Skip to content
SCULKANTICHEAT
Sign up
FiveM documentation§4 Commands & Permissions
  1. 1Getting Started
  2. 2Installing the Resource
  3. 3Configuration
  4. 4Commands & Permissions
  5. 5In-Game Admin Panel
  6. 6Rollout Planning
  7. 7Event Policy Worksheet
  8. 8Frameworks (ESX, QBCore & More)
  9. 9Entity Incident Playbook
  10. 10Staff Review Workflow
  11. 11Migrating from Another Anticheat
  12. 12Plans, Billing & the Hard Stop
  13. 13Troubleshooting

Elsewhere

§4

Commands & Permissions

Every console command, chat command and ACE, what each one needs, and the detections no per-detection exemption can ever cover.

On this page7 entries

Everything staff-facing is gated by a FiveM ACE. Grant them to a group in server.cfg; the group names below are examples, not requirements.

§4.1ACEs

| ACE | Grants | |---|---| | sculk.admin | The in-game admin panel (/sculkpanel), and the actions inside it. | | sculk.spectate | /spectate. Holders are also automatically excused from antiSpectate. | | sculk.screenshot | /sculkview (request a capture of a player's game view). | | sculk.bypassall | Full exemption: this player is never acted on by any detection. Works out of the box: Config.BypassAces ships with it listed — see below. | | sculk.bypass | The pre-3.4 global exemption. Honoured while Config.HonourLegacyBypassAce is on, which it is by default so an upgrade does not suddenly make your admins bannable. Because ACEs are hierarchical it also grants every sculk.bypass.<detection>. Rename it to sculk.bypassall in server.cfg, then turn the fallback off — in that order, or your admins lose their exemption. | | sculk.bypass.<detection> | Exempt from one detection, e.g. sculk.bypass.antiTeleport. sculk.bypass.* exempts from everything that can be scoped. |

add_ace group.admin sculk.bypassall allow
add_ace group.admin sculk.spectate  allow
add_ace group.admin sculk.admin     allow

-- config.lua: the global exemption ACEs. Ships like this, so an
-- `add_ace ... sculk.bypassall allow` grant works with no edit here.
-- Never add 'command': it would exempt every resource holding it.
Config.BypassAces = { 'sculk.bypassall' }

Two things worth knowing about exemptions:

  • Exempt is not silent. An exempt player still trips detections and still produces log lines; the pipeline just does not act. That is deliberate — it is how you watch what a rule would have done before it does it to a customer.
  • txAdmin is exempt by default. While Config.ExemptTxAdmin is on, anyone holding the command ACE is fully exempt. That ACE is broad; turn the switch off if a resource on your server holds command for reasons unrelated to administration.

§4.1.1Detections no per-detection exemption can cover

A small set can never be scoped away with sculk.bypass.<detection> (or sculk.bypass.*), or whitelisted by a zone, because the thing they detect is the attempt to gain an exemption:

antiHoneypot, antiMoneyInjection, antiHeartbeat, antiSculkMind, antiTrustEscalation.

§4.2Console commands

Run from the server console (RCON/txAdmin), not from chat.

| Command | What it does | |---|---| | sculk | Status: version, licence state, tier, server id, clients tracked and linked, bans on file, how many dashboard commands are remembered, and the last error (for example expired after a subscription hard stop). Answers "is it actually protecting?" at a glance. | | sculk detections | Every detection: category, side, the evidence it rests on, the action it will actually take (capped ones marked *), and its on/off state. Anything catalogued with no implementation is listed separately as not running. | | sculkmind | Sculk Mind's current view: pattern counts, upheld vs cleared, and its top ten patterns. | | sculkmind reset | Clears Sculk Mind's decision pool. | | sculk:api:players | Prints the connected-player list as JSON. Only exists while the REST API is enabled. |

§4.3Chat commands

Run in game by a player holding the relevant ACE.

| Command | Needs | What it does | |---|---|---| | /sculkpanel | sculk.admin | Opens the full-screen admin panel. Alias: /sculkmenu. See In-Game Admin Panel. | | /spectate <id> | sculk.spectate or sculk.admin | Follows the player, invisibly, with an on-screen overlay (name, id, distance, trust). /spectate off (or /spectate with no id) returns you. | | /sculkview <id> [reason] | sculk.screenshot or sculk.admin | Requests a capture of that player's current game view. Rate-limited to six requests a minute per requester and one capture per target every 20 seconds. Also runs from the console. | | /link | — | Gives the player a one-time code, shown only to them, to link their Discord account to this game identity on the Sculk website. |

Every one of these is checked on the server. A client cannot grant itself a command by editing the resource; the ACE lookup and the target resolution both happen server-side.

§4.4The website dashboard

The anticheat dashboard is where policy lives. It exposes, per activated server:

  • Detections — enable/disable, action, threshold, window, ban duration, message, escalation. Changes reach the server on its next heartbeat, no restart.
  • Players / live feed / map / console / logbook — the roster the server publishes, its recent detections, and a searchable event history.
  • Bans and shared ban intelligence — issue, review, lift; share a ban with other Sculk servers and withdraw it. Bans shared by other Sculk servers arrive as review events for your staff; they never block a player automatically.
  • Zones, triggers, webhooks, fingerprints, whitelist — edited live. Dashboard zones replace Config.WhitelistZones; dashboard triggers are the connection and log triggers, not Config.AdvancedTriggers; dashboard webhooks are posted by the website, alongside (not instead of) any sculk_webhook_* convars.
  • Sculk Mind — review what the learning layer is holding.

Actions taken there and actions taken from the in-game panel are the same command pipeline: a ban is recorded, webhooked and synced identically. The only difference is the attribution — panel actions are marked In-game: <name>.

§4.5The Discord bot

The bot runs lookups and moderation from Discord, scoped to the licence a guild has bound with /bind. It cannot act outside the servers a guild is bound to, and a licence holder can pull the kill switch on bot-originated writes at any time. Its commands mirror the dashboard: lookups, licences, bans and global bans, whitelist requests, and tickets.

§4.6The REST API

Off by default. When enabled (Config.RestApiEnabled plus a 24+ character sculk_rest_api_key), it serves a small authenticated API on the server's own HTTP endpoint for local tooling. Enabling it grants ban authority to every resource on the server — FiveM can name the caller but not refuse it — so leave it off unless you are using it.