The blueprint
Seven layers, and what each one is allowed to do.
This is the long version. It covers what each layer watches, why some findings are arithmetic and others are a judgement call, and what has to happen before any rule is allowed to touch a player. It does not cover our thresholds, our scoring or the checks themselves, because anyone building a bypass would start there.
[SwisserAC] swisserac_core started (0.6.5)
[SwisserAC] layer-0 hardening applied, verifying against manifest
[SwisserAC] configuration matches the expected manifest (checked=9)
[SwisserAC] event inventory: 138 net events across 85 resources
[SwisserAC] resource scan finished: 87 resources, 0 high, 21 medium
[SwisserAC] high severity finding: os.execute in <resource>:12
[SwisserAC] report uploaded, shadow stage, no player affected
The journey
One session, from boot to record.
What a player goes through, and what the server is doing while they do it. Read the left column on its own: for most of a session, and for every honest player, the answer is nothing.
-
00
Before anyone joins
What the player notices
Nothing. They are not here yet.
What the server does
Reads its own configuration against a pinned known-good state and scans every installed resource for the patterns that hand a stranger the server.
-
01
They connect
What the player notices
The normal loading screen. No download, no launcher, no driver.
What the server does
Resolves who this is against what it already knows, so a returning account arrives as a connected node rather than a clean slate.
-
02
They play
What the player notices
Nothing. No overlay, no stutter, no prompt.
What the server does
Checks every network event the server exposes before it runs, and keeps its own history of where each player has been.
-
03
Something does not fit
What the player notices
Still nothing. Nobody has decided anything yet.
What the server does
Writes a finding with the raw values it saw, not a rounded score. At this point it is an observation, not a verdict.
-
04
The finding is weighed
What the player notices
Nothing, or a warning they can read and answer.
What the server does
A measurement the server made itself can act alone. A statistical signal goes in front of a person first, every time.
-
05
It becomes a record
What the player notices
If it went that far: removed, with a reason they can read and appeal.
What the server does
Appends the detection and the sanction to a hash-chained log. Nobody edits that quietly afterwards, including us.
Stations 00 to 02 run on live servers today. Everything after them is in shadow mode: findings are written, nothing is acted on.
The state of the market
Most FiveM anticheats are lists.
A list identifies the menu that shipped last month. It says nothing about the exploit that walked in through your own event handlers, and nothing about the backdoor in the script you downloaded last night.
Lists expire.
Signature and texture blacklists need a fresh entry for every new cheat build. The maintenance scales with the cheat market. The detection rate does not.
The client can lie.
Anything computed on a player's machine can be changed on a player's machine. A check that depends on the client answering honestly is a request, not a check.
A false ban costs more.
An anticheat that occasionally bans an innocent player gets switched off faster than one that lets a few cheaters through. Trust is the actual product.
The worst case is not a cheater.
A backdoored resource hands over the whole server, not just an unfair advantage. Leaked scripts carry them routinely, and no aimbot detector will ever notice.
Blueprint
Defence in depth, one layer at a time.
SwisserAC is not a detector. It is a stack, and every layer is written on the assumption that the one before it has already been bypassed.
Everything arriving at your server
- −1
Network
deterministicRate limiting and caching in front of the game server, so a scripted flood never reaches the server thread in the first place.
- 0
Configuration & integrity
deterministicA hardened, versioned server configuration that alarms the moment it drifts, plus a static scan of every installed resource for backdoor patterns.
- 1
Event gateway
deterministicEvery network event your server exposes is declared, schema-checked, rate limited and authorised. Anything undeclared is refused and logged.
- 2
Server-side sensors
deterministicGame events are checked against what the server itself observed, including a rolling history per player. Claims about movement become server-side findings.
- 3
Bound client channel
deterministicA cryptographically bound, replay-protected session with the client component. An interruption is permanent and cannot be quietly healed.
- 4
Behavioural analysis
probabilisticRolling percentiles across your own player base instead of fixed limits. A cheat tuned to sit under a fixed threshold still sits outside its cohort.
- 5
Identity
probabilisticIdentities are held as a graph rather than a ban list, so a returning account is a connected node instead of a clean slate.
- 6
Evidence
deterministicEvery detection and every sanction is appended to a hash-chained log. Records cannot be silently edited or removed. Not even by an admin account.
What is left, on the record
Approach
Two kinds of proof, never mixed.
Most anticheats put a server-side fact and a statistical hunch in the same bucket and let the same threshold act on both. That is where false bans come from.
The server saw it happen.
The request reached the server and broke a rule the server enforces. Nothing is inferred, nothing is estimated, and the evidence is the request itself.
May act automatically
The numbers are unusual.
A statistical statement about how someone plays. It can be overwhelming and still be wrong, which is exactly why it is never allowed to end an account on its own.
Goes to a human, with evidence attached
No rule starts by banning.
Every detection rule walks the same three stages, and the promotion criteria are measured rather than felt.
- 01
Shadow
Logs only. Nothing is scored, nothing is shown, no player is affected, however certain the rule looks.
- 02
Warn
Scored and raised to admins, once the measured false-positive rate has stayed under target long enough to mean something.
- 03
Enforce
Full effect. A rule that starts misfiring in the field drops back to warn automatically, without waiting for anyone to notice.
We publish no detection percentage. Nobody can verify one, and a number nobody can verify is marketing.
Evidence
Every record answers the appeal.
A ban you cannot explain is a ban you will eventually reverse. Each detection is written to an append-only log where every entry carries the hash of the one before it, so records cannot be quietly edited or removed, not by a compromised admin account and not by us.
- Append-only
- Records are added, never updated. The history is the value, not the current state.
- Chained
- Each entry contains the hash of its predecessor, so removing one breaks every entry after it.
- Reproducible
- The raw values that triggered the rule are stored with it, so the decision can be re-examined rather than remembered.
- record
- #4812
- observed
- 2026-07-25 21:14:07.338 UTC
- rule
- event.undeclared
- stage
- shadow (logged, no effect)
- proof
- deterministic
- event
- bank:withdraw
- check
- schema
- raw value
- amount = -1000000
- subject
- identity#a91f…
- prev_hash
- 9c1f4d02…4e2a
- hash
- 3b70a8e1…d81c
Your players
Nothing they have to install.
An anticheat that demands trust from a player should be able to say precisely what it does on their machine. Ours currently does nothing at all, because the alpha is server-side only.
No kernel driver
No ring-0 component, now or later. FiveM offers no honest way to ship one, and the ones that exist elsewhere buy detection with a trust problem.
No companion app
Players are never asked to install a second program to be allowed on your server. Requiring one breaks the platform terms besides.
No screen or clipboard reading
We do not capture the screen for automatic judgement and we do not read the clipboard. Neither survives a serious look at proportionality.
No VPN or country blocking
Blunt filters that catch travellers, shared connections and diaspora communities more reliably than they catch cheaters. Not shipped.
What leaves your server.
With no license key set, nothing does. With one set, this is the complete list.
- Event inventory
- Event names with counters and argument types. Never argument values.
- Scan findings
- Resource, file, line and rule. Code snippets and URLs are masked before upload, so keys, passwords and webhook URLs never leave your machine.
- Player identifiers
- The identifiers a player presents at connect, so the same person stays recognisable when they return on a new account. They reach us in the clear, are hashed the moment they arrive and are never written down: what we keep is the hash. IP addresses are the exception and never leave your server at all.
- Stays local
- The full, unmasked reports and the identity graph are written to disk on your own server and are yours to read.
Status
Where the build actually is.
Closed alpha, running on real servers in shadow mode: logging and collecting, no kicks, no bans. The stack below is the plan; here is the honest split between shipped and not.
Shipped and running 4
Hardened configuration + drift detection
A versioned config set applied at boot and verified against a manifest, so a loosened value is an alarm instead of a silent regression.
Resource integrity scan
Every installed resource scanned for backdoor patterns at boot, with reviewed findings suppressible by reason rather than by silence.
Attack surface inventory
A full inventory of the network events your server exposes. For most servers, the first time that list has ever existed.
Signed config + report pipeline
Signed configuration from our backend and masked report upload, so rules can change without shipping a new build to anyone.
Next in the build 4
Event gateway enforcement
Declared schemas, rate limits and authorisation for every event. Currently observing; enforcement follows the measurement window.
Server-side sensors
Game event verification and the rolling per-player history that turns movement claims into server-side findings.
Bound client channel
The cryptographically bound session with the client component, and the telemetry that is only trusted through it.
Behavioural scoring
Cohort percentiles and the risk engine. Needs a population before it means anything, so it comes after the layers below it.
The first three phases carry roughly three quarters of the value. If this project stopped tomorrow, a server running it would still be measurably harder to exploit than it was.
Install
Three lines in your server.cfg.
No database to provision, no panel to host, no client resource to hand out. Unpack, add three lines, restart.
- Artifact 4960+
- Required for the escrow-protected build. Anything newer is fine.
- set, never sets
- sets publishes the value to every client. Your license key is not a public value.
- Review the hardening
- It applies recommended server convars. One of them also disables legitimate carjacking. Read it once and decide for your server.
1exec "resources/[swisserac]/swisserac_core/server/config/hardening.cfg"2set swisserac_licenseKey "sac_..."3ensure swisserac_coreClosed alpha
The alpha is small on purpose.
We onboard a limited number of servers so that every report is read by a person instead of a dashboard. If you run a server and want the rules to meet real traffic, come and say hello.
No payment, no commitment. Shadow mode means nothing happens to your players.