netkit

The only way remotes are created. One shared module defines every remote; netkit creates them on the server, resolves them on the client, and guards every incoming server call with rate limiting → middleware → payload validation before the handler runs. Nothing in any game creates a raw RemoteEvent.

Shared realm: NetKit = "moxxum/netkit@0.1.0" under [dependencies].

API

NetKit.Event({ Rate = 10?, Validate = fn? })     -- definition marker
NetKit.Function({ Rate = 10?, Validate = fn? })  -- definition marker
NetKit.Define(defs)      -- server: creates remotes; client: waits for them (30s)
NetKit.Use(middleware)   -- (remoteName, player, packedArgs) -> boolean; false blocks
NetKit.OnBlocked(cb)     -- (player, remoteName, "rate"|"validate"|"middleware")

Per-remote Rate is requests/second per player (token bucket, default 10). Validate receives the unpacked payload and must return true or the call drops.

Server event wrapper: :Connect(handler), :Fire(player, ...), :FireAll(...), :FireExcept(player, ...). Client event wrapper: :Fire(...), :Connect(handler). Function wrapper: server :SetCallback(handler), client :Invoke(...) (returns nil when blocked).

Example

-- ReplicatedStorage/Shared/Remotes.luau (required by BOTH server and client)
local NetKit = require(ReplicatedStorage.Packages.NetKit)
return NetKit.Define({
	BuyItem = NetKit.Event({
		Rate = 5,
		Validate = function(itemId)
			return type(itemId) == "string"
		end,
	}),
})

-- server
local Remotes = require(ReplicatedStorage.Shared.Remotes)
Remotes.BuyItem:Connect(function(player, itemId)
	-- itemId is guaranteed to be a string and inside the rate budget
end)

-- client
local Remotes = require(ReplicatedStorage.Shared.Remotes)
Remotes.BuyItem:Fire("sword")

The server must require the defs module during bootstrap so remotes exist before clients ask for them. Wire guard's flood detection with NetKit.Use(Guard.NetMiddleware()).

Test

rojo build test.project.json -o test.rbxl, open in Studio, Play Solo. Client output shows pass lines; server output shows echoes plus rate/validate blocks.