Repository navigation
Legality & Risks
Last Update: October 15th, 2026 - All statements are checked on the day this document was last updated. The EULA can change with re-acceptance of it on the next login (Section 17), and detection can change with any game update.
Merframe reads game memory and the EE.log on your file system. This inherently sounds like a scary statement. To make a long story short: The same rules apply to every Warframe third-party app. Since 2023, reading memory is not a specific clause (2017 EULA, Section 2(h), names "areas of RAM") and generally falls under collecting information about the game by any means now.
TL;DR If you are not comfortable with that, don't use any third-party app. All further information seekers may find everything they need or are concerned with below.
Merframe does not write to or inject into the process (Windows Source (only PROCESS_VM_READ is requested)/Linux Source). There is no input automation and no calls to DE's API except the public worldState. Merframe does not upload game or account data to third parties. All third parties are listed under Privacy in the README.
Memory holds way more than the game shows to a user. Merframe only displays what a player could also work out by hand from what the game shows them. If it can be done with pen and paper, Merframe may show it.
The current EULA (Last Update July 6th 2023) forbids among other things the following in Section 7:
use, or provide, any unauthorized third-party programs that intercept, emulate, or redirect any communication between the Services and us or that collect information about the Game
and in the same list covers "third party program add-ons". Merframe reads the inventory the game just received and reads what the game displays. This falls under "intercept" and "collect information". "Provide" in the EULA also includes distributing Merframe, which applies to the maintainers.
This is virtually any Warframe third-party application. A public way to get authorized does not exist to our knowledge. The 2013 through 2017 to 2023 EULA had the statement "Digital Extremes may [...] allow the use of specified third party user interfaces". The 2023 rewrite no longer has this sentence.
Further clauses apply and have, to our knowledge, never been enforced against a tool:
- DE licenses you to "access and use the Services, including any Content, for your personal entertainment purposes leveraging only the functionality of the Game and Services" (EULA, Section 6, License Grant). Merframe and other companion apps fall outside of that since they are not a feature the game has.
- Reverse engineering is forbidden "except as otherwise permitted by applicable local law" (EULA, Section 7). Developing Merframe involved reverse engineering by a person residing in the European Union and was done through observing the running game. In the EU, observing a program you are licensed to run is a statutory right that a contract can not remove (Directive 2009/24/EC, Art. 5(3) and Art. 8). This only covers the reverse-engineering clause for the developer and does not change anything about the "collect information" clause of the EULA. Contributors outside of the EU should check their own law or precedents before working on the memory aspects of Merframe.
- Storing "information that could be used to identify an individual [...] from other users" (EULA, Section 7) is forbidden. The trade log stores your trade partner's name. We ask you to not publish usernames alongside your trade history.
Regardless of any specific clause, EULA Section 21 (Termination) and Terms of Use Section 11 (Account Termination) both allow Digital Extremes to terminate your account at any time, for any reason or none at all. Termination means the loss of all of your purchases with no refund (EULA, Section 21: "all payments and fees are non-refundable under all circumstances"). Appeals are to be made through the official support ticket system. Disputes go to arbitration in Singapore (EULA, Section 22), or to your home courts if you live in the EU or UK (EULA, Schedule A-1, Additional Terms for Residents of EU and UK).
DE's policy page (Third-Party Software and You) refuses to publish an allowed or banned list of software on purpose. The stated rule is "If you use external software in conjunction with Warframe, then you do so at your own risk". "Hefty and final" bans apply to altering game files, cheating, exploiting and AFK farming. The EULA defines Cheating as an unfair advantage over other players (Section 8, Ownership). Merframe internalizes this with the "pen and paper" rule above.
We found no code in the current game client that could lead to an automatic ban for running Merframe. This is an observational statement, not a guarantee and can change with any game update.
The game client has no observed kernel driver. On Windows the game does not use the functions that would list other processes reading its memory. On Linux the detection of what Merframe does is not practical and not observed. The game runs inside of Wine and thus has limited awareness of other processes on the machine.
A list of blacklisted process names exists on Windows (community guide, 2013, may be outdated), but Merframe is not known to be on it. By DE's own description, you land on this list if your program is tied to an exploit. Exposure to this grows with user count and is increased by the project being open-sourced (meaning that malicious forks that continue using the Merframe name may alter the memory actions taken and do something that will cause DE to ban the name for everyone).
In the worst case: A false positive ban stays in place until the support ticket is processed.
- You, the users, risk your account under the clauses above
- We, the maintainers, risk the "provide" clause and DE's legal attention. DE's legal actions on record have all targeted copies of its code or server emulation, see what DE has enforced so far at the bottom. Merframe contains no game code or script content outside of publicly observable names.
AlecaFrame uses Overwolf, which then in turn reads game memory. This is not officially documented, but independent analysis (WFHelper FAQ, Deftera186's Aleca on Linux notes) and our own inspection of gep_warframeext.dll show that process memory is opened and scanned for inventory data. This is what Merframe does as well.
There is a commonly misquoted statement by DE in their forum post on the 23rd August of 2022. DE's involvement with Overwolf was limited to "conversations to ensure the EULA is not breached", and that the app is to be used "at your own risk". This means that there is no publicly known special treatment for or cooperation with Overwolf developers.
The previous whitelist statement of the EULA confused people into misquoting it. There is no signature whitelist or other form of whitelist in the game client as of today.
All clauses that apply to AlecaFrame also apply to Merframe. A potential exception is the "for the benefit of any third party" (EULA, Section 7, First Bullet) clause. Overwolf and thus AlecaFrame run on an ad-funded platform. Treat this as an interpretation, not a fact.
WFinfo or Cephalon Cuda are lower in exposure/risk than Merframe, as they only screenshot and read EE.log. WFHelper is higher in exposure/risk as they read the current account session token from memory and then call DE's internal inventory snapshot endpoint as the client.
This is a clearer indication of what DE allows and does than any speculation.
- 2017: Cease & Desist against VoiD_Glitch datamine, plus ~35 account bans for people who used the data for trade scams and item forgery
- 2024: DMCA takedown of a decrypted dump of the game's internal encrypted scripts
- 2025: DMCA takedown of SpaceNinjaServer (also known as OpenWF), a server emulator. Counter-noticed, not pursued by DE and still online today.
Account bans for read-only tools are not documented. This is absence of evidence and should not be treated as proof of exemption. DE does not name programs in ban notices, so banned players cannot show which program banned them, nor which program did not.