to custom player-facing interfaces. That trajectory matters, because a debugging console is a tool you expose to yourself and a player-facing interface is a feature other people depend on, and the requirements of the second are much harder. The language is Luau, the licence is MIT, the homepage is eryn.io/Cmdr, and the current release is Cmdr v1.13.1 from 2026-09-30, after v1.13.0 earlier in September and a release candidate for it in late August.

## Extensibility, and what you can add to it

The first feature bullet is extensibility, and the list under it names the four things you write yourself. Custom commands, argument types, validators and integrations tailored to your game, and commands can interact directly with your existing systems and APIs. The second point is the one that separates Cmdr from a command handler, because it means the framework does not hide your game behind an abstraction. A command is a function that can call anything in your codebase, and the argument types and validators are the extension points where your domain knowledge goes in. The consequence is that the framework stays out of the way of your game logic while still owning the parsing, and that the parts you write are ordinary Luau rather than some declarative description of your game.

## Type safety, and what it saves you from writing

Cmdr is built with type validation right in, and the pitch is that you do not need to worry about the right arguments reaching your commands because Cmdr validates them for you. In practice this is the feature that removes the most code. A handler written against a typed argument receives a value that has already been checked to be the right kind of thing, so there is no string-to-number conversion at the top of every function and no error path for a player who typed a nonsense value. The second part of the feature is the autocomplete, which is described as intelligent command suggestions with instant argument validation while typing, and where custom argument types can provide their own suggestions and parsing logic. That last clause is the important one in practice, because a framework that offers autocomplete over a fixed set of types stops being useful as soon as your game has a domain-specific concept, such as a player name or an item in your inventory.

## The security model, which is the reason to read this section

Cmdr is secure by design, and the design is stated precisely enough to reason about. Both the client and server independently validate command input, and server authority is maintained while still providing a responsive user experience. The split is the interesting part. A client-side console that feels instant has to run the parser locally, because otherwise every keystroke is a round trip, and if only the client validated then a modified client could send anything to the server. So the client validates for responsiveness and the server validates for authority, and a command handler can assume it only runs with arguments that passed both. The consequence for your own code is that you do not need a second validation layer in the handler, but you also cannot skip the server-side check by assuming the client already did it.

## Running commands from code, and binding them to input

Two features make Cmdr usable as more than a console. Programmatic command execution lets you execute commands from your own scripts and run commands on behalf of players or internal systems, which means a scheduled task or an event handler can go through the same argument validation as a human typing. Input binding support lets you bind commands to keyboard shortcuts or other user input, with the stated aim of creating custom developer tools directly inside your game, so a hotkey in a playtest does the same thing as typing the command. And command composition lets you use the output of one command as input for another, to build complex workflows by combining smaller commands together. Between them these three turn the console from a debug surface into an interface layer, and command composition in particular is the one that changes how you structure a command set, because it pushes you towards small commands with clean outputs.

## How the project is organised

The repository layout tells you how the project is run rather than what it contains. The Cmdr/ directory holds the library itself, and there are separate directories for docs, scripts, assets and a website. The toolchain is a mixture that reflects a Roblox project with a documentation site attached to it. There is a wally.toml and a rokit.toml, which are the manifest files for the two Roblox package managers, so dependencies for the library are pinned the Roblox way. There is a selene.toml for linting Luau and a stylua.toml for formatting it, plus a .markdownlint.yaml for the documentation and a .editorconfig. Two project files sit at the top level, default.project.json and test-place.project.json, which is how a Roblox Studio place gets opened from a command line for testing. The package.json is marked private, because it exists to build the documentation rather than to publish anything.

## The documentation site, and how it is built

The full documentation lives at eryn.io/Cmdr/, and the repository shows exactly how that site is produced. The scripts in the package.json are all Docusaurus commands.

```json
  "scripts": {
    "predocs": "node scripts/sync-changelog.mjs",
    "docs:dev": "npm run predocs && docusaurus start website",
    "docs:build": "npm run predocs && docusaurus build website",
    "docs:serve": "docusaurus serve website",
    "docs:publish": "npm run predocs && docusaurus deploy website",
    "docs:swizzle": "docusaurus swizzle",
    "docs:clear": "docusaurus clear website",
    "set-version": "node scripts/version.mjs"
  },
```

A docs:dev that runs a predocs step and then starts the site, a docs:build that runs the same predocs step and builds it, a docs:serve for the built output and a docs:publish that deploys it. The predocs step is a node script called sync-changelog.mjs, and it is there because the CHANGELOG.md at the root of the repository is the source of truth for the changelog pages, so the sync step copies it into the site before every build. The dependencies are the standard Docusaurus stack, with the classic preset, the client redirects plugin, the moonwave plugin for the API documentation and docusaurus-lunr-search for search, plus react and react-dom at version 18.3.1. The browserslist targets are conservative on purpose, with production at greater than 0.5 percent, not dead and not op_mini all, which is the kind of detail a documentation site for a game framework should get right.

## Conclusion

Cmdr fits a Roblox developer building a developer console, an admin panel or a player-facing command interface, since the type system does the argument parsing and validation that otherwise turns into a pile of defensive checks in every handler. It does not fit a Roblox project that only needs one or two fixed commands, since a framework has a cost in setup and in the extra layer between your code and the player's keystrokes. It also does not fit a team that wants a single console binary, because Cmdr is a library you integrate into your game rather than a tool you run beside it. Before you start, read the documentation at eryn.io/Cmdr/, and note that the repository publishes a changelog and a security policy, and that the release line is on 1.13.x with a recent candidate for 1.13.0, so you should pin a version rather than tracking master.

## FAQ

### What is Cmdr and what is it for?

Cmdr is a fully extensible, type-safe command framework for Roblox, used to build in-game command systems, developer tools and admin workflows. It started as a developer console for debugging and internal tools and evolved into a command system usable for gameplay interactions, moderation tools and player-facing interfaces.

### How does Cmdr validate commands for security?

Both the client and the server independently validate command input, and server authority is maintained while still giving a responsive user experience. The client validates locally so the console feels instant, and the server validates so a modified client cannot send anything through.

### What can I extend in Cmdr?

Custom commands, argument types, validators and integrations tailored to your game. Custom argument types can also provide their own suggestions and parsing logic, so autocomplete can cover domain-specific values rather than only the built-in types.

### Can Cmdr run commands without a player typing them?

Yes. Programmatic command execution lets you execute commands from your own scripts and run commands on behalf of players or internal systems, and command composition lets you use the output of one command as input for another to build workflows out of smaller commands.

## Sources

- [evaera/Cmdr on GitHub](https://github.com/evaera/Cmdr)
- [License: MIT](https://github.com/evaera/Cmdr/blob/master/LICENSE)
- [Project website](https://eryn.io/Cmdr/)
- [README](https://github.com/evaera/Cmdr/blob/master/README.md)
- [Releases](https://github.com/evaera/Cmdr/releases)

---

Hysen Labs editorial analysis, written from the project's own repository and release notes. Cite the canonical page: https://hysenlabs.com/projects/evaera-cmdr