VTube Studio's plugin API draws a hard line at webcam access

The setup

VTube Studio, made by DenchiSoft, is the iOS, Android and desktop app that reads a phone or webcam's face tracking and drives a Live2D Cubism model, and its official wiki states it 'DOES NOT support 3D models,' pointing 3D VTubers elsewhere. Beyond the tracking app itself, DenchiSoft publishes a separate plugin API so third-party developers can extend it without an official feature. The documentation page on the developer's own site confirms this wiki is the official manual, 'updated either before or shortly after each release.'

What the documents show

The wiki's Plugins page documents a WebSocket API: VTube Studio starts a local server, by default on port 8001, that a plugin on the same PC, or even a web app, can connect to. A connected plugin can trigger hotkeys, inject values into existing tracking parameters, add entirely new custom parameters, and control items, positioning and expressions, described as a way to make 'literally anything' drive a model. One boundary is stated explicitly, not implied: 'plugins cannot access your webcam or read any personal data through VTS.' Access is gated by a one-time permission popup per plugin per computer, which does not reappear unless revoked. The developer's documentation page adds a separate note: plugin development carries no licensing fee, but 'companies may need to purchase a company license' for VTube Studio's own end-user terms, distinct from the free plugin API.

The craft

For a plugin developer, the result is a wide surface with one hard boundary: a Stream Deck integration, a Twitch-triggered hotkey, or hardware feeding a new parameter are all documented as achievable through the same connection, without DenchiSoft's involvement beyond the standard permission grant. For a performer choosing plugins, the documentation reframes the decision: since a plugin cannot see webcam footage or personal data through VTS by design, the real risk is what a plugin does with the model data and hotkeys it is granted, not hidden camera access.

Keeping the creator in control

The once-per-PC permission popup is the practical control a streamer has over which unofficial software can act on their model, and the wiki's no-webcam, no-personal-data line is a documented boundary, not an assumption. The documentation does not vouch for any plugin's trustworthiness, since third-party plugins are user-submitted software outside DenchiSoft's control. A creator should treat shared API access as a floor, not a guarantee, since the API's limits say nothing about what a given developer logs or stores. This caution is editorial, not a wiki statement.

• Has this plugin's permission request actually been reviewed, rather than approved by habit at the popup?
• Does a specific plugin need to read tracking parameters, or is it requesting broader access than its function requires?
• If revoking a plugin's access, has the permission actually been reset in VTube Studio's settings, not just the plugin closed?

The plugin API's real boundary is not what a plugin can move on a model, nearly everything, but what it is documented to never see, the performer's actual camera feed, and that distinction is what makes an open plugin ecosystem workable for a creator who wants to keep tracking hardware private.