We built the FiveM anticheat we wanted to run, then sold it to the people who needed the same one.
Every FiveM anticheat we tried in 2024 forced a choice: tank resmon, eat false positives, or wait weeks for a public bypass to get patched. Raven started as a workaround on one server. It now protects more than five thousand.
Founded 2024 · Independent
- 5,000+
- Servers running Raven today
- Under 0.5ms
- FiveM resmon at 200+ concurrent players
- 24h
- Median response to a new public bypass
- 4.9 / 5
- Operator rating across reviews
Detection runs in two layers. They check each other.
The client layer watches process integrity, memory regions, input patterns, and the attack surface that paid menus inject through. The server layer cross-checks every event the client emits against state the server already knows is true: health, position, inventory, money, weapons.
A signed heartbeat channel ties the two halves together. Tampering with the client is visible from the server. Spoofing the server is visible from the client. Most public bypasses pretend the other half does not exist; ours stays loud about both.
New detections go through an internal false-positive review on a thirty-server sample before they ship. Aggressive heuristics catch more cheaters and also ban more legitimate players. We treat that second outcome as unacceptable. Raven Mind handles the per-server tuning so operators do not have to babysit thresholds for the protection to work.
Six principles we hold to.
Dual-layer or nothing
Client and server detection run together on every plan, never sold apart. Client-only anticheats miss server-side event abuse. Server-only anticheats miss memory injection. Shipping just one half is what produces the bypass videos you see on TikTok.
Heartbeat anti-tamper
A signed liveness channel between client and server detects tampering in seconds. Any drop, replay, or signature mismatch triggers a kick and an audit log entry admins can review later. Killing the anticheat process is itself a detection.
Evidence-first bans
Every automated ban carries the detection that fired and the config option behind it, the threshold where that detection has one, every identifier and hardware id the player connected with, and the capture, when the game managed to produce one. When the game hands back an empty frame nothing is stored and the ban says black screen, because a black rectangle in an evidence panel reads as a broken product rather than as a failed capture. Admins can watch a suspect live before they decide, one player or sixteen in a grid, and reversing a ban is one button in the same panel.
Operator-driven AI
Raven Mind is a decision store and a rules engine rather than a model, which is why it can always tell you why it acted. It reads the context on every system ban, works out the one config change that would have prevented it, and remembers what the operator chose, so a signal you have dismissed stops coming back and the fix you picked is pre-selected the next time it turns up. It does reverse calls on its own: three bans on the same detection inside three minutes is a threshold set too tight rather than three separate cheaters, so it applies the fix and unbans everyone caught in the burst. That path is fenced to sensitivity tuning and to the one whitelist that cannot open an exploit, a wider allowed voice range, and every action it takes is logged with a revert beside it.
Global ban network
A network ban is our call rather than yours. Raven staff issue one from Discord, and a short list of hard signals escalates on its own the moment the detection lands: external aimbot, the executor detections that ship a code, resource injection and a few more. What your server chooses is whether to honour the list at all, and which individual bans on it to ignore. Enforcement is a refused connection at the door rather than a warning to read later. A network ban the detection raised by itself comes off everywhere as soon as the ban behind it is reversed, and one our staff issued is lifted by our staff.
Performance is a hard ceiling
The resource runs under 0.5ms on the FiveM resmon, measured at 200+ concurrent players. Detections that push tick over budget get refactored or cut. Players never feel the anticheat in the frame timer.
How we run the product.
- Disclosure and response
- Researchers who report a bypass get an acknowledgement within 24 hours. A fix on our side of the line reaches every server the moment it ships, because the connection filters, the ban and network checks and everything Raven Mind decides run on our infrastructure rather than in your resource folder. A fix inside the resource means downloading the new build and restarting, and the changelog says which of the two it is instead of implying there is nothing to do.
- Privacy posture
- Raven processes what a ban has to stand on and nothing past it: the identifiers a player connects with, Steam, Rockstar licence and Discord among them, their hardware ids, the connecting IP, and the capture attached to the action. One detection reaches past that, and only where the server turns it on: the clipboard scanner files a ban carrying up to 150 characters of a paste that matched the server's own word list, and nothing is read from the clipboard at any other moment. No keystrokes, no microphone, no camera. Live view is a moderation tool rather than a recording, so nothing an admin watches reaches our storage, and the record button on it writes a file to the admin's own machine and nowhere else. The evidence behind a reversed ban is reaped three days after it was taken, unless it was the proof behind a network ban, which we keep.
- Operational transparency
- Every version push writes its notes to the public changelog, which reads the same rows the dashboard shows, so what we publish cannot drift from what operators see. The product is documented behind no login, down to what each detection checks and which config key turns it off. The pages that explain Raven before you buy run in fifteen languages, while the docs and the legal pages stay English, because a machine translation of security documentation or of a contract is a second version nobody has checked. Status incidents are posted to Discord and resolved in the open rather than buried in a support email.
- Public proof
- Every ban a detection issues is published on the public live bans feed once it has sat through the fifteen-minute hold we put on detection bans, and straight away when it carries one of the hard signals that escalate to the network list. Names, identifiers, hardware ids, the server and the ban id are never selected for that page, so no row can leak them. A ban reversed after it was posted drops off the feed on the next refresh, which is more than the Discord channel it mirrors can do.
- Refunds and cancellation
- Subscriptions cancel from inside the dashboard, the licence stays live to the end of the term you already paid for, and the cancellation can be undone any time before it rolls over. No email tickets, no retention scripts. The refund policy is a no-refund policy and we would rather say so here than at the checkout: payments are final, and a refund is an exception we make at our own discretion for something like a double charge or a defect we cannot fix.
Drop the resource in, restart, and the protection is live. Two-minute install on every framework, including ESX, QBCore, vRP, and QBox.