Installing the Resource

Sculk FiveM is a normal FiveM resource. There is no installer, no agent to run, and nothing for your players to download. This page is the whole install, plus the boot output that tells you it worked.

If you have not bought a licence yet, start with Getting Started.

§2.11. Drop it in

Download the resource from your account, then unzip it into your server's resources folder as a folder named sculkanticheat — that exact name is what the ensure line uses. If your download is a .zip, extract it; do not leave it zipped.

§2.22. Add the server.cfg block

server.cfg runs top to bottom, so every set has to come before the ensure.

# Mandatory. The resource declares a dependency on OneSync and will not start
# without it — without OneSync the server never parses game state at all.
set onesync on

# Your licence key, from your account page. Use `set`, NOT `setr` — a licence
# key must never replicate to clients.
set sculk_license "SCULK-XXXX-XXXX-XXXX-XXXX"

# Observation mode: detections run and report, but automatic kicks and bans
# are held. Leave it on for your first nights — see step 6.
set sculk_observe "true"

ensure sculkanticheat

The key is read from the sculk_license convar and nowhere else. Start without it and the console says No licence key set and the resource runs, but does not enforce.

§2.33. Set the engine hardening convars

This is the part that matters more than the resource does. Several entire categories of cheat are configuration problems, not detection problems: if sv_filterRequestControl is 0, a cheat can take control of anyone's vehicle and no amount of Lua catches it reliably.

The full block ships in server.cfg.example inside your download. Copy it in. The resource checks every one of those convars at boot and prints exactly which are still leaving a hole open — so you do not have to trust documentation, you can read your own console.

The ones people skip and regret:

set sv_entityLockdown relaxed         # stops client scripts spawning networked entities
set sv_protectServerEntities true     # stops clients deleting entities your server created
set sv_filterRequestControl 2         # defaults to 0, which lets anyone take control of anything

The example sets each one to the roleplay-safe level. Here's what each can break, so you can test before you go live:

• sv_entityLockdown relaxed blocks networked entities created by client scripts. Ambient traffic and peds still work. A garage, job or prop script that spawns networked entities client-side stops working until its spawning moves server-side. strict goes further and blocks every client-created entity, ambient traffic and peds included, so only use it if all your spawning is server-side.
• sv_protectServerEntities true needs an FXServer artifact from April 2025 or later. Older artifacts ignore it. A client script that deletes a server-spawned entity itself stops working, so move that delete server-side.
• sv_filterRequestControl 2 blocks control requests for anything another player controls. -1 does the same and logs each blocked request, which is a good way to watch first. 4 blocks every control request and can break tow, carry and mechanic scripts.
• setr sv_stateBagStrictMode true lets only the server write networked state. Scripts that write state bags from the client stop working. If one breaks, comment the line out and ask the script's author for a server-side version.

You don't need sv_authMinTrust or sv_authMaxVariance. Every player already has identifiers that pass them, so they don't turn anyone away. The game_sanitizeRagdollEvents and game_sanitizePlayerAttachment protections are on by default, and game_enableVehicleHijackFix is optional because it also stops roleplay carjacking.

§2.44. Exempt your staff before you arm anything

add_ace group.admin sculk.bypassall allow
add_ace group.admin sculk.spectate allow
add_ace group.admin sculk.admin allow

Config.BypassAces ships as { 'sculk.bypassall' }, so that grant works out of the box with no edit to config.lua. Never add command to that list — it would silently exempt every resource holding command, not just txAdmin.

(The older sculk.bypass name still works out of the box while Config.HonourLegacyBypassAce is on, and logs a warning asking you to rename it.) txAdmin admins are already exempt through the command ACE while Config.ExemptTxAdmin is on, which it is by default.

Exempt players still trip detections and still log; they are simply not acted on. Run in observation mode (step 6) for a few days before trusting the enforcement on real players. See Commands & Permissions for what each ACE does and which detections can never be exempted.

§2.55. Start the server and read the boot output

The resource prints, in order:

• Sculk AntiCheat vX.Y.Z starting. API: …;
• the activation result — Licence active (<tier>). This server is protected., or the exact reason it failed;
• about five seconds in, the hardening gaps it wants you to close (or Server hardening convars all look right.);
• about eight seconds in, Game-view capture provider: <name>., or a warning that no screenshot provider is started.

Then two console commands answer the rest:

sculk              status: licence, version, clients tracked, bans on file
sculk detections   every detection, the evidence it rests on, the action it
                   will ACTUALLY take, and anything with no implementation

sculk detections is deliberately blunt. Anything capped below the action you configured is marked with an asterisk, and any catalogued detection with no implementation behind it is named as not running. Nothing in the listing claims coverage the build does not have.

§2.66. Observe before you enforce

The shipped catalogue is armed: nearly every detection is on, most at Warn or Kick and a handful of deterministic ones at Ban. Observation mode is what makes the first nights safe. With set sculk_observe "true" in server.cfg (the server.cfg.example in your download ships with it on), every detection runs, strikes count, and events and webhooks fire as normal — but automatic kicks and bans are held. That covers detections, the handshake policy and any kick or ban in your own advanced triggers. Each one is reported as OBSERVE would kick / OBSERVE would ban in the console and as a review event on the anticheat dashboard. Warnings still happen, and staff actions — a ban or kick from the dashboard, the in-game panel or the REST API — are never held.

While it is on, the console reminds you every 30 minutes how many kicks and bans it has held. When the reports look right, run set sculk_observe false in the live console: it is read on every call, so enforcement starts at once with no restart. Then remove the line from server.cfg so the next boot enforces too.

If one detection is wrong for your server permanently, set it to Log on the dashboard instead: it records without punishing, and the change reaches every activated server on its next heartbeat — within a minute, no restart.

The Rollout Planning guide is the order of operations from here to live enforcement.

§2.7Common first-boot problems

| Symptom | Cause | |---|---| | No licence key set | sculk_license missing, or placed after the ensure | | Activation rejected | key mistyped, or already bound to another server id | | The resource does not start at all | OneSync off — the manifest depends on /onesync, so FXServer refuses to start it | | sculk shows licensed: true but nothing enforces | observation mode is on (sculk_observe — the console prints OBSERVE would kick / would ban), the detections you expected are set to Log on the dashboard, or the player is exempt (txAdmin command, a bypass ACE) | | sculk shows licensed: false and last error: expired | the subscription hard stop — the console also printed PROTECTION DISABLED | | no screenshot provider is started | install screenshot-basic (or another supported provider) — see Troubleshooting |

If a step here does not match what you see, the Troubleshooting page starts from the console output rather than from a symptom.