Detections reference

Every detection Raven ships, grouped by the config category it lives in, with the options it takes and what the resource ships them as. 74 detections in seven categories. For the shipped values on their own, read What Raven ships with. To change any of them, use Protection Rules.

How to read a detection entry

A detection is an object in the config under Detections.<category>.<name>. Almost all of them carry an Enable flag and an Action, and the rest of the keys narrow what the check looks at or exempt things from it.

A missing Types key is off, a missing Methods key is on

The two look interchangeable and are not. The resource reads a type by asking whether Types.<name> is true, so a type you delete from the config reads as off and that sub-check goes quiet. It reads a method through a helper that returns true when the key is absent, so a method you delete keeps running at its default. If you want a type off, write false rather than removing the line, and expect a Methods number to show up in a ban even when your config never listed it.

The 5 plain on or off switches

These are written as a bare true or false rather than as an object. They have no Action and no sub-options, so they cannot be set to kick, and Protection Rules shows them without an action dropdown. All 5 ship on.

Whitelist zones

21 detections take a WhitelistZones array: a list of spheres where the detection never fires, so a player standing inside one is not measured at all. This is the right fix when a garage, a tuning shop, an admin area or a job script legitimately produces the thing a detection is looking for in one fixed place.

Each entry is one sphere, written either as an object like { "X": 128.4, "Y": -1080.7, "Z": 29.0, "Radius": 60.0 } or as a plain coordinate array like [128.4, -1080.7, 29.0, 60.0]. Lower-case keys are accepted too. The radius is optional and defaults to 30 units.

Where a detection lives in the config

On Raven 1.5.9.4 and newer the detections are grouped into seven categories, so a detection sits at Detections.Weapons.AntiAimbot rather than Detections.AntiAimbot. Older servers keep the flat layout where every detection sits directly under Detections. The dashboard reads both, so there is nothing to do when you upgrade.

Main

The checks that watch the anticheat itself and the machine it is running on. These are the ones that notice a client being silenced or inspected rather than a player doing something in the world.

Heartbeat

The Raven client reports to the server on a regular heartbeat. One type catches the heartbeat stopping, and the rest catch a client that keeps reporting but lies about its state.

From resource 1.9.2 Types.Timeout never bans. With Action set to ban, a timeout is a kick, while the other five types still use the Action you set.

The same type covers a player who never verifies at all, with the reason Failed to verify in time. From 1.9.2 that is a kick even when Action is ban.

A timeout log carries Last Heartbeat and Last Activity in seconds. Last Activity also counts ordinary game events, so a low Last Activity beside a high Last Heartbeat is a game that kept running after Raven's heartbeat stopped.

AntiNuiTamper

Watches the browser page the Raven client runs its own UI in, which is where a cheat goes to read or rewrite what the anticheat is doing. This detection was named AntiNuiDevTools before Raven 1.5.9.4.

AntiExecutor

Cheat loaders and mod menus that run outside the game Lua. Five types cover injected executors, input blockers, external tools, known bypass techniques and executors that spoof their identity. The full behaviour has a page of its own: see Anti Executor.

AntiScreenOcr, ClipboardScanner and AntiLuaMenus

All three work from a list you can edit, so the list is the whole tuning surface.

Playerstats

Everything about the player character itself.

AntiTeleport

Acts on a player who teleports. Two methods each catch a different kind of teleport, and a ban stamps the number of the one that fired along with the distance it measured. Either can be switched off while the other keeps running.

A script that relocates a player is expected to call the SetPlayerTeleported client export before it moves them, so the move is not taken for a teleport. The client exports page covers that call.

From 1.9.2 a Methods.1 hit that lands at the map waypoint the player had set is logged as Teleport to waypoint detected rather than Teleport detected (1). It is the same Methods.1 with the same Distance field and the same action.

AntiNoclip

Acts on a player moving through the world with collision switched off.

Resource 1.9.2 made it a single check with no Types map. A Types key a 1.9.2 server receives is ignored, so writing Types.Normal as false no longer switches the check off. The Bypass check was removed, and the frozen check now reports as AntiHookNatives and only runs while that detection is on.

On 1.9.1 and older the three types below still apply, the ban names which one fired, and all three ship on.

AntiSpeedHack

Acts on a player covering ground faster than the game lets anyone move on foot or in water, or from 1.9.2 while climbing. The ban names which type fired along with the speed it measured. The detection ships off, so nothing happens until you enable it yourself.

A whitelisted moderator is exempt from this check, the same exemption that covers AntiTeleport and AntiNoclip.

AntiFreecam and AntiSpectate

Both watch where the player is looking from rather than where they are. While AntiFreecam is on, it also keeps cinematic mode and the idle cameras switched off.

WhitelistZones is the right fix for an admin spectate tool that runs from a fixed place on the map.

AntiPedManipulation

Acts on a player who has switched on one of the ped config flags a cheat menu uses to make itself unkillable, untargetable or immune to a taser. The ban names the type that fired, which tells you exactly which flag to switch off when a script on your server sets one on purpose.

AntiClearPedTasks

Catches the clear-tasks exploit, where a cheater sends the game clear-tasks event at someone else to yank them out of whatever they are doing. Three types decide what is caught and one further key decides whether anything is done about it.

AntiBlacklistPedModel and AntiBlacklistAnimations

Both work from a list you fill in.

AntiNightVision and AntiThermalVision

Both act on a player switching on night or thermal vision. Beyond Enable and Action each carries only WhitelistZones.

AntiVoiceSpoofing

Acts on a player whose voice range is above the ceiling you set. The ban names the value it found.

The simple player checks

The remainder carry nothing beyond Enable and Action, so what matters about them is what they catch.

Resources

Two of these watch resources starting and stopping on a player client, one watches resources making calls they should not, and two watch the Raven client itself for a cheat that has got inside it. The last two sit here rather than under Main because they are grouped with the resource checks in the config.

AntiHookNatives

Detects a cheat that has hooked or replaced the game natives the Raven client reads, or tampered with the client timer and threads. The log reason is Native hook detected, or Thread manipulation detected for the timer and thread checks. From resource 1.9.3 a Native hook detected ban names the Native that was spoofed. On 1.9.1 and older the ban names the native, what was expected and what was found. The full trace stays internal to Raven.

AntiTamperedEnv

Detects a cheat that has rewritten the Lua environment the Raven client runs inside. The ban names the global, what was expected and what was found.

Entities

The largest category, and most of it is vehicle tampering. The three spawn protections at the end are the ones that need tuning against your own scripts before they are safe to leave unattended, and Entities spawn protection and Resources and entities cover that work.

Vehicle tampering

Vehicle tampering is not one detection. Raven 1.8.1 split the old AntiVehicleModification rule into fifteen separate checks, each with its own Enable and Action. There is no Types list to look for, and one noisy check can be switched off without dropping the other fourteen.

Nine take WhitelistZones, which is the right fix when a garage, a tuning shop or a job script legitimately changes a vehicle in one place.

How many of the fifteen a whitelisted moderator is exempt from depends on the build. From 1.8.1 through 1.8.5 the resource list of detections a whitelisted player is skipped for names four of them: AntiVehicleArmorChanger, AntiVehicleEngineChanger, AntiVehicleGodmode and AntiVehicleBoost. The 1.8.6 resource added the other ten vehicle checks to that list, so from that build a whitelist covers fourteen of the fifteen. AntiDestroyVehicles is on no build list but honours the whitelist on its own. That list reaches well past vehicles and also covers player checks such as AntiGodmode, AntiTeleport, AntiNoclip and AntiFreecam, which is why the tag belongs only on staff you trust. The In-Game Moderators card in the dashboard lists the exact set your resource version honours, and Admins and moderators explains the tag. On a build older than 1.8.1 the whitelist knows nothing about these fifteen, because they do not exist there.

EntitiesSpawnProtection

Acts on a networked entity appearing on your server that no server-side resource asked for. It ships off, and it is the detection most likely to catch your own scripts if you enable it without filling the two whitelists in first.

EntitiesSpamProtection

Counts entity creation rather than judging a single spawn. Peds, vehicles and objects are counted separately, and each of the three carries its own numbered rules rather than a single threshold. A ban names the entity type and the rule number that tripped, which tells you exactly which rule to edit. WhitelistModels and WhitelistResources sit at the top level of the detection rather than inside a type, so they cover all three.

EntitiesModelProtection

Called BlacklistEntitiesProtection before resource 1.9.1, and a server below that build keeps that name and always runs as a blacklist. Mode decides what Models means. In blacklist mode, the default, any entity a player creates whose model is on the list is cancelled and deleted. A script-spawned one also gets the player the configured Action, after which everything they spawned is deleted too. On 1.9.1 and older every listed model a player creates, script-spawned or not, gets them the Action. In allowlist mode only script-spawned vehicles are judged: one whose model is in neither Models nor, while that detection is on, EntitiesSpawnProtection.WhitelistModels is deleted and the player gets the Action, logged as Entity model is not on the allowlist. Objects and peds cannot be enforced in that mode. The shipped list is 679 models (672 up to 1.9.1): weaponised griefing vehicles, landmines and oversized props. In allowlist mode a whitelisted player is never judged. From 1.9.2 a whitelisted player is not acted on in blacklist mode either, though the entity is still deleted.

The entity checks with no options

Events

Network events, both the ones your own scripts register and the two the game itself provides. The two event protections have a page of their own: Server event protections.

AntiPlaysound is a bare switch that blocks the play-sound network event, which is how a modded client makes a sound play on everybody else's machine. It has no action and no options.

Weapons

Shooting and damage. The four damage checks at the end of this list were one detection, AntiDamageManipulation, until Raven 1.8.1 split them, and a server on an older build still runs the combined one with its Types.Exploits, Types.Spoofed, Types.Blocked and Types.Spam list.

AntiSpawnWeapons and AntiBlacklistWeapons

These two are easy to confuse. AntiSpawnWeapons asks whether a player should have the weapon they are carrying, so a weapon your server gave them is fine. AntiBlacklistWeapons asks only whether the weapon is on your list, so ownership makes no difference.

Damage or an explosion from a caught weapon is cancelled as well as logged, so the hit does not land.

AntiSpoofBulletShot

Spoofed shots from a cheat menu. Three types each catch a different form of it, and each switches on or off on its own.

AntiAimbot, AntiSilentAim and AntiMagicBullet

AntiNoRecoil

Acts on a player whose weapon has no recoil at all. The ban names the weapon that was in hand.

WhitelistWeapons is for a weapon that legitimately has no recoil, which in practice means an addon weapon. A name written there is hashed for you and both the signed and the unsigned form of the hash are matched.

The damage checks

Four detections split the damage surface between them. Each carries its own Action, so you can ban for one and kick for another.

AntiSpoofedDamage

Two methods cover it, and a ban stamps the number of the one that fired along with the distance it measured.

AntiBlockedDamage

Forged damage from a cheat. Three methods each catch a different form of it, and a ban stamps the number of the one that fired, so you can switch that one off on its own.

The third method was running long before the template listed it. A Methods key with no entry reads as on, so a config that stopped at two never stopped it firing, which is why a ban stamped method 3 on an older config was never a mistake. Listing the key changed nothing about when it fires, it only gave you the switch.

AntiSpamDamage

Numbered rules sit directly on the detection rather than under a Types block, and each rule is counted on its own, so a ban names the rule that fired and you tune only that one.

cluster and spread are not accepted here, although the explosion, particle and projectile rules below take them. A save that gives a rule any type other than the three above is refused with Invalid rule type and the list it allows. A rule stored before that check, with cluster, spread, a type the resource does not know or no type at all, shows as normal and is sent to the server that way, which is how the resource was already counting it.

A kills rule also reads differently in a log. Its ban says Kill rate limit exceeded rather than Spam damage detected. The Action is still this detection's action, so setting Anti Spam Damage to kick sets the kill rate limit to kick with it.

Pyrotechnics

Explosions, particle effects and projectiles. In all three, a caught request is cancelled as well as logged, so the explosion or the effect never happens.

AntiExplosionAi

Every explosion a player client asks the server to create passes through this check. This detection was named ExplosionProtection before Raven 1.5.9.4.

The explosion is cancelled every time one of Invisible, Scale, NoAudio or Shake matches. Each of the four also takes its own Action and falls back to the detection Action when it does not carry one. All four ship enabled with an empty WhitelistExplosions, so a script of your own that legitimately fires a silent or an oversized explosion needs that explosion type added to the list for the check it trips.

AntiParticleAi and AntiProjectileAi

The spam rule types

All three pyrotechnic Types.Spam nodes share one vocabulary, and all three ship with the same three rules.

Sections that are not detections

The config carries four more sections that sit beside Detections. They are edited on Main Settings rather than in Protection Rules, and none of them bans anybody on their own.

Screenshots and recordings captured by a detection are stored on the Raven cloud CDN and linked from the activity log, so there is no screenshot webhook to configure. The Discord logs reference covers webhook setup and Connection filters covers the connect pipeline.