Capabilities

Some globals are always installed; a few are gated behind a capability. A gated global that was not granted is simply not there: the global is nil, and indexing into it is a normal Lua error.

Always present

client, globals, ui, renderer, json, bit, database and vector, plus the game’s own namespace (pool, carrom, soccer, mlbb, aov) and — on the Miniclip cocos games — cocos and miniclip. No grant is needed for any of these.

Gated

Group	What it gives
http	Asynchronous HTTPS requests, off the game thread. Reference.
websocket	Asynchronous WebSocket client. Reference.
input	client.tap(x, y) to synthesise a tap.
reflect / cocos	Raw node and field access on the cocos games.

Memory read and write, hooks and the licence gate are never exposed.

How a grant works

A marketplace bundle lists the groups it needs in manifest.json under capabilities. They are shown on the item page and in the moderation queue, and the runtime installs exactly those groups and no others.

A loose local script — one you drop into the scripts folder on a dev build — is granted every group automatically. There is no capability comment header to write.

Testing for a grant

Because an ungranted gated global is nil, test for one by checking the global:

if http then
  http.get("https://api.ipify.org?format=json", function(ok, res)
    if ok then client.log(res.body) end
  end)
end