Installation
Anti-Cheat installation — step by step
This guide takes you from nothing to a working setup. It also explains why each step matters, so you know where to look if something goes wrong.
Before you start — requirements
| Requirement | Why it's needed |
|---|---|
| FiveM artifact 6121+ | The server-side net events the anti-cheat relies on (giveWeaponEvent, explosionEvent) only behave reliably from this build onward. |
| OneSync enabled | set onesync on. Entity ownership and server-authoritative detections do not work without it. |
| oxmysql | The only hard dependency. Bans, detections and settings are read and written through it. |
| MySQL / MariaDB 10.4+ | No database yet? See the database guide. |
| screenshot-basic (optional) | Captures evidence screenshots at ban time. |
1. Download the package
Once your subscription is active: Panel → Servers → your server → "Download Anti-Cheat"
Or directly with your license key:
curl -H "X-License-Key: YOUR_LICENSE_KEY" \
-o tosun-ac.zip \
https://{{PANEL_URL}}/api/ac_package_download.php
server/core/anticheat_000_license.lua. If your copy surfaces elsewhere, its origin can be proven. Do not share your package or license key.
2. Extract into your resources folder
resources/
└── [tosun]/
├── tosun-ac/
└── tosun-ac-guardian/
Both folders must sit at the same level. Guardian is a separate resource — you'll see why in a moment.
3. Import the database schema
First install only:
mysql -u USER -p DATABASE < tosun-ac/sql/ts_anticheat.sql
Alternatively set ts.autoSQL = true in configs/anticheat_config.lua, start the server once, then set it back to false.
ℹ️ On upgrades, schema differences are applied automatically (ADD COLUMN IF NOT EXISTS) — nothing manual required.
4. server.cfg — order matters
ensure oxmysql
ensure tosun-ac
ensure tosun-ac-guardian
stop tosun-ac and play without ever being banned. The problem is that when tosun-ac stops, its own protection threads die with it — it cannot revive itself.
tosun-ac-guardian is a separate resource, so it survives: on an unauthorised stop it restarts the anti-cheat within one second and stops the resource that issued the command. The two guard each other — shutting both down at once is not possible.
Guardian must come after
tosun-ac.
5. Connect the panel
In configs/anticheat_config.lua:
ts.webPanelURL = "https://{{PANEL_URL}}"
ts.webPanelKey = "YOUR_API_KEY"
Get the API key from Panel → Servers → your server → API key.
You can leave both empty — the anti-cheat pulls them from the panel_settings table on startup. If you set up through the panel, they're already there.
6. Start and verify
Restart the server. You should see:
[Tosun AC v9.0] NetEventGuard aktif
[AC-Guardian] Aktif — tosun-ac harici gözetmen koruması altında.
Then, in game:
/ts status → module status
/ts test → self-test
Panel → AC → Live should show your server online within 30 seconds.
7. Platform hardening — the highest-value step
# Clients cannot create networked entities (vehicles/peds/objects)
set sv_entityLockdown "relaxed"
# Only the server may write state bags
set sv_stateBagStrictMode "true"
# Entity control hijacking (vehicle throwing, player launching)
set sv_filterRequestControl "2"
# Abusable networked events
set sv_enableNetworkedSounds "false"
set sv_enableNetworkedPhoneExplosions "false"
set sv_enableNetworkedScriptEntityStates "false"
# ScriptHookV clients
set sv_scriptHookAllowed "false"
# Modified client files (used for silent-aim)
set sv_pureLevel "1"
The anti-cheat audits these on startup and lists any that are missing. To have the safe ones applied automatically:
ts.hardening.autoApply = true
sv_entityLockdown strict can break older scripts that spawn vehicles from the client (some dealership systems). Start with relaxed, test, then tighten. This setting is never applied automatically.
8. Grant admin access
Any one of these works; the first match wins:
# 1) server.cfg — ACE
add_ace group.admin tosun.admin allow
add_principal identifier.license:YOUR_LICENSE group.admin
# 2) txAdmin — recognised automatically (ts.txAdminAuth = true)
# 3) admins/anticheat_admins.lua
Admins = { "license:xxxxxxxxxxxxxxxxxxxxxxxx" }
# 4) Panel → AC → Admin Grants
Open the menu with /tsmenu, /ts menu or F7.
Installation checklist
- ☐ Console shows
NetEventGuard aktif - ☐ Console shows
[AC-Guardian] Aktif - ☐ No red
GUVENLIK UYARISIblock (or you deliberately skipped the listed convars) - ☐ Server appears online in the panel
- ☐
/tsmenuopens for an admin - ☐
/tsmenudoes nothing for a normal player
Common problems
| Symptom | Cause & fix |
|---|---|
Kicked with Anticheat failed to load | No heartbeat ever arrived from the client. Usually a slow download — raise ts.HeartBeat.firstHeartbeatDeadline. If it affects everyone, confirm oxmysql starts before tosun-ac. |
| An admin gets banned | Check the admin is recognised: /ts whoami. The identifier in admins.lua must match exactly (including the license: prefix). Panel grants can take up to 20 seconds to propagate. |
| Normal players can open the menu | You're on v8.x. Upgrade to v9.0 — this was a known vulnerability. |
| Menu buttons do nothing | The NUI could not load SweetAlert2 from its CDN. v9.0 falls back automatically; check the NUI console (F8 → nui_devtools). |
| No bans are ever issued | Check ts.punishType and ts.DetectionPunishments — a detection mapped to LOG never bans. ts.Debug must be false. |
| Ambient NPCs still spawn | Set ts.NpcBlocker.enabled = true and blockPeds = true. Script-spawned peds are intentionally never removed. |
Updating
- Download the new package from the panel (same URL — it always serves the latest build for your license)
- Back up your
configs/,admins/andeditable/folders - Replace the resource folder
- Restore your config files — they are never obfuscated precisely so you can keep editing them
- Restart
When asking for support, include your Build ID (in server/core/anticheat_000_license.lua) — it identifies your exact build.