Start using MClient

With the browser extension

The easiest way to obtain MClient is through its official browser extension. Only Google Chrome and Microsoft Edge are officially supported, although other browsers based on Chromium might work too Mozilla Firefox doesn't work at the moment. If your browser is Mozilla Firefox or you can't install extensions in your browser, do not worry. There are more ways to get MClient below. The MClient extension can also be used to load other custom clients in any game, since it will ask by default an URL pointing to an SB3 file to load.

Edge Add-ons

Chrome Web Store

Download (ZIP)

With the bookmarklet generator

If the extension doesn't work in your web browser or you don't want to/can't install it, you may also generate a JavaScript bookmarklet here. This bookmarklet generator was originally created by Anonynmous-exdash (intentional typo), and it was available on her GitHub website, but it got taken down, so this website is now using the same system to generate bookmarklets. It's really simple under the hood. Works for both Scratch and TurboWarp.

To use the bookmarklet, select a preset, click the button, and drag the link to your bookmarklet bar. Then, when you're in the game you want to use your mods in, click the bookmarklet in your bar and wait for it to load. Some users have reported problems with this in school computers, in such a case, you might need to use the browser extension.

JavaScript is required to use this. Please enable JavaScript and refresh the page.

JavaScript for developing custom clients

This won't install any client automatically in your game, but it will allow you to click "See Inside" without disabling the cloud variables. You may want to use this if you are developing your own custom client for a game or for any other reason. Works for both Scratch and TurboWarp.

Click the code to copy it to your clipboard.

function getScratchVM() {
    if (window.location.hostname == "turbowarp.org") {
        return window.vm;
    }
    
    const appElement = document.getElementById("app");
    if (!appElement) {
        return null;
    }

    const reactContainerKey = Object.keys(appElement).find(key => key.startsWith('__reactContainer$'));
    if (reactContainerKey) {
        try {
            const rootFiber = appElement[reactContainerKey];
            const AppFiber = rootFiber.child;
            const store = AppFiber?.pendingProps?.store || AppFiber?.memoizedProps?.store;
            
            if (store) {
                return store.getState().scratchGui.vm;
            }
        } catch (e) {
            console.warn("[INJECTOR]: React root container search failed. ", e);
        }
    }

    if (appElement._reactRootContainer) {
        try {
            const store = appElement._reactRootContainer._internalRoot.current.child.pendingProps.store;
            return store.getState().scratchGui.vm;
        } catch (e) {
            console.warn("[INJECTOR]: React 17 Legacy path failed:", e);
        }
    }

    console.error("[INJECTOR]: Failed to find Scratch's VM.");
    return null;
}

vm = getScratchVM();
if (vm) {
    console.log("[INJECTOR]: Found Scratch VM:", vm);
    vm.runtime.canAddCloudVariable = function() {
    return "true";
}


vm.runtime.ioDevices.cloud.provider.clear = function() {
    console.log("[INJECTOR]: Failed to hack the project! - Error: Cleared cloud provider.");
}


vm.runtime.ioDevices.cloud.setProvider = function(arg) {
    if (!arg == null) {
        vm.runtime.ioDevices.cloud.provider = arg;
    }
}

vm.runtime.ioDevices.cloud.provider.requestCloseConnection = function() {
    console.log("[INJECTOR]: Project hacked successfully!");
}
}

Download SB3 files from MClient

You may have these here.

4.0 Beta (Newest)

3.1 (1.3.1)

3.0 (1.3)

2.0 (1.2)

1.1

1.0 (Oldest)

Common concerns

Is MClient malware?

Depends of what your definition of "malware" is. If it is "A program that collects personal information from the user's PC or damages hardware/software", then no, MClient is totally safe for its user. If it extends to "A program that could be used for malicious purposes by the user, even if it doesn't affect this one, but could affect others", then MClient absolutely is Malware.

The MClient browser extension does not collect any personal information from you. Not even statistics, nothing. It doesn't introduce a vulnerability either to your account because it doesn't touch your credentials for anything since it targets the project player and not your account. It doesn't come "bundled with malware or spyware" either. When you install MClient from a web store or this website, you're only getting what you asked for, the browser extension. It's not obfuscated, so you can see with your own eyes what it exactly does. It only needs the scripting permission in fact.

Is MClient against the Scratch Terms of Use?

It's hard to know, but the facts strongly imply that it isn't. The following explanation is using the last update from the ToS in January 22, 2026. There's a problem with this question, and that is how the Scratch ToS are vague and mostly specifies the allowed and disallowed uses of the "service", which is defined as "websites at scratch.mit.edu, scratch.org, and related websites, hosted applications, downloadable applications, and related offerings". That's the exact same text, you can go check it yourself. And online multiplayer games are NOT "hosted applications", because they later define projects (which is what these are) as "User-generated content", completely separated from the service. It makes a clear distinction between user-generated projects (what we target) and what is actually part of the Scratch service (what we don't mess with). And this is relevant, because it doesn't just separate the concepts, but also explicitely mention that you are allowed to modify user-generated content. Even to break the rules of these contents.

It also mentions you shouldn't use Scratch or its API through unauthorized third-party software, on Section 11.6 here: "access, search, or otherwise use any portion of the Service through the use of any engine, software, tool, agent, device, or mechanism” other than software/search agents provided by Scratch". It's important to note that Scratch projects are later defined as user-generated content, and they're not a related application or website as "services" say. They're what they are: A user-generated project. They're what the service delivers to you, but they're not the service. And that's what MClient targets. However this term is also ambiguous, because it's contradicted by the Scratch Team forum posts in which they acknowledge how useful browser extensions are, while prohibiting advertising them. So, if we interpreted this term broadly enough to disallow MClient, other extensions like Scratch Addons, Scratch Tools, etc. would also violate the terms of service. And that doesn't make much sense.

Regarding cloud variables: The terms of use don't mention cloud variables at all, so this is even more ambiguous. But other sources like answers from Scratch Team members to Scratch users in forums and the Scratch Wiki give us enough information. You shouldn't use cloud variables for free-chat, or abuse them by flooding them so no one can use them. MClient can offer a free-chat functionality, but it's up to you to use it or not. It's well-known that cloud chatrooms Scratch projects are disallowed, but MClient isn't really a "Scratch Project" with fixed behaviors and whatever it does depends of the modules you enable. And it certainly doesn't prevent other people from using the cloud variables too, at worst, it makes the game unplayable, but that's not what the ToS prohibit. The concept of cloud variables and the data you send through cloud variables are NOT the same.

So no. MClient is probably not against the Scratch ToS. Why? As @Paddle2See once said: "And the reason it was made that way is that the primary purpose of Scratch is to teach coding - not to be a games platform. He was saying this to someone who was discussing how allowing people to modify the games affects the efficiency of Anti-Cheats. This is a real quote, and you can read it at the bottom in Sources. If you can't see inside, you can't learn how it works.". Precisely this summarizes everything. Unlike Epic Games or Ubisoft, Scratch doesn't have the resources to, and doesn't have to moderate people's games for them. It's not a gaming platform. If MClient hypotetically violated the ToS, other legitimate tools are against too. The terms must apply equally to all software. In fact, no one has ever been permanently banned for using MClient without having done something else too, and you'll certainly not be the first. The only risk you should be ware of is mass-reporting, and you can avoid making people angry enough to do that by limiting yourself with your use of MClient.

Is MClient ethically acceptable

That's up to you, and it's important to not mix what is ethically acceptable with what the terms of use say. Ruining the gameplay for everyone sure isn't ethically acceptable, but the Scratch Team isn't going to moderate those games for their creators.

There are many ethically legitimate reasons to use MClient. Some use it to play PC-only games in mobile. Many use it for 60 FPS compatibility and to optimize their game. I often use it to spectate games without being seen. And others use it to overpower normal players and fake their skill. The ethics depends of who's using this. Maltion is not going to restrict its use, because MClient is free software, and in order to comply with the 4 liberties, the user shouldn't be restricted in how they use the tool.

Sources

We have used these sources to explain why MClient isn't disallowed in Scratch.

Official Scratch ToS: https://mitscratch.freshdesk.com/en/support/solutions/articles/4000219182-scratch-terms-of-service

Official Scratch Wiki: https://en.scratch-wiki.info/wiki/Cloud_Data

The quoted Paddle2See forum post: https://scratch.mit.edu/discuss/topic/780248/?page=1#post-8138921