Where players actually are
The server keeps its own history of every player and compares it to what the game claims happened. A jump nothing can explain is arithmetic, not an opinion.
measured
Closed alpha · FiveM · server-side
That player just crossed 1.4 km of Los Santos in a third of a second. No vehicle, no ramp, no loading screen. Nobody reported him. The server already wrote it down.
Illustration. Every rule in the alpha runs in shadow mode, so nothing happens to your players yet.
Right now
Somebody flies through a wall. Six people clip it. One of them opens a ticket. An admin wakes up, watches the clip, argues with the guy, and picks a side with nothing but a video to go on. By then half the lobby has left.
A server-side check does not need the clip, the ticket or the argument. It saw the same tick the player did.
cheater-reports
What it watches
Not a list of cheat names. Cheat names change every month; these do not.
The server keeps its own history of every player and compares it to what the game claims happened. A jump nothing can explain is arithmetic, not an opinion.
measured
Every network event your server exposes gets declared and checked before it runs. Anything nobody declared is refused and written down.
measured
Leaked resources carry backdoors more often than anyone admits. Every installed resource is scanned for the patterns that hand a stranger your server.
weighed
One convar changed six months ago is enough to open a door. Your configuration is pinned to a known-good state and alarms when it moves.
measured
Every sanction
The worst thing an anticheat can do is ban the wrong person and have nothing to show for it. Every detection is written to an append-only log with what was seen, what was measured and which rule fired. You can hand it to the player.
Where it is today
Running on real servers in shadow mode: it watches and reports, and it does not touch a single player. Layers 0, 1 and 2 are in. The rest is being built in the open.
Questions
No. Everything runs in shadow mode: rules log and collect, and nothing kicks, warns or bans. The point of this phase is to measure how often each rule would have been wrong, before it is ever allowed to act.
Not in the current alpha. It is server-side only, and players do not notice it is there. The later client component adds no kernel driver, no companion app, no screen capture and no clipboard access.
Nothing. Alpha access is free for the servers we onboard, because we are asking them for something more valuable than money: real traffic and honest reports about what the rules get wrong.
ESX, QBCore and standalone servers. It works against the server itself (configuration, resources and network events) rather than hooking framework internals, so it does not care which one you run.
Every component has a hard performance budget that is measured rather than estimated, and the heavy work happens at boot instead of in the hot path. An anticheat that costs you tick rate gets switched off, and then you have no anticheat at all.
Without a license key, nothing. With one: event names with counters and argument types, never values and never player data, plus scan findings as resource, file, line and rule. Snippets and URLs are masked before upload, so keys, passwords and webhook URLs stay on your machine. The full unmasked reports are written locally.
No, and honestly, neither does anyone else. FiveM gives resources no access to hardware serials, a companion app that could read them would breach the platform terms, and spoofers defeat the values below the level anyone can read them anyway. What actually persists is an identity graph built from platform-issued tokens, which is what HWID bans in this ecosystem quietly are.
Because no vendor can verify one, including us. A percentage nobody can reproduce is a marketing number. What we can show instead is the false-positive rate of each individual rule, measured on real servers, which is the figure that decides whether you can leave an anticheat switched on.
The resource is distributed through the official Cfx asset escrow, and the detection logic deliberately lives in our backend rather than in the files you install. That is a licensing decision and a security one: anything shipped to a server can eventually be read by someone building bypasses.
Closed alpha
We onboard a limited number of servers so that every report is read by a person instead of a dashboard. If you run a server and want the rules to meet real traffic, come and say hello.
No payment, no commitment. Shadow mode means nothing happens to your players.