Static-config anticheats hit a wall in the first month. Operators get tired of clearing the same false positive on the same Lua menu, raise the threshold once to make the noise stop, and quietly lose detection on a real cheat surface that used to be loud. Raven Mind closes that loop without an admin parked at the panel.
It is not a rebrand of a rule engine. Raven Mind is the live flow that sits on top of every Raven ban. It reviews what was detected, handles the clear cases right away, and pushes the rest to Discord as a single-click card. The longer the network runs, the more decisions it has already made, so less of the queue ever reaches an operator.
What it does on every ban
When a Raven detection fires, Raven Mind reviews it. The review comes down to three questions.
- Has the network already ruled on this? If the network has already reviewed the same case, Raven Mind applies that decision instead of asking again. A known false positive is reversed automatically. A confirmed cheat stays banned and picks up a one-line audit note.
- Does it look like a real cheat? Detections that look like a real attack never get a whitelist option on the operator card. An operator cannot whitelist a real attack by clicking through Discord notifications.
- Is the action cheap to reverse? A clear false positive is reversed on the spot, and the proposal card waits in Discord for review. A clear cheat with evidence is confirmed and logged. The reviewer only sees the cases the system was not confident enough to close on its own.
The strategies a card can apply
When a card needs operator review, the strategy menu is bounded. Raven Mind does not invent new ways to mutate your config. It picks from a fixed set of operations the applier already knows how to apply safely.
- Whitelist a resource, event, model, weapon, texture, particle, or explosion. Appends the identifier to the correct config array. The applier knows which array each protection uses, so the operator never has to.
- Remove a model from a blacklist. The inverse of the above, for when a baseline entry catches a vehicle a server legitimately ships.
- Tune the threshold or the timeframe. For when the protection is right in principle but the numbers are too tight for this server's player base.
- Switch the action to kick. For protections where a ban is too aggressive but doing nothing is too permissive.
- Suppress this signature for 30 days. A soft snooze on a noisy detection while the operator collects evidence for a permanent rule.
- Disable the type or the option. The escape hatch when a protection is genuinely wrong for this server. The card warns you when this is the heavy-handed choice.
How a single approval propagates
The network share matters more than any single decision. When an operator on one Raven server approves a strategy and shares it with the network, other Raven servers benefit from that review instead of repeating it.
So most operators never see a card for the noisy false positives the network has already reviewed, and the original approver is credited in the audit log. Servers that join late inherit a year of operator review for free.
What ships pre-trained
A fresh server is not starting from zero. Raven Mind ships with a seed rule set built from false positives the network has already reviewed. That list is curated from real card approvals, not synthetic data, so a vanilla ESX or QBCore install does not flood the reviewer on day one.
The seed set is read-only on your server. Your own approvals layer on top of it, server-local where you scope them that way, network-wide where you opt them in. The split keeps a careless operator on one server from changing what the rest of the network sees.
What it does not do
Three deliberate limits, stated plainly so the marketing line does not promise more than the system delivers.
- It does not write new detection rules. Raven Mind only relaxes or tunes existing ones. New detection surfaces ship from the resource side on the regular update cadence.
- It does not clear a likely cheat on its own. Anything that looks like a real attack goes to an operator card with no automatic unban.
- It does not phone home with player data. What it shares covers the event or resource identifier and the protection that fired, never the player ID or the session payload.
What this looks like on a Tuesday
A new ESX framework release ships an event that causes a false positive on a few servers. The first server's operator opens the Discord card, reads the event name, confirms it matches the new framework release, picks Whitelist event, and clicks approve. Servers that update to the framework later in the week never produce a card for it. The operator who reviewed it spent fifteen seconds. Everyone else spent zero.
That is the day-to-day shape of Raven Mind. Not a chatbot, not a generative model writing your config. A bounded review flow that scales the work of one careful operator across the whole network.