Skip to content

Everything Sculk watches, written down.

This is the whole surface, not a highlight reel. Each entry says what the server or client actually observes, so you can check our coverage against the cheats your community is running rather than against a marketing adjective.

143

Live detections

16

Detection groups

32

Supporting subsystems

15

Hardened convars

Counted from the shipped catalogue for Sculk FiveM 3.9.0-elite.

No detection here carries a verdict

Every detection's response is yours to set. Each one can observe silently, warn, kick, ban, or open a staff review case, and each carries its own strike window and threshold. Nothing in this catalogue enforces a fixed verdict.

That is why this catalogue has no punishment column. What a detection does on your server is a setting, and most servers start every one of them in observation mode and tighten from there once they have seen a week of their own traffic.

The detection catalogue

Grouped by the surface each one watches. A Server detection is decided from the server's own game events, so a cheater cannot argue with it. A Client detection is reported by the game client — valuable, and defeatable by a determined attacker, which is why client reports are weighted lower by default. A Both detection corroborates one against the other.

143 shown

Aim and targeting

13 detections

Camera, hit component and view-cone geometry compared against what the shot would have required from a human hand.

Modified hitbox

Server

Hit component index falls outside the range the game can produce.

antiModifiedHitbox

No-headshot bias

Server

Hits concentrate on a single body component far beyond a normal spread.

antiNoHeadshot

Aimbot

Server

Damage lands on a victim more than 135° behind the reported camera heading.

antiAimbot

Aimbot (composite)

Server

A composite score built from engagement statistics across a session rather than from any single shot.

antiAimbotAI

Soft aim

Server

Mean view error below the threshold a human aim curve produces. Off by default until validated in game.

antiSoftaim

Silent aim

Server

Damage registers outside the ping-scaled view cone the shooter actually held.

antiSilentAim

Blocked damage

Server

Eight or more hits from two or more shooters while health and armour barely move.

antiBlockedDamage

No recoil

Client

Per-shot camera pitch shows recoil suppressed rather than ridden.

antiNoRecoil

Aim assist

Client

Lock-on held while the player is nominally free-aiming. Off by default until validated in game.

antiAimAssist

Spin bot

Server

Ten or more heading jumps of 45° or more within three seconds.

antiSpinBot

Trigger bot

Client

Weapon discharge that follows target acquisition rather than player input.

antiTriggerBot

Auto clicker

Client

Sustained click rate averaging under 40ms between inputs.

antiAutoClicker

Input macro

Client

Input pattern variance under 5ms across sustained play — mechanically even rather than human.

antiMacro

Weapons and ammunition

17 detections

Weapon packets, damage ceilings, fire rates and magazine arithmetic checked against the values the base game can produce.

Weapon spoofer

ServerProbation

Impossible packet field combinations, such as silenced fall damage or saturated damage values.

On probation in 3.9.0: it warns until the server owner releases it.

antiWeaponSpoofer

Weapon denylist

ServerProbation

Weapons on an owner-configured denylist appearing in a player's hands.

On probation in 3.9.0: it warns until the server owner releases it.

antiWeapon

Ammo ceiling

Server

Ammunition counts above the vanilla maximum of 4,500.

antiAmmo

Weapon injection

ServerProbation

Giving weapons to three or more different players within ten seconds.

On probation in 3.9.0: it warns until the server owner releases it.

antiAddWeapon

Weapon stripping

ServerProbation

Stripping weapons from three or more different players within ten seconds.

On probation in 3.9.0: it warns until the server owner releases it.

antiRemoveWeapon

Damage modifier

ServerProbation

Overridden firearm damage far above the weapon's vanilla base, and saturated damage values.

On probation in 3.9.0: its new arm warns until the server owner releases it.

antiDamageChanger

Melee modifier

ServerProbation

Melee damage modifiers or overridden unarmed damage.

On probation in 3.9.0: it warns until the server owner releases it.

antiInfinitePunch

Explosive ammunition

Server

Explosive rounds identified by the explosion tag carried on the damage event.

antiExplosiveWeapon

Fast shoot

Server

Weapon cycling faster than the vanilla interval for that weapon.

antiFastShoot

Magic bullet

Server

A hit registered at an impossible range, correlated across both clients.

antiMagicBullet

Rapid fire

Server

Sustained median shot gap below the weapon's own cycle time.

antiRapidFire

No reload

Client

More rounds fired than the magazine holds, with no reload between them.

antiNoReload

Infinite ammo

Client

Total ammunition never decreases across sustained fire.

antiInfiniteAmmo

Tranquilizer abuse

Server

The tranquilizer weapon's instant-incapacitate used as a silent kill.

antiTranquilizer

Projectile abuse

ServerProbation

Projectiles owned by another player, spawned more than 1 km from their owner, or fired in floods.

On probation in 3.9.0: it warns until the server owner releases it.

antiProjectileAI

Money injection

Server

Credits above your configured ceilings, read from the framework's own money events (ESX, QBCore, Qbox).

antiMoneyInjection

Money rate abuse

Server

Many small balance changes in a short window — the dupe signature, minting value in pieces to stay under a per-transaction cap.

antiMoneyRateAbuse

Movement and position

9 detections

Position deltas, velocity and ground state measured against the physics the engine will actually grant a player on foot.

Teleport

Server

A position jump beyond the speed-scaled allowance for that player.

antiTeleport

Waypoint teleport

Server

The standstill–jump–standstill signature a waypoint warp leaves behind. Off by default: teleport judges these itself.

antiTeleportToWaypoint

Speed modifier

ServerProbation

On-foot speed above 12 m/s, or ground covered faster than 14 m/s while reporting a walking pace.

On probation in 3.9.0: its new arm warns until the server owner releases it.

antiSpeedChanger

Super jump

Server

The super-jump flag set, or vertical velocity above 12 m/s.

antiSuperJump

Desync

Server

Position desync patterns consistent with deliberate state divergence.

antiDesync

Fake lag

Server

Artificial latency and packet timing manipulation.

antiFakeLag

Ragdoll suppression

Client

Ragdoll state suppressed where the engine would have applied it.

antiRagdoll

Air brake

Client

On foot in the air with almost no vertical movement for four seconds.

antiAirBrake

Water walk

Client

Standing on deep water without swimming.

antiWaterWalk

Player state

11 detections

Health, armour, visibility and ped ownership — the attributes a player should only ever change on themselves, and only within limits.

Health

Both

Health above the configured ceiling, or above the player's own maximum.

antiHealth

Armour

Server

Armour above the configured ceiling, or above the player's own maximum.

antiArmor

Godmode

BothProbation

The synced invincibility flag held and re-checked, or set while other players' shots land.

On probation in 3.9.0: it warns until the server owner releases it.

antiGodmode

Invisibility

Both

A player hidden from others while moving, re-checked.

antiInvisible

Glitched player

Server

A player parked far under the map while not falling.

antiGlitchPlayer

Mass kill

Server

Mass-hit packets, absurd damage values, or hits at impossible range.

antiKill

Semi godmode

Server

Damage absorption confirmed across both clients in an engagement.

antiSemiGodmode

Ped immunity flags

Both

Engine-level switches that make a player immune to core mechanics: untargetable, immune to homing missiles, immune to tasers, friendly-fire protection removed. Menus set these and often never unset them, so they persist into ordinary play.

antiPedFlags

Untargetable while engaging

Both

The untargetable flag held while a player is armed and actively shooting — a combination no cutscene or scripted sequence explains.

antiUntargetable

Passive mode abuse

Both

The engine passive-mode flag held outside any state that legitimately sets it. Warns rather than acts, since passive mode is a real feature on many frameworks.

antiPassiveAbuse

Player launching

Server

A player launched into the air, attributed only when exactly one nearby player sent attack traffic. The victim is never flagged.

antiLaunchPlayer

Vehicles

17 detections

The widest surface in the catalogue: speed, handling, health, cosmetics and ownership, each measured against the vehicle's own class limits.

Vehicle godmode

Server

A damaged vehicle repeatedly restored to full health between sweeps.

antiVehicleGodmode

Vehicle health cap

Server

Body or engine health above the game's 1,000 maximum on a driven vehicle.

antiVehicleHealthCap

Plate change

Server

The number plate changed on a vehicle that already existed.

antiPlate

Horn boost

Client

Speed above the vehicle maximum while the horn is held.

antiHornBoost

Vehicle jump

Server

Vertical velocity above 25 m/s.

antiVehicleJump

Vehicle modifier

Server

Sustained speed above 306 km/h.

antiVehicleModifier

Moving spawn

Server

A vehicle that arrives already in motion.

antiShootVehicle

Vehicle flooding

ServerProbation

Six or more vehicles spawned within eight seconds. The rest of the burst is blocked.

On probation in 3.9.0: it warns until the server owner releases it.

antiVehicle

Vehicle weapons on foot

Server

Vehicle weapon damage dealt by a player who is not in a vehicle.

antiVehicleWeapons

Vehicle hijack

Server

Appearing directly in the driver seat of a moving vehicle.

antiVehicleHijack

Bulletproof tyres

Server

Tyres that never burst while the vehicle keeps taking bullet damage.

antiBulletProofTires

Collision disabled

Server

Driving above 10 m/s with vehicle collision switched off.

antiNoVehicleCollision

Handling modifier

Server

Acceleration averaging above 18 m/s² from 10 to 20 m/s.

antiVehicleHandling

Gravity modifier

Client

A driven car held more than 3 m in the air without falling.

antiVehicleGravity

Vehicle boost

Server

Speed above the maximum for that vehicle's class.

antiVehicleBoost

Vehicle flip

Server

Rotation changed by more than 90° within three seconds.

antiFlipVehicle

Vehicle teleport

Server

An occupied vehicle moved more than 200m within two seconds.

antiVehicleTeleport

Explosions

7 detections

Explosion type, ownership and audibility checked against the projectile or vehicle that should have caused them.

Malformed explosion

Server

An explosion type outside the valid range of −1 to 83.

antiMalformedExplosions

Explosion spoofer

Server

A vehicle tag with no vehicle, or ordnance with no projectile behind it.

antiExplosionSpoofer

Explosion denylist

Server

Explosion types on an owner-configured denylist.

antiExplosion

Invisible explosion

Server

An explosion flagged invisible that still deals damage.

antiInvisibleExplosion

Silent explosion

Server

An explosion flagged silent that still deals damage.

antiSilentExplosion

Maximum camera shake

Server

A damaging explosion held at the top of the camera-shake range, which blinds and destabilises the view of every player nearby at once. Nothing in normal play needs the maximum; a menu can hold the field there.

antiShakeExplosion

Phone explosion

Server

Remote detonation far from the player who sent it.

antiPhoneExplosions

Entities and world objects

13 detections

Who created an entity, who owns it now, and whether the place it appeared makes sense for the player who made it.

Forced animation

Server

An animation forced onto another player's ped.

antiAnims

Pickup flooding

Server

Six or more pickups created within twenty seconds.

antiPickup

Caging

Server

A cage prop placed within 12m of another player.

antiCage

Particle abuse

Server

Scale above 6.0, particles on other players' peds, or a rate above 20 per ten seconds.

antiParticles

Fire abuse

Server

Fires started beyond 150m, or a rate above 10 per ten seconds.

antiFire

Isolated spawn

Server

Entities created 300m or more from the player who created them.

antiIsolatedSpawn

Entity takeover

Server

Mass ownership takeover — four or more entities within sixty seconds.

antiEntityTakeover

Server entity deletion

Server

A pattern of server-created entities deleted by one client, recorded for staff review. It never strikes a player.

protectServerEntities

Entity state jump

Server

An unoccupied entity moving 300m or more in a single step.

antiEntityStateChange

Malformed entity

Server

A vehicle or ped with a model hash of zero, or an SLOD dummy model used as a real entity.

antiMalformedEntities

Invisible entity

Server

Entities spawned with rendering disabled so other players cannot see them.

antiInvisibleEntity

Electric fence

Client

The damage-on-proximity field mod menus attach to a player to hurt anyone who comes near.

antiElectricFence

Entity firewall violation

Server

An entity creation that your own firewall rules disallow, by type, population type or model. The rules are yours; this is the signal that one was broken.

antiEntityFirewall

Peds and objects

7 detections

Spawn volume, model choice and attachment — the three ways ped and object creation is used against a server.

Ped flooding

Server

Eight or more peds spawned within thirty seconds.

antiPed

Armed NPC

Server

NPCs spawned already carrying weapons.

antiNPC

Ped model change

Server

SLOD models, or four or more model changes within five minutes.

antiPedChanger

Forced ped task

Server

Tasks forced onto another player's ped, on the ped or on the wire.

antiPedTasks

Ped attachment

Server

An entity attached to another player's ped.

antiPedAttachments

Object flooding

Server

Eight or more objects created within ten seconds.

antiObject

Object attachment

Server

An object attached to another player.

antiAttached

Network and session

13 detections

Identity, connection provenance, and the integrity of the client's own reporting channel.

Ragdoll disabled

Client

Ragdoll disabled while the player is on foot.

antiNoRagdoll

VPN and proxy

ServerProbation

VPN, proxy or datacentre origin identified by IP lookup (proxycheck.io by default).

On probation in 3.9.0: it warns until the server owner releases it.

antiVPN

Crasher

Server

Malformed event payloads used as a client crash vector.

antiCrasher

Identifier spoofing

Server

Spoofed or stripped player identifiers.

antiSpoofer

Trust escalation

Server

Several weak signals stacking against one player until their trust score falls through the threshold.

antiTrustEscalation

Dashboard warning

Server

A warning issued by staff from the dashboard or Discord bot.

dashboardWarn

Offline account

Server

No Cfx.re account session behind the connection.

antiOffline

Networked sound abuse

Server

Sound broadcast abused through interact-sound and similar resources.

antiNetworkedSounds

Global voice

Client

Mumble proximity raised above the configured ceiling.

antiGlobalVoice

NUI blocker

Both

The anticheat's NUI frame blocked or stripped from the client.

antiNuiBlocker

Heartbeat failure

ServerProbation

A linked client that goes silent on the anticheat's channel while its game traffic keeps arriving, or whose reporting functions are replaced.

On probation in 3.9.0: it warns until the server owner releases it.

antiHeartbeat

Game event validation

Server

Inbound game events checked against what the sending client is actually entitled to trigger.

antiGameEvents

State bag abuse

Server

State-bag writes rate-limited and validated, closing the desync and client-crash vector they open.

antiStateBagAbuse

Cheat menus and clients

10 detections

The cheat itself rather than its effect: menu textures, commands the server never registered, and known probe events.

Free camera

Server

Camera held more than 55m from the ped for fifteen seconds or longer.

antiFreecam

Noclip

Both

Server half: frozen, invisible and collisionless while still changing position — the variant that also sets a synced flag. Client half: floating more than 10m above the nearest ground with no vehicle, parachute, fall or ragdoll to account for it. A noclip that only disables collision is missed by the server half.

antiNoclip

Spectate

Both

Spectator mode entered outside the staff tooling.

antiSpectate

Cheat menu

Both

Runtime menu textures, or commands the server never registered.

antiMenu

Known exploit events

Server

Exploit events fired for resources that are not on this server.

antiExploit

Bypass attempt

Server

Anticheat kill-switch events and probing for its internals.

antiBypass

Connection trigger

Server

An owner-authored connection rule matched. Enforcement arm of the trigger rules — it never fires on its own.

antiConnectionTrigger

Game-event rule

Server

An owner-authored game-event rule matched. Enforcement arm of the dashboard rules — it never fires on its own.

antiEventRule

Forced screen overlay

Client

Night-vision or thermal see-through post-process forced on. These are engine states read by a getter, not a menu's overlay — a stream-proof overlay cannot be seen from here. Legitimate NVG and thermal items also set them.

antiOverlay

Wall hack

Both

Aim tracked through walls, confirmed by a line-of-sight probe.

antiWallHack

Injectors

3 detections

Control events and payloads that belong to injector tooling rather than to any resource your server runs.

Injector control events

Server

Injector control events fired at the server.

antiTrigger

Troll sound payloads

Server

Known troll sound payloads broadcast to other players.

antiPlaySound

Unsent client resources

BothProbation

Server-confirmed: a client-only resource running that this server never sent — authoritative bookkeeping, but it only sees injectors that register a named resource. The client-reported half is a claim, not proof.

On probation in 3.9.0: its new arm warns until the server owner releases it.

antiInjector

Resource integrity

5 detections

Your own resource list as an attack surface: backdoors in stock resources, events for resources you do not run, and protected resources being stopped.

Backdoor signatures

Server

Known backdoor signatures found inside stock resources.

resourceProtection

Illegal entity

Server

Train spawns, zero-model entities, and entity floods.

antiIllegalEntity

Illegal trigger

Server

Events fired for resources that are not present on this server.

antiIllegalTrigger

Illegal weapon use

Server

Damage attributed to a weapon the player is not holding.

antiIllegalWeaponUse

Protected resource stopped

Server

The anticheat or another protected resource being stopped.

antiResourceStop

Moderation

9 detections

Names and chat, including the cheat advertising that usually arrives before the cheating does.

Blocked words

Server

Configured words plus cheat-advertising signatures in chat.

antiBlacklistWords

Honeypot events

ServerProbation

Decoy server events that exist only as traps. Nothing on your server calls them, so the only way one fires is if something enumerated your event surface and triggered it — which is what a cheat menu with a trigger list does. The one detection where firing is itself the proof.

On probation in 3.9.0: its new arm warns until the server owner releases it.

antiHoneypot

Blocked names

Server

Configured strings appearing in player names.

antiBlacklistName

Markup injection

Server

Markup injection attempted through chat or player names.

antiXSS

Non-alphanumeric name

Server

Control characters, colour codes and non-ASCII in player names.

antiNonAlphanumericName

Chat spam

Server

Chat flooding and repeated identical messages.

antiChatBot

Correlated crashes

Server

Mass client crashes correlated to one player's activity.

antiSuspiciousCrash

Boosting

Server

Kill/death ratios consistent with a paid boosting service rather than with play. A fair-play signal, not a cheat signature.

antiBoost

Sculk Mind learning

Server

Not a detection — the learning layer over this server's own enforcement verdicts. It groups repeated flags into patterns and learns from how each is judged, so a pattern with a clean history stops punishing innocent players and a repeat of a confirmed one resolves without a human. It can only ever make enforcement more cautious: it holds a ban for review, never issues one, and cannot override a deterministic detection. Owner-switchable.

antiSculkMind

Connection filters

5 detections

The connection gate. These run before a player is in the world, so a rejected connection never becomes an incident.

Account sharing

Server

Multiple concurrent players from a single IP address.

antiAccountShare

IP blocklist

Server

Blocked addresses and CIDR ranges.

antiIPBlacklist

Discord requirement

Server

Requires a Discord-linked Cfx.re account.

antiDiscordFilter

Token requirement

Server

Requires a minimum number of CFX hardware tokens.

antiForceTokens

Country filter

Server

Geo-IP allow and block lists by country code.

antiCountryFilter

DMA and external cheats

1 detection

Hardware and out-of-process cheats, which leave no trace inside the game client and can only be read from the behaviour they produce in play.

DMA aim assist (statistical)

Both

Behavioural only. Nothing observes hardware: a DMA reader on a second machine is invisible to the game process. This measures mechanical hit geometry and unusually low aim variance, which an excellent player also produces.

antiDMA

Anti-evasion

3 detections

What happens after a ban: the reconnection, the new account and the new hardware token are themselves the signal.

Identity cycling

Server

Reconnection patterns tracked across rolling 24-hour windows.

identityCycling

Account hopping

Server

One IP address presenting three or more different identities.

accountHopping

Token rotation

Server

Fresh hardware tokens presented on every reconnect.

tokenRotation

Retired detections

These 21 checks are switched off and do nothing in the current build. An audit found that each one either could never fire, duplicated another check, or would flag ordinary roleplay. They are not counted above. Their keys stay in the resource so saved settings and old links keep working.

Spoofed bullet

Retired

Duplicated silent aim without its weapon, vehicle and ping gating, so it added noise and no coverage.

Was under aim and targeting · antiSpoofedBullet

Client replays

Retired

It read a server convar, not a player, so it could never flag anyone. Set sv_disableClientReplays in server.cfg instead.

Was under player state · antiReplays

Outfit change

Retired

It listened for events FXServer never raises, so it never fired.

Was under player state · antiChangeOutfit

Task clearing

Retired

It read the event with the wrong signature and duplicated forced ped tasks, which covers the same abuse.

Was under player state · antiClearPedTasks

Infinite stamina

Retired

It called natives that only exist on the client from the server, so it never fired. The server has no stamina signal to read.

Was under player state · antiInfiniteStamina

Voice spoof

Retired

The state it read is set by voice resources during normal play. It is not a cheat signal.

Was under player state · antiVoiceSpoof

Colour change

Retired

A bug meant it never fired, and a working version would flag every respray shop.

Was under vehicles · antiVehicleColorChanger

Engine repair

Retired

Its streak could never complete, and a working version would flag mechanics. Vehicle godmode's repair check covers the cheat.

Was under vehicles · antiVehicleEngineChanger

Body repair

Retired

Its streak could never complete, and a working version would flag mechanics. Vehicle godmode's repair check covers the cheat.

Was under vehicles · antiVehicleArmorChanger

Livery change

Retired

It fired only on a coincidence and blamed whoever was driving at the time.

Was under vehicles · antiVehicleLivery

Window repair

Retired

Its streak could never complete, and a working version would flag repair kits.

Was under vehicles · antiVehicleWindows

Dirt reset

Retired

Its streak could never complete, and a working version would flag car washes.

Was under vehicles · antiCleanVehicle

Networked task injection

Retired

It handled the same two events as forced ped tasks and reached the same verdict. Merged into forced ped tasks.

Was under peds and objects · antiNetworkedTasks

ESP script residue

Retired

It scanned only the anticheat's own Lua state, which an injected menu never touches. ESP drawn from outside the game is invisible to every FiveM resource.

Was under cheat menus and clients · antiEsp

Cheat brand strings

Retired

It scanned only the anticheat's own Lua state, which an injected menu never touches.

Was under cheat menus and clients · antiMenuOCR

Hooked natives (client report)

Retired

Its timing probe always measured 0 ms because the game timer only advances once per frame, and a hooked native returns well-formed values.

Was under cheat menus and clients · antiHookNatives

Tampered environment (client report)

Retired

Both halves measured the anticheat's own state and files, which an executor never changes.

Was under cheat menus and clients · antiTamperedEnv

Proxy and VPN gate

Retired

It duplicated the VPN and proxy check with a second lookup on every join. The VPN check does the job once.

Was under connection filters · antiProxyDetect

Connection flood

Retired

It could never fire: the connection gate rate-limits each address before any check runs.

Was under connection filters · antiConnectionFlood

Night vision

Retired

Nothing reported it. Forced screen overlay watches the same night-vision state.

Was under vision overlays · antiNightVision

Thermal vision

Retired

Nothing reported it. Forced screen overlay watches the same thermal state.

Was under vision overlays · antiThermalVision

The machinery underneath

A detection is only as useful as the identity it is attached to and the record it lands in. These are the subsystems that decide who a player is, keep the catalogue honest, and make an incident reviewable a week later.

Core infrastructure

19 systems

Licensing, identity and the ban record — the layer that decides who a player is before any detection has an opinion about them.

Licence key activation
Activates against the Sculk API with a stable server identity binding.
Heartbeat
A 60-second interval that keeps the session alive and picks up revocations and upgrades.
Dashboard feed
Telemetry, player roster, resource list and console feed.
Dashboard commands
Delete vehicles, peds and objects, capture screenshots, and announce messages.
Multi-identifier extraction
license, license2, discord, fivem, steam, live, xbl and ip.
CFX hardware tokens
Server-issued tokens, which cannot be forged from Lua.
Stable key generation
A license → token → src fallback chain.
Persistent ban store
bans.json with hardware fingerprinting.
Alt-account cascade banning
Automatically bans known alternate accounts of a banned player.
Token-match threshold
Configurable token matching, defaulting to two.
Shared ban intelligence
Bans issued on other Sculk servers arrive as flags for your staff to review. They never block a player automatically.
Ban sync
Bidirectional synchronisation between the dashboard and the server.
Trust scoring
A 100-point scale with weighted penalties per detection class.
Multi-signal escalation
Trust under 25 combined with five or more unique detections escalates on its own.
Confidence-based capping
Deterministic, claim, policy and statistical signals each cap at a different maximum response.
Client report capping
Client-originated reports are capped at the lowest response unless you opt in.
Excuse system
Resources declare legitimate activity so it does not read as a detection.
Strike system
Per-detection hit counting inside configurable time windows.
Webhook integration
Separate Discord webhooks per response class, plus connect and disconnect.

Infrastructure subsystems

13 systems

The machinery the detections run on: authentication, rate limiting, evidence, and the monitoring that tells you when a detection has gone quiet.

Challenge–response auth
A chained multi-round hash protocol; each response is folded into the next challenge.
Event firewall
Per-player rate limits across 18 game event types. Events over the limit are dropped or flagged.
Detection health monitor
Every loop and handler pings a health tracker, which alerts on stale or broken detections.
Anti-evasion system
Tracks identity changes, reconnection patterns and account hopping.
Spectate tracker
Records who spectated whom, and identifies spectate bombing — more than five targets in thirty seconds.
Server hardening advisor
Checks twelve critical convars at boot and reports the holes.
Entity firewall
Rule-based entity control by type, model and population.
Whitelist zones
Areas in which specific detections are switched off.
Evidence system
Per-player detection history with a replay trace.
Screenshot capture
Game-view capture attached to detection events.
REST API
An HTTP API for external integration.
Trigger system
Owner-authored triggers evaluated at connection and at log time.
Reputation system
Connection gate reputation modes: none, loose, standard, strict and whitelist.

Hardening the engine itself

Some attacks are closed by configuration rather than by detection. Sculk checks these at boot and reports the ones your server.cfg leaves open — closing them removes whole categories of abuse before any detection has to notice.

Recommended server.cfg settings and what each one closes
SettingValueWhat it closes
onesynconRequired for entity tracking.
sv_entityLockdownrelaxedStops client scripts spawning networked entities. strict also blocks ambient traffic and peds.
sv_protectServerEntitiestrueStops clients deleting server-created entities (April 2025+ artifacts).
sv_filterRequestControl2Blocks control requests for player-controlled entities. 4 blocks all and can break tow scripts.
sv_stateBagStrictModetrueOnly the server writes networked state. Breaks client-side state writes.
sv_scriptHookAllowedfalseBlocks native trainers.
sv_enableNetworkedSoundsfalseRemoves the sound-broadcast vector.
sv_enableNetworkedScriptEntityStatesfalseBlocks client entity state pushes.
sv_enableNetworkedPhoneExplosionsfalseRemoves the phone explosion vector.
sv_disableClientReplaystrueTurns off client replays. Also disables the Rockstar Editor.
sv_pureLevel1Blocks modified game files. 2 also blocks graphics mods.
sv_requestParanoia2Counters proxy-based HTTP floods.
game_sanitizeRagdollEventstruePrevents remote forced-ragdoll. On by default.
game_sanitizePlayerAttachment1Blocks vehicles attaching to players (2 adds objects). On by default.
block_net_game_event9 eventsBlocks pickup, weapon and vehicle abuse events.

Coverage is the easy half. The record is the hard half.

A list this long is only worth anything if what it produces is readable by a moderator at 2am. The rollout guides cover how an incident reaches your staff and what they see when it does.

Catalogue for Sculk FiveM 3.9.0-elite. Detections are added and refined over time — the changelog records every change to this list.