SAF Anticheat Checks & codes | SAF Scripts Docs

How a flag becomes an action

Text

check -> flag (code, severity, numbers) -> history -> score (+severity, drains Config.Score.Decay per minute)
      -> action: the higher of the code's own action and the score's (alert 40, screenshot 70, kick 100)
      -> alert in game + Discord, case file, screenshot when it reaches that far

Cooldowns. The same code for the same player raises a flag at most once per cooldown seconds. Repeats in between are counted on the next one.
Alerts. One line in game for staff with ac.staff, at most once a minute per player and code.
Kicks from the score wait KickDelay seconds. If a staff member opens the player in the panel or acts on them, the kick is off.
Bans only happen for certain flags with Config.AutoBan on. With it off, a ban becomes a kick, and a certain flag doesn't escalate past its code's action and the score.
Staff get flagged, scored and alerted like anyone else. Config.StaffMaxAction (default screenshot) only stops the anticheat kicking or banning them on its own. Set it to nil to treat staff exactly like players.
Shadow mode caps every action at Config.Shadow.MaxAction and only keeps the cancels in Config.Shadow.StillCancel.

Per-check settings

Every code has an entry in Config.Checks:

Key	What it does
`enabled`	Turn the check off
`severity`	Points added to the score, 1 to 100
`action`	The code's own action: `'log'`, `'alert'`, `'screenshot'`, `'kick'` or `'ban'`
`cooldown`	Seconds between two flags of this code for the same player
`cancel`	Block the thing when it can be blocked

custom/shared/checks.lua

Config.Checks.SPECTATE.enabled = false
Config.Checks.HEAL_INSTANT.severity = 5
Config.Checks.NOCLIP.action = 'screenshot'

Codes

Severity and action are the defaults. Certain means the code can ban on its own once Config.AutoBan is on.

Entities

Code	What it means	Sev	Action	Certain
`ENT_BLACKLIST`	Spawned a model nobody needs (ramps, UFOs, cargo planes). Blocked	60	alert
`ENT_SPAM`	Spawned more objects, vehicles or peds than allowed in 10 s. Blocked	30	log	5 times in 30 s
`ENT_CAP`	Owns more entities at once than allowed. Blocked	10	log
`ENT_MODEL`	Went over a per-model limit you set. Blocked	20	log

Explosions

Code	What it means	Sev	Action	Certain
`EXPL_BLOCKED`	An explosion type normal play doesn't create (grenades, rockets, explosive ammo). Blocked	40	log
`EXPL_REMOTE`	An explosion far from the player who sent it. Blocked	40	alert	over 500 m
`EXPL_SILENT`	An invisible or silent explosion. Blocked	70	alert	yes
`EXPL_RATE`	More than 4 explosions in 5 s. Blocked	30	log

Movement

Code	What it means	Sev	Action	Certain
`TP_DIST`	Moved further in a second than possible	30 / 80	log	over 2 km on foot, no grace in 30 s
`SPD`	Over the speed limit in 3 of the last 5 seconds	25	log
`NOCLIP`	Hanging in the air for 4 s, client and server agree	40	log
`TP_OOB`	Outside the map or far under it	40	log
`SPECTATE`	Camera far from the ped, or in spectator mode	10	log

Health

Code	What it means	Sev	Action	Certain
`GOD_HP`	Health or armour over the max	50	alert	500 health or more
`GOD_DMG`	10 hits in a row from other players and no health or armour lost	60	alert
`GOD_FLAG`	Invincible on the client for 30 s	20	log
`HEAL_INSTANT`	Health from low to full in a second with no known heal	15	log

Weapons and damage

Code	What it means	Sev	Action	Certain
`WEAP_GIVE_OTHER`	Gave a weapon to another player. Blocked	80	alert	yes
`WEAP_REMOVE_OTHER`	Took weapons from another player. Not blocked by default	40	log
`WEAP_BLACKLIST`	Holding a restricted weapon. Removed	40	alert
`DMG_WEAPON`	Hits with a weapon that isn't in their hand	15	log
`DMG_RANGE`	Hit someone beyond the weapon's range	30	log
`DMG_AMOUNT`	Claimed more damage than the weapon does	30	log
`DMG_MULTIKILL`	Killed several players within a second	40	alert
`DMG_VEH_FAR`	Damaged a vehicle from very far	30	log
`DMG_HEADSHOT`	Headshot rate far above the server's	10	log
`AMMO_INFINITE`	Kept firing with the ammo count never dropping	15	log

Events

Code	What it means	Sev	Action	Certain
`EVT_RATE`	Fired the same event over 40 times in 10 s	20	log	over 200 in 10 s
`EVT_HONEYPOT`	Fired a fake event menus try	100	alert	yes
`EVT_SCHEMA`	Wrong arguments for an event you listed	30	log
`EVT_EXPLOIT`	Fired a known exploitable event without the job	40	alert
`EVT_TOKEN`	Our own events with a wrong session token, or a replayed heartbeat	30	log

Players affecting players

Code	What it means	Sev	Action	Certain
`PLY_ATTACH`	Attached to another player's ped for a while	10	log
`PLY_TASKS`	Cleared another player's tasks (froze or stopped them). Blocked	40	log	3 times in 10 s
`PLY_PTFX`	Particle effects far away or in a flood. Blocked	20	log

Tamper and client

Code	What it means	Sev	Action	Certain
`HB_MISS`	The anticheat on their client stopped answering. Kick after 3 in a row	50	log
`RES_STOP`	A watched resource was stopped on their client	40	alert
`RES_INJECT`	A resource the server never started	90	alert	yes
`MENU_TXD`	A known menu's textures are loaded	30	log
`MENU_CMD`	A known menu's command is registered	30	log
`MENU_GLOBAL`	A known menu left its code in our resource	40	log
`MENU_PEDFLAG`	Jumped higher than possible (super jump)	25	log

The client checks (GOD_FLAG, SPECTATE, the client half of NOCLIP, AMMO_INFINITE, MENU_*, RES_*) are weak on their own: good menus hide from them. They exist to raise the score and get a screenshot.

Certain flags

Only codes in Config.Certain can ban on their own, and only with Config.AutoBan on. Some are certain on every flag, others only past a condition:

Code	Certain when
`EVT_HONEYPOT`, `EXPL_SILENT`, `WEAP_GIVE_OTHER`, `RES_INJECT`	Every flag
`ENT_SPAM`	5 times in 30 s
`EXPL_REMOTE`	Over 500 m from the sender
`GOD_HP`	500 health or more
`TP_DIST`	Over 2 km on foot, outside any grace and none in the last 30 s
`PLY_TASKS`	3 times in 10 s
`EVT_RATE`	Over 200 in 10 s

Add or remove codes freely:

custom/shared/certain.lua

Config.Certain.EXPL_REMOTE = nil   -- never ban on remote explosions

Grace windows

A legit teleport or heal opens a grace window. Flags inside it are scaled by the window's severity (0 is no flag, 0.25 a quarter) and are never certain.

Window	When	Default
`spawn`	Joining	120 s, no flags
`character`	Character loaded or switched (Qbox, QBCore, ESX, ox_core, ND events)	30 s, no flags
`respawn`	The server sees the ped die and come back, or get replaced	15 s, no flags
`script`	Another resource calls `AllowTeleport` or fires `saf-anticheat:grace`	10 s, no flags
`client`	The player's own client asks (client `AllowTeleport` export)	10 s, half severity, 6 per 5 min
`vmenu`	vMenu summon or teleport to player, checked against vMenu's ACE	15 s, quarter severity
`easyadmin`	EasyAdmin teleports and spectate, checked against its ACE	15 s, quarter severity
`txadmin`	txAdmin menu teleports and heals	15 s, quarter severity
`panel`	Goto, bring or spectate from this panel	15 s, quarter severity
`heal`	`AllowHeal`, txAdmin heal, respawn	5 s, covers `HEAL_INSTANT`
`attach`	Carry or escort scripts firing `saf-anticheat:grace` with `'attach'`	30 s, covers `PLY_ATTACH`

Teleports that only happen on the client (vMenu teleport to waypoint, noclip) can't be seen by the server and are flagged normally. To have those logged only, add an exemption for the ACE that gives them.

For your own scripts, open a window right before a legit teleport:

Lua

-- server
exports['saf-anticheat']:AllowTeleport(src, 10)
TriggerEvent('saf-anticheat:grace', src, 'teleport', 10)   -- if you'd rather not depend on the resource

-- client
exports['saf-anticheat']:AllowTeleport(10)

Exemptions

None by default. Add them in Config.Exempt, per identifier, per ACE or per code. Each one is a mode for every code, or a table of code = mode ('*' for the rest).

Mode	What it does
`'ignore'`	The check doesn't run for them
`'log'`	Flagged and logged only: no score, alert or action
`'normal'`	Checked like everyone else

Lua

Config.Exempt = {
    players = { ['license:abc123'] = 'log' },
    aces = { ['vMenu.NoClip'] = { NOCLIP = 'log', TP_DIST = 'log', SPD = 'log' } },
    codes = { HEAL_INSTANT = 'log' },
}

The panel shows every exemption on the Checks screen and marks exempt players in the list. Staff with ac.exempt can also set a player to log-only for their session from the panel (Config.PanelAllowMode).