Reads your own session. Locally.
Every name in the lobby.
Before the first lock.
valstalker reads your live Valorant session on your own machine — rank, peak, act record and named loadouts for all ten players, from the first second of agent select. Your Riot tokens never leave your PC.
What it does
Lobby, player, session, rank.
The lobby, fully named
Every player in your match — rank, peak, act record, level and their named loadout. In agent select, all five enemies are named from the first second, while Riot's own enemy field is still null.
Step 1 of 4: The lobby, fully named
In detail
What you actually see.
Five views of one session, in the order you meet them: agent select first, the regional ladder last.
It keeps up with the match.
It follows the match from menus to post-game, and reattaches after a restart — tracker or Riot Client.
Menus
Reads you even while you idle
Agent select
The very first second
In match
Every round, live
Post-game
The full record
A restart mid-match is a reattach, not a reset — the session is read again from wherever the match is.
Under the hood
Read-only is a shape, not a promise.
The routes that could write to Riot are not disabled or guarded. They were never built.
the core
A Rust core, on your PC
Every authenticated call to Riot happens in a local Rust core. Nothing that holds your credentials runs anywhere else.
the surface
One local port
The Riot Client's lockfile serves its endpoints over 127.0.0.1 with Basic auth and a self-signed certificate. That is the entire local attack surface — and it is the same one Riot's own client uses.
the omission
Read-only by absence
The lock, select, quit and matchmaking routes are not implemented — not merely unused. Four write endpoints were catalogued and deliberately left unbuilt.
the blast radius
Why that line is drawn
With writes wired up, the worst a bug can do changes from showing wrong numbers to queueing games on your behalf. That is a different blast radius.
Where your data goes
Three places, and one of them is a dead end.
Your Riot credentials can buy skins, change loadouts and queue games. So they are held in exactly one place and given a way out of none.
A breach of our server cannot leak a Riot token.
It never receives one.
A bug in our server cannot act on your account.
It cannot authenticate as you.
A Riot schema change cannot break our server.
It never parses Riot's payloads.
Your machine
RSO token · entitlements JWT
The Rust core holds your credentials and makes every authenticated Riot call from here. These are account credentials — anything holding them could buy skins and queue games as you.
Our server
normalised data only
It receives only data structures this project defines — never a Riot token, never a raw Riot payload. It never parses Riot's schemas, so it could not read one if it arrived.
Public sources
aggregates · static content
HenrikDev for what Riot withholds mid-match, valorant-api.com for names and icons. Reached through our server, never with a Riot token.
Your Riot token stops here. It has no path across.
features in the catalog
run on your machine
need the server
use both
Riot tokens that leave
The full catalog
All seventy-six.
Nine categories. Colour marks where each one runs — and forty of them never touch a network we control.
- in the catalog
- 76
in the catalog
- run on your machine
- 40
run on your machine
- need the server
- 21
need the server
- use both
- 15
use both
Identity & profile
12Who a player is, and where they stand.
Match history & post-game
15Everything the scoreboard does not tell you.
Agent & map analytics
8What works, for you and for everyone.
Live match
5The match you are in, while you are in it.
Cosmetics & store
10Skins, bundles, and what they actually cost.
Esports
7VCT, ingested once and served to everyone.
Social & companion
7Watchlists, channels, shareable profiles.
Training & utility
7Aim, sensitivity, crosshairs, lineups.
Aggregates
5Numbers that need every player, not one.
Your machineServerBoth
How you run it
Three steps, and you do two of them already.
- 01
Queue like you always do
Nothing changes about how you play. The Riot Client is already running, already signed in, already serving its own local API on your machine.
- 02
valstalker reads that session
It talks to one local port with your own session — the same one Riot's client uses. It reads. It never writes, and nothing is injected, patched or intercepted.
- 03
The lobby fills in
Rank, peak, act record, level and named loadouts for all ten players — including all five enemies, from the first second of agent select.
What ships when
The parts that work, and the parts that don’t yet.
The engine is built and verified against live matches. The app you would double-click is not. Both of those are true and neither is buried.
Working now
Verified against live matches
- Identity, region and shard
- The full lobby, all ten players
- Any player by name, tag or PUUID
- Live session that survives restarts
- Regional leaderboard
- Per-match RR history
Next
Phase 4 of 9 — the reason there is no installer yet
- The desktop app itself
- The signed Windows installer
Later
Catalogued, not started — described in the future tense on purpose
- Party grouping
- Store, wallet and contracts
- Friends and Premier
- Server and queue status
- Price-history archive
Questions
Before you download.
Mostly about what leaves your machine, and what does not.
valstalker is read-only. It never writes to a Riot endpoint — no instalock, no auto-dodge, no presence writes. It reads the same local API that Riot's own client exposes on your machine, with your own session. It operates in the same territory as tracker.gg, Blitz and u.gg.
No. The RSO access token and entitlements JWT never leave your PC. Every authenticated call to Riot happens in a Rust core running locally. Our server receives only normalised data we define — never a token, never a raw Riot payload.
Nothing. Names, ranks and loadouts are fetched live from Riot while the match is on, rendered, and discarded.
Nothing is written to Riot, no game files are touched, no memory is read, and nothing is injected. It reads a local HTTP API.
No. The lobby view is fully local. The server adds what a local client cannot compute — community aggregates, esports, public profiles.
Riot's pregame endpoint hides the enemy team for the whole of selection, but the sibling loadouts endpoint on the same match names all ten players immediately. valstalker reads the one Riot leaves open.
Riot blanks those names during a live match and returns them afterwards. valstalker shows what Riot returns.
Windows. The Riot Client's local API is where the data lives.
Run it on your own machine.
Windows only. No account. Nothing leaves your PC that you did not send.
- Reads your session
- Read-only
- Nothing stored about others
Requires the Riot Client. Read-only — nothing is ever written to Riot. The Windows installer ships with the first public build. Why Windows may warn you about the installer.