Installation

Anti-Cheat installation — step by step

This guide takes you from nothing to a working setup. It also explains why each step matters, so you know where to look if something goes wrong.

Before you start — requirements

RequirementWhy it's needed
FiveM artifact 6121+The server-side net events the anti-cheat relies on (giveWeaponEvent, explosionEvent) only behave reliably from this build onward.
OneSync enabledset onesync on. Entity ownership and server-authoritative detections do not work without it.
oxmysqlThe only hard dependency. Bans, detections and settings are read and written through it.
MySQL / MariaDB 10.4+No database yet? See the database guide.
screenshot-basic (optional)Captures evidence screenshots at ban time.

1. Download the package

Once your subscription is active: Panel → Servers → your server → "Download Anti-Cheat"

Or directly with your license key:

curl -H "X-License-Key: YOUR_LICENSE_KEY" \
     -o tosun-ac.zip \
     https://{{PANEL_URL}}/api/ac_package_download.php
Every download is unique to you. The package carries a Build ID tied to your license, recorded in server/core/anticheat_000_license.lua. If your copy surfaces elsewhere, its origin can be proven. Do not share your package or license key.

2. Extract into your resources folder

resources/
└── [tosun]/
    ├── tosun-ac/
    └── tosun-ac-guardian/

Both folders must sit at the same level. Guardian is a separate resource — you'll see why in a moment.

3. Import the database schema

First install only:

mysql -u USER -p DATABASE < tosun-ac/sql/ts_anticheat.sql

Alternatively set ts.autoSQL = true in configs/anticheat_config.lua, start the server once, then set it back to false.

ℹ️ On upgrades, schema differences are applied automatically (ADD COLUMN IF NOT EXISTS) — nothing manual required.

4. server.cfg — order matters

ensure oxmysql
ensure tosun-ac
ensure tosun-ac-guardian
Why is Guardian essential? The most common cheat escape was simply stopping the anti-cheat: run stop tosun-ac and play without ever being banned. The problem is that when tosun-ac stops, its own protection threads die with it — it cannot revive itself.

tosun-ac-guardian is a separate resource, so it survives: on an unauthorised stop it restarts the anti-cheat within one second and stops the resource that issued the command. The two guard each other — shutting both down at once is not possible.

Guardian must come after tosun-ac.

5. Connect the panel

In configs/anticheat_config.lua:

ts.webPanelURL = "https://{{PANEL_URL}}"
ts.webPanelKey = "YOUR_API_KEY"

Get the API key from Panel → Servers → your server → API key.

You can leave both empty — the anti-cheat pulls them from the panel_settings table on startup. If you set up through the panel, they're already there.

6. Start and verify

Restart the server. You should see:

[Tosun AC v9.0] NetEventGuard aktif
[AC-Guardian] Aktif — tosun-ac harici gözetmen koruması altında.

Then, in game:

/ts status     → module status
/ts test       → self-test

Panel → AC → Live should show your server online within 30 seconds.

7. Platform hardening — the highest-value step

These settings block a large share of cheats at FiveM's routing layer. No client-side cheat can bypass them, because the server never relays the packet. They cost the anti-cheat nothing and cannot be worked around.
# Clients cannot create networked entities (vehicles/peds/objects)
set sv_entityLockdown "relaxed"

# Only the server may write state bags
set sv_stateBagStrictMode "true"

# Entity control hijacking (vehicle throwing, player launching)
set sv_filterRequestControl "2"

# Abusable networked events
set sv_enableNetworkedSounds "false"
set sv_enableNetworkedPhoneExplosions "false"
set sv_enableNetworkedScriptEntityStates "false"

# ScriptHookV clients
set sv_scriptHookAllowed "false"

# Modified client files (used for silent-aim)
set sv_pureLevel "1"

The anti-cheat audits these on startup and lists any that are missing. To have the safe ones applied automatically:

ts.hardening.autoApply = true
sv_entityLockdown strict can break older scripts that spawn vehicles from the client (some dealership systems). Start with relaxed, test, then tighten. This setting is never applied automatically.

8. Grant admin access

Any one of these works; the first match wins:

# 1) server.cfg — ACE
add_ace group.admin tosun.admin allow
add_principal identifier.license:YOUR_LICENSE group.admin

# 2) txAdmin — recognised automatically (ts.txAdminAuth = true)

# 3) admins/anticheat_admins.lua
Admins = { "license:xxxxxxxxxxxxxxxxxxxxxxxx" }

# 4) Panel → AC → Admin Grants

Open the menu with /tsmenu, /ts menu or F7.

v9.0 security change: menu authorisation now uses a server round-trip with a client-generated nonce. In earlier versions a cheat could trigger events locally to mark itself as admin — gaining both menu access and immunity from every ban. That hole is closed.

Installation checklist

  • ☐ Console shows NetEventGuard aktif
  • ☐ Console shows [AC-Guardian] Aktif
  • ☐ No red GUVENLIK UYARISI block (or you deliberately skipped the listed convars)
  • ☐ Server appears online in the panel
  • /tsmenu opens for an admin
  • /tsmenu does nothing for a normal player

Common problems

SymptomCause & fix
Kicked with Anticheat failed to loadNo heartbeat ever arrived from the client. Usually a slow download — raise ts.HeartBeat.firstHeartbeatDeadline. If it affects everyone, confirm oxmysql starts before tosun-ac.
An admin gets bannedCheck the admin is recognised: /ts whoami. The identifier in admins.lua must match exactly (including the license: prefix). Panel grants can take up to 20 seconds to propagate.
Normal players can open the menuYou're on v8.x. Upgrade to v9.0 — this was a known vulnerability.
Menu buttons do nothingThe NUI could not load SweetAlert2 from its CDN. v9.0 falls back automatically; check the NUI console (F8 → nui_devtools).
No bans are ever issuedCheck ts.punishType and ts.DetectionPunishments — a detection mapped to LOG never bans. ts.Debug must be false.
Ambient NPCs still spawnSet ts.NpcBlocker.enabled = true and blockPeds = true. Script-spawned peds are intentionally never removed.

Updating

  1. Download the new package from the panel (same URL — it always serves the latest build for your license)
  2. Back up your configs/, admins/ and editable/ folders
  3. Replace the resource folder
  4. Restore your config files — they are never obfuscated precisely so you can keep editing them
  5. Restart

When asking for support, include your Build ID (in server/core/anticheat_000_license.lua) — it identifies your exact build.

Back to home Tosun Dev Docs