Config & Performance
This page explains the tosun-ac/configs/anticheat_config.lua settings. For each one: what it protects, performance impact and recommended value.
Rule of thumb: raising an ms/sec value = less CPU/DB load (panel updates slightly later). Lowering it = faster reaction but more load. Keep every action on "log" for the first week to tune false-positives, then move to "kick"/"ban".
Performance budget — what costs what
| Feature | Cost | Weight |
|---|
LiveWatch (live screen/video) | Client capture + network + DB | 🔴 High |
ResourceGuard.deepScan | Server CPU (hash every .lua/.js) | 🔴 High |
BackdoorGuard / signatureScan | Periodic CPU + disk | 🟠 Medium |
| v12 VPN check | External API on connect (cached) | 🟡 Low |
| Detections (client loop) | Player machine CPU | 🟢 Very low |
LiveWatch — the heaviest feature
ts.LiveWatch.interval (1500ms ≈ 6.7 FPS): lower value = much more network+CPU. Recommended: 1500 with tosun_render, 2500–3000 with screenshot-basic. quality 0.7 is ideal; maxConcurrent 3 for small servers, 5–8 for large.
ServerPerf — lag / hitch reduction
| Setting | Default | Recommended |
|---|
panelPlayerSyncIntervalMs | 12000 | 12000 (large server 15–20k) |
liveWatchDbPollMs | 4500 | 4500 |
configSyncIntervalSec | 120 | 120 (never <60 — overflow risk) |
Guards (server CPU)
ResourceGuard.deepScan = false (when on, every file is hashed; heavy — enable only during an audit).ResourceGuard.resyncInterval 90000 — lowering means frequent hashing.BackdoorGuard.scanIntervalMs 1800000 (30m); use 3600000 on large servers, 0 = boot only.BackdoorGuard.autoQuarantine = false (a false-positive could stop a legit resource; review in the panel first).EventScanner.scanIntervalMs 3600000 (1h) — low cost.
Detections
Detections run on the player's client → almost no server load, very low client CPU. Keep them all on; the only risk is false-positives. Use ts.confirmHits to confirm a detection 2–3 times before banning (greatly reduces FP, no perf cost).
v12 (VPN / cleanup / heartbeat)
enableVpnCheck = true (catches ban-evasion; external API on connect, 3s timeout, 24h cache).blockHosting = false recommended (VPS/staff false-positives).keepDetectionsDays 90 — use 30–60 on busy servers to keep the table small.
Quick recommendations
- Lag? → raise ServerPerf values, raise LiveWatch.interval, deepScan=false, raise BackdoorGuard interval.
- Maximum security? → all actions kick/ban, autoBlockInfected/autoQuarantine as pilot, launcherGate (if you ship a launcher).
- Always: "log" for the first week, enable confirmHits, manage blacklist/whitelist from the panel, Debug=false.
Nearly every setting is explained one-by-one below.
A) Core settings
| Setting | Default | Description / Recommendation |
|---|
Debug | false | Developer logs — false in production |
Locale | "tr" | Language (tr/en/de/fr/es/pt/ru/zh) |
punishType | BAN | Default punishment: LOG / KICK / BAN |
banIDFormat | 1 | 1=ABCD-1234, 2=#1234 |
autoSQL | false | Create tables on first boot → then false |
showReason | true | Show ban reason to player |
spoilerIP | true | Hide IP in logs (privacy) |
needDiscord | false | Require Discord link on join |
maxUsernameLength | -1 | -1 = unlimited |
txAdminAuth | true | Recognize txAdmin admin perms |
NuiNeverBanUnauthorized | true | Unauthorized NUI → log only (no ban) |
screenshotModule | screenshot-basic | Screenshot source (tosun_render smoother) |
B) Detections — full list (keep all on, ~no perf)
All run on the player's client; no server load. Risk is false-positives → first week punishType="LOG", confirmHits on.
Aim / Combat
antiAimbot / antiSilentAim | Auto / silent aim |
antiInstantAim / antiMicroJitter / antiGimbalLook | Aim snap / micro-jitter / 360° look |
antiSpoofedShot / antiBulletTracer | Fake shot / bullet origin |
antiNoRecoil / antiRapidFire / antiMagicBullet | No-recoil / rapid fire / wall-bang |
antiInfiniteAmmo / antiExplosiveAmmo | Infinite / explosive ammo |
antiDamageBoost / antiWeaponDamageBoost / antiDamageMod | Damage multiplier (cap weaponDamageMultMax 1.10) |
antiMeleeDamageBoost / antiMeleeDefenseBoost | Melee damage/defense (1.08/1.12) |
antiThermal / antiNightVision / antiRadar | Thermal/NV/radar (radar off by default) |
antiVDM / antiKill / antiTaze | VDM / unauthorized kill / taze grief |
Movement / Body
antiGodMode / antiPlayerInvincible | Invincibility |
antiNoClip / antiVehicleNoClip | No-clip (noclipHeightMin 3m, noclipFlatSpeedMin 3 m/s) |
antiTeleport / antiTeleportInVeh | Teleport (teleportDistance 0=auto, veh 90m) |
antiFastRun / antiOnFootSpeedHack / antiSprintHack | Speed (onFootSpeedMax 12 m/s, runSprintMultMax 1.15) |
antiSpeedHack | Vehicle speed + handling |
antiSuperJump / antiInfiniteRoll | Super jump / infinite roll |
antiInfiniteStamina / antiStaminaRecoveryHack / antiSwimMultHack | Stamina/swim multipliers |
antiHealthRegenSpike / antiArmorRegenSpike | HP/armor spike (55 / 65 per sec) |
antiIllegalExtraHealth / antiIllegalExtraArmor | Cap breach (200 / 100) |
antiInvisible / antiSmallPed / antiPedSwap | Invisibility / small ped / ped swap |
antiFreeCam / antiSpectate / antiBlips | Freecam/spectate/blip ESP (freecamMaxDistance 45m) |
Vehicle
antiVehicleGodmode / antiVehicleHealthHack | Veh invincibility/HP (vehHealthCapMax 1100) |
antiVehicleTopSpeedMod / antiVehCheatPower | Top-speed/engine power (1.10 / 1.12) |
antiVehiclePlayerDmgBoost / antiVehicleDefenseBoost | Veh damage/defense multiplier |
antiVehicleGravityAbuse | Gravity abuse (0.35–16.0) |
antiBlacklistedVehicles / ...Spawn | Blacklisted vehicle / spawn |
antiBlacklistPlate / antiPlateChange | Blacklisted plate / plate change |
Spawn / Entity / Visual
antiEntitySpawn / antiSpamPed / antiPeds / antiAIs | Mass vehicle/object/ped spawn |
antiBlacklistedWeapon / antiGiveWeapons / antiRemoveWeapons | Blacklisted/unauthorized weapons |
antiObjectAttach / antiAttachChainAbuse | Object attach abuse (chain depth 4) |
antiExplosionBlacklist / antiExplosiveAmmo | Explosion blacklist |
antiOverlay / antiMenus / antiNUIDevTools | Overlay / mod menu / NUI DevTools |
antiPickups / antiClipboardPaste | OFF by default (privacy/FP) |
System / Integrity
antiResourceInjection / antiResourceClone / antiCustomNative | Runtime injection / manifest clone / native hook |
antiFileTampering / antiCipherBypass / antiHWIDSpoof | File tampering / cipher spoof / HWID change |
antiResourceStop / antiResourceStart / antiModuleStop | Unauthorized resource/module stop-start |
antiStatebagCrash / antiServerEventSpam / antiCommandSpam | Statebag crash / event-command spam |
antiClearTasks / BlacklistedTasks / antiFold | ClearTasks abuse / blacklisted task |
fakeTriggers / messageBlacklist | Honeypot fake event / banned chat+OCR |
antiLowFPSMacro | Low-FPS macro (lowFPSThreshold 6) |
C) Thresholds / tolerances (false-positive tuning)
confirmHits (noclip 3, teleport 3, fastrun 2…) | Confirm N times before banning — greatly reduces FP |
spawnGraceSecondsMs 35000 | No-detection window after spawn |
noclipStrikeMax 3 / fakeTriggerStrikeMax 2 | Consecutive-hit tolerance |
instantAimDegPerFrame 75 / gimbalLookDegPerFrame 270 | Aim/look angle thresholds (raise = less FP) |
maximumModifier 2.0 | Global multiplier cap |
D) System blocks (action: log→kick→ban)
| Block | What it does / Recommendation |
|---|
shield | Native hooks + hidden NUI fingerprint/heartbeat + WebGL screenshot/video evidence on ban. nuiHeartbeatAction "log" first |
nativeGuard | External tosun-guard.exe RAM/memory scan. action "log"→"kick", requireGuard true if you ship guard |
shieldAi | Object/vehicle/ped AI spawn rate-limit (maxVehiclePerSec 4). action "cancel" |
shieldExplosion | Invisible/inaudible explosion block (action "ban") |
premiumGuard | Particle/projectile/sound/ragdoll/requestControl guard + rate-limit. All "log" first |
guard (watchdog) | Separate tosun-guard resource liveness. action "log" (no FP if guard absent) |
v16 serverMovement | Server-side teleport (teleportSpeedFlag 150 m/s, action "log") |
cloudBridge | Threat-score + central threat-intel lookup (threatIntelMinScore 70, "log") |
launcherGate | Launcher-only join — keep false unless you ship a launcher |
licenseLock | Product license lock — "log" then "reject" in production |
Framework.moneyCheck | Money cheat (moneyCheckThreshold 5M hard, moneySoftThreshold 75k soft) |
PhoneNotify / connectingCard / AdminMenu | Phone alerts / connect card / admin menu |
E) Preset bundles
| Scenario | Recommended |
|---|
| RP server (balanced) | All action = "log" (first week) → then "kick"; confirmHits on; blockHosting=false; LiveWatch on; launcherGate=false |
| Hardcore / PvP | actions "ban"; nativeGuard.action="kick"; shieldExplosion="ban"; tighten thresholds; premiumGuard "kick" |
| Low-RAM / VPS | deepScan=false; LiveWatch.interval 3000; raise ServerPerf values; BackdoorGuard.scanIntervalMs 3600000; keepDetectionsDays 30 |
| Maximum security | launcherGate=true (if you ship a launcher); requireGuard=true; autoBlockInfected/autoQuarantine pilot; all actions "ban"; licenseLock "reject" |
F) Reducing false-bans
- First week
punishType="LOG" + every block action="log" — watch real players and tune.
- Use
ts.confirmHits to confirm a detection 2–3 times before banning.
- Loosen thresholds: raise
instantAimDegPerFrame, maxVehicleTeleportDistance, onFootSpeedMax, etc.
- Permanent exemption: panel → AC → Whitelist. For temporary/activity-based exemption use exports:
exports['tosun-ac']:AddWhitelist("license:abc", 3600) -- exempt 1 hour
exports['tosun-ac']:WhitelistArea(src, "parkour", 120) -- during an activity
exports['tosun-ac']:BypassDetection(src, {"antiTeleport","antiFastRun"}, 8000)
exports['tosun-ac']:SetPlayerExempt(src, true, 60000, "clothing")
G) Troubleshooting
| Symptom | Fix |
|---|
| AC won't connect (red heartbeat) | Is panel ac_api_key = FiveM webPanelKey? Is fivem_url the game server address (not the web panel)? Is tosun-ac started? |
| Players can't join | Set launcherGate.enabled=false (if no launcher); raise firstHeartbeatDeadline (heavy servers); if VPN set blockHosting=false |
| Lag / hitch | Raise ServerPerf values; raise LiveWatch.interval; ResourceGuard.deepScan=false; raise BackdoorGuard.scanIntervalMs |
| Staff/VPS false VPN-ban | bypassStaffIpCheck=true; blockHosting=false; add staff to AdminBypassIdentifiers |
| Legit player banned (FP) | Set that action="log"; raise confirmHits; loosen threshold; exempt via export |
| Reliable network overflow error | Don't lower NetworkJoin values; keep configSyncIntervalSec ≥ 60 |
Full list of all detection keys and panel on/off: panel → AC Settings.