Everything Sculk watches, written down.
This is the whole surface, not a highlight reel. Each entry says what the server or client actually observes, so you can check our coverage against the cheats your community is running rather than against a marketing adjective.
143
Live detections
16
Detection groups
32
Supporting subsystems
15
Hardened convars
Counted from the shipped catalogue for Sculk FiveM 3.9.0-elite.
No detection here carries a verdict
Every detection's response is yours to set. Each one can observe silently, warn, kick, ban, or open a staff review case, and each carries its own strike window and threshold. Nothing in this catalogue enforces a fixed verdict.
That is why this catalogue has no punishment column. What a detection does on your server is a setting, and most servers start every one of them in observation mode and tighten from there once they have seen a week of their own traffic.
The detection catalogue
Grouped by the surface each one watches. A Server detection is decided from the server's own game events, so a cheater cannot argue with it. A Client detection is reported by the game client — valuable, and defeatable by a determined attacker, which is why client reports are weighted lower by default. A Both detection corroborates one against the other.
143 shown
Aim and targeting
13 detectionsCamera, hit component and view-cone geometry compared against what the shot would have required from a human hand.
Modified hitbox
ServerHit component index falls outside the range the game can produce.
antiModifiedHitbox
No-headshot bias
ServerHits concentrate on a single body component far beyond a normal spread.
antiNoHeadshot
Aimbot
ServerDamage lands on a victim more than 135° behind the reported camera heading.
antiAimbot
Aimbot (composite)
ServerA composite score built from engagement statistics across a session rather than from any single shot.
antiAimbotAI
Soft aim
ServerMean view error below the threshold a human aim curve produces. Off by default until validated in game.
antiSoftaim
Silent aim
ServerDamage registers outside the ping-scaled view cone the shooter actually held.
antiSilentAim
Blocked damage
ServerEight or more hits from two or more shooters while health and armour barely move.
antiBlockedDamage
No recoil
ClientPer-shot camera pitch shows recoil suppressed rather than ridden.
antiNoRecoil
Aim assist
ClientLock-on held while the player is nominally free-aiming. Off by default until validated in game.
antiAimAssist
Spin bot
ServerTen or more heading jumps of 45° or more within three seconds.
antiSpinBot
Trigger bot
ClientWeapon discharge that follows target acquisition rather than player input.
antiTriggerBot
Auto clicker
ClientSustained click rate averaging under 40ms between inputs.
antiAutoClicker
Input macro
ClientInput pattern variance under 5ms across sustained play — mechanically even rather than human.
antiMacro
Weapons and ammunition
17 detectionsWeapon packets, damage ceilings, fire rates and magazine arithmetic checked against the values the base game can produce.
Weapon spoofer
ServerProbationImpossible packet field combinations, such as silenced fall damage or saturated damage values.
On probation in 3.9.0: it warns until the server owner releases it.
antiWeaponSpoofer
Weapon denylist
ServerProbationWeapons on an owner-configured denylist appearing in a player's hands.
On probation in 3.9.0: it warns until the server owner releases it.
antiWeapon
Ammo ceiling
ServerAmmunition counts above the vanilla maximum of 4,500.
antiAmmo
Weapon injection
ServerProbationGiving weapons to three or more different players within ten seconds.
On probation in 3.9.0: it warns until the server owner releases it.
antiAddWeapon
Weapon stripping
ServerProbationStripping weapons from three or more different players within ten seconds.
On probation in 3.9.0: it warns until the server owner releases it.
antiRemoveWeapon
Damage modifier
ServerProbationOverridden firearm damage far above the weapon's vanilla base, and saturated damage values.
On probation in 3.9.0: its new arm warns until the server owner releases it.
antiDamageChanger
Melee modifier
ServerProbationMelee damage modifiers or overridden unarmed damage.
On probation in 3.9.0: it warns until the server owner releases it.
antiInfinitePunch
Explosive ammunition
ServerExplosive rounds identified by the explosion tag carried on the damage event.
antiExplosiveWeapon
Fast shoot
ServerWeapon cycling faster than the vanilla interval for that weapon.
antiFastShoot
Magic bullet
ServerA hit registered at an impossible range, correlated across both clients.
antiMagicBullet
Rapid fire
ServerSustained median shot gap below the weapon's own cycle time.
antiRapidFire
No reload
ClientMore rounds fired than the magazine holds, with no reload between them.
antiNoReload
Infinite ammo
ClientTotal ammunition never decreases across sustained fire.
antiInfiniteAmmo
Tranquilizer abuse
ServerThe tranquilizer weapon's instant-incapacitate used as a silent kill.
antiTranquilizer
Projectile abuse
ServerProbationProjectiles owned by another player, spawned more than 1 km from their owner, or fired in floods.
On probation in 3.9.0: it warns until the server owner releases it.
antiProjectileAI
Money injection
ServerCredits above your configured ceilings, read from the framework's own money events (ESX, QBCore, Qbox).
antiMoneyInjection
Money rate abuse
ServerMany small balance changes in a short window — the dupe signature, minting value in pieces to stay under a per-transaction cap.
antiMoneyRateAbuse
Movement and position
9 detectionsPosition deltas, velocity and ground state measured against the physics the engine will actually grant a player on foot.
Teleport
ServerA position jump beyond the speed-scaled allowance for that player.
antiTeleport
Waypoint teleport
ServerThe standstill–jump–standstill signature a waypoint warp leaves behind. Off by default: teleport judges these itself.
antiTeleportToWaypoint
Speed modifier
ServerProbationOn-foot speed above 12 m/s, or ground covered faster than 14 m/s while reporting a walking pace.
On probation in 3.9.0: its new arm warns until the server owner releases it.
antiSpeedChanger
Super jump
ServerThe super-jump flag set, or vertical velocity above 12 m/s.
antiSuperJump
Desync
ServerPosition desync patterns consistent with deliberate state divergence.
antiDesync
Fake lag
ServerArtificial latency and packet timing manipulation.
antiFakeLag
Ragdoll suppression
ClientRagdoll state suppressed where the engine would have applied it.
antiRagdoll
Air brake
ClientOn foot in the air with almost no vertical movement for four seconds.
antiAirBrake
Water walk
ClientStanding on deep water without swimming.
antiWaterWalk
Player state
11 detectionsHealth, armour, visibility and ped ownership — the attributes a player should only ever change on themselves, and only within limits.
Health
BothHealth above the configured ceiling, or above the player's own maximum.
antiHealth
Armour
ServerArmour above the configured ceiling, or above the player's own maximum.
antiArmor
Godmode
BothProbationThe synced invincibility flag held and re-checked, or set while other players' shots land.
On probation in 3.9.0: it warns until the server owner releases it.
antiGodmode
Invisibility
BothA player hidden from others while moving, re-checked.
antiInvisible
Glitched player
ServerA player parked far under the map while not falling.
antiGlitchPlayer
Mass kill
ServerMass-hit packets, absurd damage values, or hits at impossible range.
antiKill
Semi godmode
ServerDamage absorption confirmed across both clients in an engagement.
antiSemiGodmode
Ped immunity flags
BothEngine-level switches that make a player immune to core mechanics: untargetable, immune to homing missiles, immune to tasers, friendly-fire protection removed. Menus set these and often never unset them, so they persist into ordinary play.
antiPedFlags
Untargetable while engaging
BothThe untargetable flag held while a player is armed and actively shooting — a combination no cutscene or scripted sequence explains.
antiUntargetable
Passive mode abuse
BothThe engine passive-mode flag held outside any state that legitimately sets it. Warns rather than acts, since passive mode is a real feature on many frameworks.
antiPassiveAbuse
Player launching
ServerA player launched into the air, attributed only when exactly one nearby player sent attack traffic. The victim is never flagged.
antiLaunchPlayer
Vehicles
17 detectionsThe widest surface in the catalogue: speed, handling, health, cosmetics and ownership, each measured against the vehicle's own class limits.
Vehicle godmode
ServerA damaged vehicle repeatedly restored to full health between sweeps.
antiVehicleGodmode
Vehicle health cap
ServerBody or engine health above the game's 1,000 maximum on a driven vehicle.
antiVehicleHealthCap
Plate change
ServerThe number plate changed on a vehicle that already existed.
antiPlate
Horn boost
ClientSpeed above the vehicle maximum while the horn is held.
antiHornBoost
Vehicle jump
ServerVertical velocity above 25 m/s.
antiVehicleJump
Vehicle modifier
ServerSustained speed above 306 km/h.
antiVehicleModifier
Moving spawn
ServerA vehicle that arrives already in motion.
antiShootVehicle
Vehicle flooding
ServerProbationSix or more vehicles spawned within eight seconds. The rest of the burst is blocked.
On probation in 3.9.0: it warns until the server owner releases it.
antiVehicle
Vehicle weapons on foot
ServerVehicle weapon damage dealt by a player who is not in a vehicle.
antiVehicleWeapons
Vehicle hijack
ServerAppearing directly in the driver seat of a moving vehicle.
antiVehicleHijack
Bulletproof tyres
ServerTyres that never burst while the vehicle keeps taking bullet damage.
antiBulletProofTires
Collision disabled
ServerDriving above 10 m/s with vehicle collision switched off.
antiNoVehicleCollision
Handling modifier
ServerAcceleration averaging above 18 m/s² from 10 to 20 m/s.
antiVehicleHandling
Gravity modifier
ClientA driven car held more than 3 m in the air without falling.
antiVehicleGravity
Vehicle boost
ServerSpeed above the maximum for that vehicle's class.
antiVehicleBoost
Vehicle flip
ServerRotation changed by more than 90° within three seconds.
antiFlipVehicle
Vehicle teleport
ServerAn occupied vehicle moved more than 200m within two seconds.
antiVehicleTeleport
Explosions
7 detectionsExplosion type, ownership and audibility checked against the projectile or vehicle that should have caused them.
Malformed explosion
ServerAn explosion type outside the valid range of −1 to 83.
antiMalformedExplosions
Explosion spoofer
ServerA vehicle tag with no vehicle, or ordnance with no projectile behind it.
antiExplosionSpoofer
Explosion denylist
ServerExplosion types on an owner-configured denylist.
antiExplosion
Invisible explosion
ServerAn explosion flagged invisible that still deals damage.
antiInvisibleExplosion
Silent explosion
ServerAn explosion flagged silent that still deals damage.
antiSilentExplosion
Maximum camera shake
ServerA damaging explosion held at the top of the camera-shake range, which blinds and destabilises the view of every player nearby at once. Nothing in normal play needs the maximum; a menu can hold the field there.
antiShakeExplosion
Phone explosion
ServerRemote detonation far from the player who sent it.
antiPhoneExplosions
Entities and world objects
13 detectionsWho created an entity, who owns it now, and whether the place it appeared makes sense for the player who made it.
Forced animation
ServerAn animation forced onto another player's ped.
antiAnims
Pickup flooding
ServerSix or more pickups created within twenty seconds.
antiPickup
Caging
ServerA cage prop placed within 12m of another player.
antiCage
Particle abuse
ServerScale above 6.0, particles on other players' peds, or a rate above 20 per ten seconds.
antiParticles
Fire abuse
ServerFires started beyond 150m, or a rate above 10 per ten seconds.
antiFire
Isolated spawn
ServerEntities created 300m or more from the player who created them.
antiIsolatedSpawn
Entity takeover
ServerMass ownership takeover — four or more entities within sixty seconds.
antiEntityTakeover
Server entity deletion
ServerA pattern of server-created entities deleted by one client, recorded for staff review. It never strikes a player.
protectServerEntities
Entity state jump
ServerAn unoccupied entity moving 300m or more in a single step.
antiEntityStateChange
Malformed entity
ServerA vehicle or ped with a model hash of zero, or an SLOD dummy model used as a real entity.
antiMalformedEntities
Invisible entity
ServerEntities spawned with rendering disabled so other players cannot see them.
antiInvisibleEntity
Electric fence
ClientThe damage-on-proximity field mod menus attach to a player to hurt anyone who comes near.
antiElectricFence
Entity firewall violation
ServerAn entity creation that your own firewall rules disallow, by type, population type or model. The rules are yours; this is the signal that one was broken.
antiEntityFirewall
Peds and objects
7 detectionsSpawn volume, model choice and attachment — the three ways ped and object creation is used against a server.
Ped flooding
ServerEight or more peds spawned within thirty seconds.
antiPed
Armed NPC
ServerNPCs spawned already carrying weapons.
antiNPC
Ped model change
ServerSLOD models, or four or more model changes within five minutes.
antiPedChanger
Forced ped task
ServerTasks forced onto another player's ped, on the ped or on the wire.
antiPedTasks
Ped attachment
ServerAn entity attached to another player's ped.
antiPedAttachments
Object flooding
ServerEight or more objects created within ten seconds.
antiObject
Object attachment
ServerAn object attached to another player.
antiAttached
Network and session
13 detectionsIdentity, connection provenance, and the integrity of the client's own reporting channel.
Ragdoll disabled
ClientRagdoll disabled while the player is on foot.
antiNoRagdoll
VPN and proxy
ServerProbationVPN, proxy or datacentre origin identified by IP lookup (proxycheck.io by default).
On probation in 3.9.0: it warns until the server owner releases it.
antiVPN
Crasher
ServerMalformed event payloads used as a client crash vector.
antiCrasher
Identifier spoofing
ServerSpoofed or stripped player identifiers.
antiSpoofer
Trust escalation
ServerSeveral weak signals stacking against one player until their trust score falls through the threshold.
antiTrustEscalation
Dashboard warning
ServerA warning issued by staff from the dashboard or Discord bot.
dashboardWarn
Offline account
ServerNo Cfx.re account session behind the connection.
antiOffline
Networked sound abuse
ServerSound broadcast abused through interact-sound and similar resources.
antiNetworkedSounds
Global voice
ClientMumble proximity raised above the configured ceiling.
antiGlobalVoice
NUI blocker
BothThe anticheat's NUI frame blocked or stripped from the client.
antiNuiBlocker
Heartbeat failure
ServerProbationA linked client that goes silent on the anticheat's channel while its game traffic keeps arriving, or whose reporting functions are replaced.
On probation in 3.9.0: it warns until the server owner releases it.
antiHeartbeat
Game event validation
ServerInbound game events checked against what the sending client is actually entitled to trigger.
antiGameEvents
State bag abuse
ServerState-bag writes rate-limited and validated, closing the desync and client-crash vector they open.
antiStateBagAbuse
Cheat menus and clients
10 detectionsThe cheat itself rather than its effect: menu textures, commands the server never registered, and known probe events.
Free camera
ServerCamera held more than 55m from the ped for fifteen seconds or longer.
antiFreecam
Noclip
BothServer half: frozen, invisible and collisionless while still changing position — the variant that also sets a synced flag. Client half: floating more than 10m above the nearest ground with no vehicle, parachute, fall or ragdoll to account for it. A noclip that only disables collision is missed by the server half.
antiNoclip
Spectate
BothSpectator mode entered outside the staff tooling.
antiSpectate
Cheat menu
BothRuntime menu textures, or commands the server never registered.
antiMenu
Known exploit events
ServerExploit events fired for resources that are not on this server.
antiExploit
Bypass attempt
ServerAnticheat kill-switch events and probing for its internals.
antiBypass
Connection trigger
ServerAn owner-authored connection rule matched. Enforcement arm of the trigger rules — it never fires on its own.
antiConnectionTrigger
Game-event rule
ServerAn owner-authored game-event rule matched. Enforcement arm of the dashboard rules — it never fires on its own.
antiEventRule
Forced screen overlay
ClientNight-vision or thermal see-through post-process forced on. These are engine states read by a getter, not a menu's overlay — a stream-proof overlay cannot be seen from here. Legitimate NVG and thermal items also set them.
antiOverlay
Wall hack
BothAim tracked through walls, confirmed by a line-of-sight probe.
antiWallHack
Injectors
3 detectionsControl events and payloads that belong to injector tooling rather than to any resource your server runs.
Injector control events
ServerInjector control events fired at the server.
antiTrigger
Troll sound payloads
ServerKnown troll sound payloads broadcast to other players.
antiPlaySound
Unsent client resources
BothProbationServer-confirmed: a client-only resource running that this server never sent — authoritative bookkeeping, but it only sees injectors that register a named resource. The client-reported half is a claim, not proof.
On probation in 3.9.0: its new arm warns until the server owner releases it.
antiInjector
Resource integrity
5 detectionsYour own resource list as an attack surface: backdoors in stock resources, events for resources you do not run, and protected resources being stopped.
Backdoor signatures
ServerKnown backdoor signatures found inside stock resources.
resourceProtection
Illegal entity
ServerTrain spawns, zero-model entities, and entity floods.
antiIllegalEntity
Illegal trigger
ServerEvents fired for resources that are not present on this server.
antiIllegalTrigger
Illegal weapon use
ServerDamage attributed to a weapon the player is not holding.
antiIllegalWeaponUse
Protected resource stopped
ServerThe anticheat or another protected resource being stopped.
antiResourceStop
Moderation
9 detectionsNames and chat, including the cheat advertising that usually arrives before the cheating does.
Blocked words
ServerConfigured words plus cheat-advertising signatures in chat.
antiBlacklistWords
Honeypot events
ServerProbationDecoy server events that exist only as traps. Nothing on your server calls them, so the only way one fires is if something enumerated your event surface and triggered it — which is what a cheat menu with a trigger list does. The one detection where firing is itself the proof.
On probation in 3.9.0: its new arm warns until the server owner releases it.
antiHoneypot
Blocked names
ServerConfigured strings appearing in player names.
antiBlacklistName
Markup injection
ServerMarkup injection attempted through chat or player names.
antiXSS
Non-alphanumeric name
ServerControl characters, colour codes and non-ASCII in player names.
antiNonAlphanumericName
Chat spam
ServerChat flooding and repeated identical messages.
antiChatBot
Correlated crashes
ServerMass client crashes correlated to one player's activity.
antiSuspiciousCrash
Boosting
ServerKill/death ratios consistent with a paid boosting service rather than with play. A fair-play signal, not a cheat signature.
antiBoost
Sculk Mind learning
ServerNot a detection — the learning layer over this server's own enforcement verdicts. It groups repeated flags into patterns and learns from how each is judged, so a pattern with a clean history stops punishing innocent players and a repeat of a confirmed one resolves without a human. It can only ever make enforcement more cautious: it holds a ban for review, never issues one, and cannot override a deterministic detection. Owner-switchable.
antiSculkMind
Connection filters
5 detectionsThe connection gate. These run before a player is in the world, so a rejected connection never becomes an incident.
IP blocklist
ServerBlocked addresses and CIDR ranges.
antiIPBlacklist
Discord requirement
ServerRequires a Discord-linked Cfx.re account.
antiDiscordFilter
Token requirement
ServerRequires a minimum number of CFX hardware tokens.
antiForceTokens
Country filter
ServerGeo-IP allow and block lists by country code.
antiCountryFilter
DMA and external cheats
1 detectionHardware and out-of-process cheats, which leave no trace inside the game client and can only be read from the behaviour they produce in play.
DMA aim assist (statistical)
BothBehavioural only. Nothing observes hardware: a DMA reader on a second machine is invisible to the game process. This measures mechanical hit geometry and unusually low aim variance, which an excellent player also produces.
antiDMA
Anti-evasion
3 detectionsWhat happens after a ban: the reconnection, the new account and the new hardware token are themselves the signal.
Identity cycling
ServerReconnection patterns tracked across rolling 24-hour windows.
identityCycling
Account hopping
ServerOne IP address presenting three or more different identities.
accountHopping
Token rotation
ServerFresh hardware tokens presented on every reconnect.
tokenRotation
Retired detections
These 21 checks are switched off and do nothing in the current build. An audit found that each one either could never fire, duplicated another check, or would flag ordinary roleplay. They are not counted above. Their keys stay in the resource so saved settings and old links keep working.
Spoofed bullet
RetiredDuplicated silent aim without its weapon, vehicle and ping gating, so it added noise and no coverage.
Was under aim and targeting · antiSpoofedBullet
Client replays
RetiredIt read a server convar, not a player, so it could never flag anyone. Set sv_disableClientReplays in server.cfg instead.
Was under player state · antiReplays
Outfit change
RetiredIt listened for events FXServer never raises, so it never fired.
Was under player state · antiChangeOutfit
Task clearing
RetiredIt read the event with the wrong signature and duplicated forced ped tasks, which covers the same abuse.
Was under player state · antiClearPedTasks
Infinite stamina
RetiredIt called natives that only exist on the client from the server, so it never fired. The server has no stamina signal to read.
Was under player state · antiInfiniteStamina
Voice spoof
RetiredThe state it read is set by voice resources during normal play. It is not a cheat signal.
Was under player state · antiVoiceSpoof
Colour change
RetiredA bug meant it never fired, and a working version would flag every respray shop.
Was under vehicles · antiVehicleColorChanger
Engine repair
RetiredIts streak could never complete, and a working version would flag mechanics. Vehicle godmode's repair check covers the cheat.
Was under vehicles · antiVehicleEngineChanger
Body repair
RetiredIts streak could never complete, and a working version would flag mechanics. Vehicle godmode's repair check covers the cheat.
Was under vehicles · antiVehicleArmorChanger
Livery change
RetiredIt fired only on a coincidence and blamed whoever was driving at the time.
Was under vehicles · antiVehicleLivery
Window repair
RetiredIts streak could never complete, and a working version would flag repair kits.
Was under vehicles · antiVehicleWindows
Dirt reset
RetiredIts streak could never complete, and a working version would flag car washes.
Was under vehicles · antiCleanVehicle
Networked task injection
RetiredIt handled the same two events as forced ped tasks and reached the same verdict. Merged into forced ped tasks.
Was under peds and objects · antiNetworkedTasks
ESP script residue
RetiredIt scanned only the anticheat's own Lua state, which an injected menu never touches. ESP drawn from outside the game is invisible to every FiveM resource.
Was under cheat menus and clients · antiEsp
Cheat brand strings
RetiredIt scanned only the anticheat's own Lua state, which an injected menu never touches.
Was under cheat menus and clients · antiMenuOCR
Hooked natives (client report)
RetiredIts timing probe always measured 0 ms because the game timer only advances once per frame, and a hooked native returns well-formed values.
Was under cheat menus and clients · antiHookNatives
Tampered environment (client report)
RetiredBoth halves measured the anticheat's own state and files, which an executor never changes.
Was under cheat menus and clients · antiTamperedEnv
Proxy and VPN gate
RetiredIt duplicated the VPN and proxy check with a second lookup on every join. The VPN check does the job once.
Was under connection filters · antiProxyDetect
Connection flood
RetiredIt could never fire: the connection gate rate-limits each address before any check runs.
Was under connection filters · antiConnectionFlood
Night vision
RetiredNothing reported it. Forced screen overlay watches the same night-vision state.
Was under vision overlays · antiNightVision
Thermal vision
RetiredNothing reported it. Forced screen overlay watches the same thermal state.
Was under vision overlays · antiThermalVision
The machinery underneath
A detection is only as useful as the identity it is attached to and the record it lands in. These are the subsystems that decide who a player is, keep the catalogue honest, and make an incident reviewable a week later.
Core infrastructure
19 systemsLicensing, identity and the ban record — the layer that decides who a player is before any detection has an opinion about them.
- Licence key activation
- Activates against the Sculk API with a stable server identity binding.
- Heartbeat
- A 60-second interval that keeps the session alive and picks up revocations and upgrades.
- Dashboard feed
- Telemetry, player roster, resource list and console feed.
- Dashboard commands
- Delete vehicles, peds and objects, capture screenshots, and announce messages.
- Multi-identifier extraction
- license, license2, discord, fivem, steam, live, xbl and ip.
- CFX hardware tokens
- Server-issued tokens, which cannot be forged from Lua.
- Stable key generation
- A license → token → src fallback chain.
- Persistent ban store
- bans.json with hardware fingerprinting.
- Alt-account cascade banning
- Automatically bans known alternate accounts of a banned player.
- Token-match threshold
- Configurable token matching, defaulting to two.
- Shared ban intelligence
- Bans issued on other Sculk servers arrive as flags for your staff to review. They never block a player automatically.
- Ban sync
- Bidirectional synchronisation between the dashboard and the server.
- Trust scoring
- A 100-point scale with weighted penalties per detection class.
- Multi-signal escalation
- Trust under 25 combined with five or more unique detections escalates on its own.
- Confidence-based capping
- Deterministic, claim, policy and statistical signals each cap at a different maximum response.
- Client report capping
- Client-originated reports are capped at the lowest response unless you opt in.
- Excuse system
- Resources declare legitimate activity so it does not read as a detection.
- Strike system
- Per-detection hit counting inside configurable time windows.
- Webhook integration
- Separate Discord webhooks per response class, plus connect and disconnect.
Infrastructure subsystems
13 systemsThe machinery the detections run on: authentication, rate limiting, evidence, and the monitoring that tells you when a detection has gone quiet.
- Challenge–response auth
- A chained multi-round hash protocol; each response is folded into the next challenge.
- Event firewall
- Per-player rate limits across 18 game event types. Events over the limit are dropped or flagged.
- Detection health monitor
- Every loop and handler pings a health tracker, which alerts on stale or broken detections.
- Anti-evasion system
- Tracks identity changes, reconnection patterns and account hopping.
- Spectate tracker
- Records who spectated whom, and identifies spectate bombing — more than five targets in thirty seconds.
- Server hardening advisor
- Checks twelve critical convars at boot and reports the holes.
- Entity firewall
- Rule-based entity control by type, model and population.
- Whitelist zones
- Areas in which specific detections are switched off.
- Evidence system
- Per-player detection history with a replay trace.
- Screenshot capture
- Game-view capture attached to detection events.
- REST API
- An HTTP API for external integration.
- Trigger system
- Owner-authored triggers evaluated at connection and at log time.
- Reputation system
- Connection gate reputation modes: none, loose, standard, strict and whitelist.
Hardening the engine itself
Some attacks are closed by configuration rather than by detection. Sculk checks these at boot and reports the ones your server.cfg leaves open — closing them removes whole categories of abuse before any detection has to notice.
| Setting | Value | What it closes |
|---|---|---|
| onesync | on | Required for entity tracking. |
| sv_entityLockdown | relaxed | Stops client scripts spawning networked entities. strict also blocks ambient traffic and peds. |
| sv_protectServerEntities | true | Stops clients deleting server-created entities (April 2025+ artifacts). |
| sv_filterRequestControl | 2 | Blocks control requests for player-controlled entities. 4 blocks all and can break tow scripts. |
| sv_stateBagStrictMode | true | Only the server writes networked state. Breaks client-side state writes. |
| sv_scriptHookAllowed | false | Blocks native trainers. |
| sv_enableNetworkedSounds | false | Removes the sound-broadcast vector. |
| sv_enableNetworkedScriptEntityStates | false | Blocks client entity state pushes. |
| sv_enableNetworkedPhoneExplosions | false | Removes the phone explosion vector. |
| sv_disableClientReplays | true | Turns off client replays. Also disables the Rockstar Editor. |
| sv_pureLevel | 1 | Blocks modified game files. 2 also blocks graphics mods. |
| sv_requestParanoia | 2 | Counters proxy-based HTTP floods. |
| game_sanitizeRagdollEvents | true | Prevents remote forced-ragdoll. On by default. |
| game_sanitizePlayerAttachment | 1 | Blocks vehicles attaching to players (2 adds objects). On by default. |
| block_net_game_event | 9 events | Blocks pickup, weapon and vehicle abuse events. |
Coverage is the easy half. The record is the hard half.
A list this long is only worth anything if what it produces is readable by a moderator at 2am. The rollout guides cover how an incident reaches your staff and what they see when it does.
Catalogue for Sculk FiveM 3.9.0-elite. Detections are added and refined over time — the changelog records every change to this list.
