ScriptingRendering

One namespace for both, but each call is only valid in its own pass. A 2D call from a renderWorld handler, or a 3D call from renderHud, throws with your file and line, because the alternative is drawing into whatever matrices happen to be loaded: an invisible artefact at best and the rest of the frame rendering wrong at worst.

Colours are 0xAARRGGBB. A string like '#FF5BD75B' works anywhere a colour does, and a six-digit value is given full alpha rather than being drawn invisibly.

2D, inside renderHud

render.text(s, x, y, argb)                  // returns the x it ended at
render.text(s, x, y, argb, shadow)
render.rect(x1, y1, x2, y2, argb)
render.outline(x1, y1, x2, y2, argb)
render.line(x1, y1, x2, y2, width, argb)
render.textWidth(s)
render.fontHeight()
render.width()   render.height()            // GUI units; also on the event

3D, inside renderWorld

render.box3d(x1, y1, z1, x2, y2, z2, argb, filled)
render.box(x, y, z, argb, filled)                 // one block
render.box3dEntity(playerOrEntity, argb, filled)  // interpolated for this frame
render.line3d(x1, y1, z1, x2, y2, z2, argb, width)
render.tracer(playerOrEntity, argb, width)
render.worldToScreen(x, y, z)                     // [x, y, depth] in GUI units, or null

worldToScreen answers null when the point is behind the camera, rather than a plausible pair of coordinates on the wrong side of the screen. Store the result and draw it in renderHud.

render.color(r, g, b, a) packs a colour; render.accent() is the live theme accent, so an overlay can follow the user's own colour including RGB mode.

function onRenderWorld(e) {
    world.players().forEach(function (p) {
        if (!p.self && p.threat > 70) render.box3dEntity(p, '#AAFF5B7A', false);
    });
}

There is no raw GL access

That is deliberate rather than cautious. This jar draws over Lunar's renderer and OptiFine's; a script that leaves depth-masking off is not a broken script, it is a broken client, with a black screen and no way to tell which of eleven loaded scripts did it. Every 3D call runs inside the host's own state bracket, which is set once per pass and fully restored afterwards.