How would I handle NPC behavior?

I would say have a new module script for attacks and handle it all on the server script but have the visual effects on the client (use remote events and :FireClient())