A free installer from a small project deserves suspicion. So this page does not ask you to
trust anything: every statement links to the exact file on GitHub that makes it true, and the
hash checker below works on the file you just downloaded, in your browser, with nothing uploaded.
The desktop app, the Roblox Studio plugin, the MCP server, the tests and this website are one
public repository. There is no private component and no obfuscated bundle, and the animator
depends on no server: only a Pro key is checked online (see B below). Each release is tagged on GitHub
(v0.14.0)
next to the files you download, and the whole thing builds with two commands:
git clone https://github.com/alycoulibal2-sketch/Cadence-Animator
cd Cadence-Animator && npm install && npm run dist
MIT means you may read it, change it, redistribute it and use it commercially. The only condition is keeping the licence notice with the code.
It talks to your own machine, and to a few named services when you ask it to.
This is the complete list of places the app can connect to, read from the source. Search src/main.js and src/pro.js for https:// and 127.0.0.1 and you will find exactly these.
Every network destination of the Cadence Animator app
Destination
What
When
Where in the source
127.0.0.1:35747
The Studio bridge. The Roblox Studio plugin polls it; it never accepts a connection from another machine because it is bound to loopback.
The update check reads the public release list. The download and the install are two separate clicks of yours; autoDownload and autoInstallOnAppQuit are both off.
A few seconds after launch and on Check for updates (installed build only)
Cadence’s licence server checks a Pro key: the app sends the email and key you entered, and gets back whether they are valid. The server stores nothing.
Only if you enter a Pro key: once then, and about once a week after
What is not on the list: telemetry, analytics, crash reporting, an account
server. None exist. The interface windows cannot make a request of their own
at all: their Content-Security-Policy is connect-src 'self', so even a bug in the
UI could not phone anywhere.
Coming with Cadence AI: one more destination, Corvexsa’s Cadence AI service, contacted only when you ask Cadence AI for an animation. It receives your words, the rig and, for a follow-up, the animation on screen, and stores none of them. It is not in the app yet; when it ships, it gets a row here with its source line.
Check it yourself: run the app, open PowerShell and run netstat -ano | findstr 3574 — you will see the three loopback listeners and nothing else.
C · Files
It writes to its own folder, and to files you choose.
Everything the app writes on its own lives under %APPDATA%\Cadence Animator:
settings.json — your theme, panel sizes, preferences
debug.log — the app’s own log, for bug reports
autosaves\ — your projects, ten rolling generations each
vfx-studio-autosave.cfx, audio\ and your saved presets
Anything else — a .cadence project, a Luau export, an image — goes through a save dialog you opened. The installer puts the program under your user profile (%LOCALAPPDATA%\Programs\Cadence Animator by default; it asks) and needs no administrator rights.
CadenceBridge.lua is the whole plugin. Cadence copies it into %LOCALAPPDATA%\Roblox\Plugins when you click the Studio offline chip — never on its own — and Studio only lets it make requests once you turn on Allow HTTP Requests for that place. Every request it makes goes to http://127.0.0.1:35747, which is the app on the same machine.
It runs inside Studio’s plugin sandbox, so it can read and write the place you have open (that is how rigs come in and animations go back) and nothing outside Studio.
script-src 'self' means no inline script and no script from any server, ever: the browser engine refuses it before it runs. Marker Luau and expressions you type are stored as text and evaluated by a small deterministic interpreter of their own, never by eval — the same policy blocks that too.
The 64 hex characters it prints must equal the installer hash above, letter for letter (case does not matter). If they differ, do not run the file: delete it and download again from this site.
F · VirusTotal
Look the file up by its hash.
These links open VirusTotal’s report for each build’s exact SHA-256 — the same hash you just verified. They resolve to an analysis once someone, anyone, has submitted that file; if nobody has yet, VirusTotal offers to scan your copy, which takes a minute.
An unsigned Electron app can pick up a heuristic flag from one scanner among seventy; that is what “unsigned” costs. The source above is how to settle it, and signing is what the paid plans will pay for.
G · Report a concern
Found something? Say so where everyone can see it.
Security concerns go to the public issue tracker, where the fix and the discussion are visible to every user. If you would rather not post details publicly, open an issue saying only that, and a private channel will be arranged from there.
Also useful: the app’s own log at %APPDATA%\Cadence Animator\debug.log, which records every network request it makes.
“Windows protected your PC” is about a signature, not a detection.
The first time you run a new release, SmartScreen shows a blue panel: Microsoft Defender
SmartScreen prevented an unrecognized app from starting. It appears because the file is not
code-signed — Windows cannot name a publisher, so it says Unknown publisher. It has
not found anything in the file; Defender still scans it like any other download. Click
More info, check the app name matches your file, then Run anyway.
A rendering of the dialog is on the download page.
A code-signing certificate costs about $150–300 a year for a project like this. The paid
plans will fund it once they open; when releases are signed the warning goes away for everyone,
free build included. Windows 11’s optional Smart App Control blocks unsigned apps outright
rather than warning; if you have it on, signing is the only fix.