Documentation

Overview

hoaxeye is an anti-cheat SaaS for FiveM. We produce verdicts. The operator decides what to do with them. These pages cover live detection families, the architecture concepts behind them, and what's coming on the protection side.

Numbers we'll stand behind

Three measured values that summarize what the documentation backs up. Each links to the page where the methodology is documented.

< 0.2 ms

On-server tick cost

Average resmon snapshot on a representative test server — see Server setup for the bar chart and bench notes.

0 / 59

Backdoor-scanner false positives

On the same representative test server. With a planted backdoor it cleanly fired at high severity — see Backdoor scanner.

< 50 ms

Anti-VPN connect-path lookup

Typical in-process cache hit; cold lookups pay a one-time cost per endpoint per cache window — see Anti-VPN.

Start here

New install? Walk through the Quickstart for a working setup in under ten minutes, then read Server setup for deeper config (resource whitelist, performance, Discord verify hookup).

Concepts

Two architecture concepts run through every detection family. Read these once and the rest of the documentation reads faster.

Rule engine

Modes, verdict strings, risk buckets, fail-closed/fail-open semantics, and per-server operator control. The architecture under every detection.

False positives

How we keep the false-positive rate honest: three filtering layers, an anonymized SHA-256 snippet-hash corpus, a published iteration history, and operator-final say on every action.

Detection & protection

Each family page describes the modes you can run it in, the public verdicts it emits, the latencies and cadences we measure, and the false-positive history that shaped the current version. The HoaxShield card links to the roadmap page for our upcoming UDP-DDoS layer.

Anti-VPNlive

Network-side classification at connect time — VPN, proxy, datacenter, Tor, and a separate verdict for residential-VPN traffic so consumer-privacy users aren't bucketed with cheaters.

Backdoor scannerlive

Scheduled deep scans of started resources. Whitelist-first design with in-house AI severity grading; current iteration produces 0 false positives on a representative test server.

Server analyticslive

Always-on view of loaded resources, exploit-risk buckets per resource, 7-day trigger heatmap, and edge-triggered alerts when a resource crosses into the high-risk bucket.

Discord verifylive

Hardcoded Discord-membership gate at connect time, with a time-boxed and audited emergency bypass for the case where Discord itself is the problem.

Behavior Analyticsroadmap

ML-driven behavioral detection. Per-server inference agent reading from the existing multi-stream upstream — four named classes (mod-menu indicators, camera-state, movement-state, pattern correlation). Roadmap; details follow.

HoaxShieldroadmap

FiveM-aware DDoS protection layer. UDP-validating edge, EU node, planned public beta in June / July 2026 — ships at launch starting with the Advanced plan.

NUI / trigger / nativeroadmap

Client-UI, server-event and entity-rate abuse families. Threat-modelled and designed; lights up here when the first of them ships.

Reference

API reference — public endpoints, auth, status-code semantics.
FAQ — false-positive appeals, whitelist requests, update cadence, emergency-bypass use cases, retention.
Live availability is on the status page; incidents and scheduled maintenance show up there before they show up here.

What we don't publish

These docs describe what each family does — not the exact storage locations, signal keys, regex / pattern internals or numeric score thresholds that drive the detection. Publishing those would just be a tuning sheet for bad actors. If you've signed an NDA as part of the pilot, the corresponding internals are documented in your pilot package.