Detections reference

Every detection has an Enable toggle and most have an Action that controls what happens when a player triggers it. Actions are set in the server config and can also be edited from the dashboard Main Settings and Protection Rules pages.

Aim and shooting

AntiAimbot

Detects aimbot behavior by monitoring player targeting patterns. Two detection sub-types can be enabled or disabled independently.

• Types.Assist: detect aim-assist style aimbots (true/false)
• Types.External: detect externally injected aimbot tools (true/false)

AntiSilentAim

Detects silent aim, including magic-bullet shots that register hits without a visible trajectory toward the target.

• Types.Normal: detect standard silent aim (true/false)
• Types.MagicBullet: detect magic-bullet shots specifically (true/false)

AntiSpoofBulletShot

Detects spoofed bullet shots where the reported shot data does not match actual game state. Three detection sub-types cover the three ways that mismatch shows up and can be enabled or disabled independently.

• Types.Normal: a gunshot event arrives while the game says the player is not shooting (true/false)
• Types.Spoof: the player shoots for more than a second and no gunshot event arrives with it (true/false)
• Types.Bypass: a gunshot event arrives from a player who is unarmed and on foot (true/false). Ships off

AntiDamageExploits

Detects damage a client reports that the situation cannot explain, such as an instant kill or the fists exploits cheat menus ship. It carries no options beyond Enable and Action.

AntiSpoofedDamage

Detects damage packets whose values were faked by the client. Two detection methods run independently and a ban stamps the number of the method that fired, so you can switch one off and keep the other.

• Methods.1 and Methods.2: the two methods, each true or false

AntiBlockedDamage

Detects damage a player deals that their own client cannot account for. The server hands the client the hits it just saw and the client compares them against the damage its game actually produced, so what trips it is a cheat that suppresses the local half of a hit while the damage still lands on the victim. A ban stamps the number of the method that fired.

• Methods.1: the unmatched-victim path. The client counts the hits the server reported against players it can see that it has no record of dealing, and three or more of those in one report is what fires it. It is skipped while the player is ragdolled or falling. Three hits are needed and a lone hit is forgotten after 35 seconds. Ships on
• Methods.2: the no-gunshot path. The damage came from a weapon that needs a shot to produce it and the client saw no gunshot at all inside the window it allows for one, which is the shape of a cheat that sends damage without firing. It stands down while the player is in a vehicle, dead or dead within the last five seconds, ragdolled or falling. Two hits are needed and a lone hit is forgotten after 35 seconds. Ships on
• Methods.3: the shooting-state path. A gunshot did land inside that window, but the ped never once read as shooting while it did, so the shot event arrived without the ped ever performing the shot. It carries the same vehicle, death, ragdoll and falling guards as the second method and also stands down for a player in a hostage animation next to someone. Three hits are needed and a lone hit is forgotten after 35 seconds. Ships on

The third method was running long before the template listed it. The resource treats a method with no entry as on, so a config that stopped at two never stopped it firing, which is why a ban stamped method 3 on an older config was never a mistake. Listing the key changed nothing about when it fires, it only gave you the switch.

AntiSpamDamage

Detects rapid repeated damage events. Its numbered rules sit directly on the detection rather than under a Types block, and each rule is counted on its own, so a ban names the rule that fired and you tune only that one.

• Rules: up to five numbered rules, each an object with a type, a Threshold (event count) and a TimeWindow (seconds). The shipped rules use the normal and victims types

Weapons

AntiSpawnWeapons

Blocks players from spawning weapons that are not permitted on the server.

• WhitelistWeapons: array of weapon names that are always allowed
• AddonWeapons: array of addon weapon names to permit alongside base-game weapons

AntiBlacklistWeapons

Acts on a player holding or using a weapon you have banned outright. Where AntiSpawnWeapons asks whether a player should have the weapon they are carrying, this one asks only whether the weapon is on your list, so ownership makes no difference and it acts on the first hit rather than waiting for a repeat. The server catches it three ways and the ban names which: on its sweep of the weapon a player is holding, on a damage event fired with the weapon, and on an explosion that weapon produced. The damage event and the explosion are cancelled as well as logged, so the hit does not land.

• BlacklistWeapons: weapon names or numeric hashes to ban, and a name is hashed for you. This is the one option here you are expected to edit. The shipped list is twelve explosive and special weapons, weapon_minigun and weapon_rpg among them

AntiGiveWeapons

Blocks unauthorized weapon-give network events from being processed by the server.

• Types.Player: block giving weapons to other players (true/false)
• Types.Ped: block giving weapons to non-player peds (true/false)

AntiRemoveWeapons

Blocks unauthorized weapon-removal network events from affecting other players.

• Types.Player: block removing weapons from other players (true/false)
• Types.Ped: block removing weapons from non-player peds (true/false)

AntiNoReload

Detects players who keep firing without ever reloading, which indicates a no-reload cheat is active.

AntiInfiniteAmmo

Detects players whose ammo count never depletes while firing, indicating an infinite-ammo cheat.

AntiNoRecoil

Acts on a player whose weapon reports no recoil shake at all. Within half a second of a shot the client reads the recoil shake amplitude of the weapon in hand, and an amplitude of zero or below scores a flag. A normal amplitude takes a flag back off again, four flags fire the detection, and the tally is cleared when 30 seconds pass without a new flag, so odd readings decay instead of adding up across a session. A shot can only score once however many passes fall inside that half second. Two hits are needed before it acts and a lone hit is forgotten after 30 seconds, and the ban names the weapon that was in hand.

• WhitelistWeapons: weapon names or numeric hashes that are never measured. A name is hashed for you and both the signed and the unsigned form of the hash are matched. Empty in the shipped config
• WhitelistZones: zones where the detection never fires

A player inside a vehicle is not measured at all, and the resource keeps its own built-in list of weapon groups and weapons it never measures, which is not exposed as a config option. So WhitelistWeapons is for what that list does not already cover, which in practice means an addon weapon that legitimately reports no recoil shake.

Player and body

AntiGodmode

Detects players using godmode or invincibility flags that prevent them from taking damage.

• WhitelistZones: areas where godmode is never flagged (see the intro note for the format)

AntiInfiniteStamina

Detects players whose stamina value never depletes, indicating a stamina cheat is active.

AntiSuperJump

Detects a player doing a beast jump, the movement state a cheat menu switches on when it offers a super jump. The check rides the client movement loop and is skipped while the player is dead and while the pause menu or a NUI panel has focus. Two hits are needed before it acts and a lone hit is forgotten after 20 seconds, so one odd reading on its own bans nobody. It carries no options beyond Enable and Action.

AntiPedManipulation

Acts on a player who has switched on one of the ped config flags a cheat menu uses to make itself unkillable, untargetable or immune to a taser. The client reads those flags off its own ped every two seconds, and a flag that reads as set is read again a quarter of a second later on the same ped before it counts, so a flag another resource sets and clears in the same moment never reaches the tally. The check is skipped while the player is dead, inside a whitelist zone, and while the pause menu or a NUI panel has focus. Three hits are needed before it acts and a lone hit is forgotten after 30 seconds. The ban names the type that fired, which tells you exactly which flag to switch off when a script on your server sets one on purpose.

Each type is one ped config flag and all six ship on. A whitelisted moderator is exempt from this detection on resource 1.8.6 and newer, and is not exempt on anything older, because that is the build where the client whitelist list grew to cover it.

• Types.PassiveMode: ped config flag 423
• Types.PassiveModeLocal: ped config flag 425
• Types.Untargetable: ped config flag 9
• Types.NoHomingLockon: ped config flag 434
• Types.FriendlyFireBypass: ped config flag 442
• Types.TaserImmunity: ped config flag 461
• WhitelistZones: zones where the check is skipped

AntiRagdoll

Detects abuse of the ragdoll state, such as forcing other players into a ragdoll permanently.

AntiClearPedTasks

Detects misuse of clear-ped-tasks calls that can be used to freeze or grief other players. Three detection modes are available.

• Types.Block: block all unauthorized clear-ped-tasks calls
• Types.Normal: detect standard clear-ped-tasks abuse
• Types.Immediately: detect the immediate variant of the task-clear call

AntiChangeOutfit

Detects outfit changes that were not initiated through an approved server-side pathway.

AntiTeleport

Acts on a player who moved further between two readings than the game can explain. The client samples the player position on a loop and compares each reading against the one before it, so what trips it is the jump itself rather than the speed the player appeared to travel at. Two paths run, each looking for a different shape of jump, and a ban stamps the number of the one that fired along with the distance it measured. Either can be switched off while the other keeps running.

• Methods.1: the distance path. It fires when the player moved more than 150 units horizontally between two passes of the movement loop, which run 1.5 seconds apart, while the speed reading says they were barely moving. That combination is a position write rather than travel. Two hits are needed and a lone hit is forgotten after 20 seconds. Ships on
• Methods.2: the teleport-back path, which runs on its own loop rather than with the movement checks. It remembers the spot a player jumped away from, and acts when they jump more than 50 units and land back within 5 units of that spot inside half a second. That out-and-back is what a cheat menu does when it looks somewhere and returns, and the distance path never sees it because the player ends up where they started. Two hits are needed and a lone hit is forgotten after 20 seconds. Ships on
• WhitelistZones: zones where neither path fires

The distance path only measures a player who is settled on foot, so a ped that is ragdolled, falling, in a parachute free fall, in a vehicle or entering one, attached to something, in water, jumping or climbing is not measured at all. The teleport-back path carries its own guards and stands down while the player is dead, for the first five seconds after a spawn, during screen fades and cutscenes, and while a player switch is running. Both honour the grace window that the SetPlayerTeleported client export opens, which is what a script that relocates a player is expected to call before it moves them. The client exports page covers that call.

The Methods map is only read by the resource on 1.8.3.8 and newer. Builds from 1.7.9 up to 1.8.3.7 already stamp the method number on the ban but never read the map, so a method you turn off there reports success while the same detection keeps firing. On those builds Enable is the only switch that changes anything, and the fix for a false positive is the export above rather than the map.

AntiNoclip

Acts on a player moving through the world with collision switched off or with their ped frozen in place. It rides the same movement loop as AntiTeleport and measures the same way, by comparing two readings 1.5 seconds apart, but what it looks for is ground covered while the player is not really moving. Three types run and the ban names which one fired.

• Types.Normal: the player covered more than 50 units in three dimensions between two passes while the speed reading said they were standing still or close to it, and while either collision was disabled on their ped or the ped was more than 5 units above the ground. A player being carried next to another player is skipped, because a carry animation moves someone the same way. Three hits are needed and a lone hit is forgotten after 30 seconds. Ships on
• Types.Bypass: the ped is frozen in place and attached to an entity whose network id is its own, which is the self-attach trick a noclip uses to drag a frozen ped around without the game treating it as movement. Two hits are needed and a lone hit is forgotten after 20 seconds. Ships on
• Types.Frozen: the ped's position is frozen and it still covered more than 20 units in three dimensions between two passes while the speed reading said it was standing still, which is the frozen-position variant of the same trick. A player being carried next to another player is skipped here too. Five passes in a row are needed, then two hits, and a lone hit is forgotten after 30 seconds. Ships off
• WhitelistZones: zones where no type fires

Types.Frozen is the one type here that ships off, and it ships off deliberately. A Types key with no entry reads as off, which is the opposite of how a Methods key behaves, so the path was already dormant on every config the dashboard had written, and listing it at true would have switched a live detection on across every server at once. It is yours to turn on when you want it. A config copied straight out of the resource folder has always carried it on, which is why a ban stamped type Frozen can turn up on a server that never went through the dashboard.

AntiFreecam

Acts on a player whose camera has left their body, which is what a freecam does. It runs on the movement loop and only measures while the camera is settled, meaning no scripted camera is rendering, the screen is not fading, no cutscene is playing, the player is not spectating and the view mode has not changed in the last five seconds. Every pass it also cancels cinematic mode and invalidates the idle cameras, because those pull the camera off the player on their own and would read the same way.

• Types.Distance: the gameplay camera sat more than 150 units from the player ped on four passes in a row while the player was not in first person. Four consecutive readings are required, so one frame with the camera somewhere odd counts for nothing. Two hits are then needed and a lone hit is forgotten after 20 seconds. Ships on
• Types.Bypass: every 30 seconds the client creates a scripted camera and destroys it again. A tool that blocks camera creation to keep its own freecam alive makes that fail, and three consecutive failures after at least one success are what fire it, so a probe that never worked in the first place cannot ban anyone. The ban names CreateCam as the native that failed. Two hits are needed and a lone hit is forgotten after five minutes. Ships off
• WhitelistZones: zones where neither type fires

AntiSpectate

Acts on a player the game reports as being in spectator mode, which is how a cheat menu watches someone from their position. It shares the movement loop, so it only reads while the screen is faded in and no cutscene is playing, and it needs the reading on three passes in a row before it counts anything, with the loop running every 1.5 seconds. Two hits are then needed before it acts and a lone hit is forgotten after 30 seconds. Beyond Enable and Action it carries only WhitelistZones, which is the right fix when an admin spectate tool runs from a fixed place on the map.

AntiSpeedHack

Acts on a player covering ground faster than the game lets anyone move on foot or in water. It rides the same movement loop as AntiTeleport and AntiNoclip and compares two readings 1.5 seconds apart, but what it reads is the speed itself rather than the distance. Two types run and the ban names which one fired along with the speed it measured. The detection ships off, so nothing happens until you enable it yourself.

• Types.Normal: the player was on foot and walking, running or sprinting, both readings put their speed above 14, and they covered more than 10 units between them. Three passes in a row are needed, then two hits, and a lone hit is forgotten after 30 seconds. If the player was sprinting on both passes and their sprint stamina did not move between them, the bar drops to 13 and only two passes are needed, because stamina that never drains alongside the speed is the cheat's own tell. The ban says which of the two it was. Ships on
• Types.Water: the player was swimming, both readings put their speed above 6, and they covered more than 4 units in three dimensions between them. Three passes in a row are needed, then two hits, and a lone hit is forgotten after 30 seconds. Ships on
• WhitelistZones: zones where neither type fires

Only a settled player is measured at all, so a ped that is ragdolled, falling, in a parachute free fall, in a vehicle or entering one, attached to something, standing on a vehicle, frozen, jumping, climbing, dead or spectating is not read, and neither is one within 100 units of the map origin. The check also stands down while a NUI panel has focus and for five seconds after it loses it, and the whole movement loop is skipped for a whitelisted moderator, the same exemption that covers AntiTeleport and AntiNoclip.

AntiBlacklistPedModel

Acts on a player wearing a ped model you have blacklisted. The client checks its own ped and the server checks each player on its sweep, so either side can catch it, and the log says which one did. Two hits are needed before it acts and a lone hit is forgotten after 30 seconds. The shipped list is the animal models cheat menus use.

• BlacklistModels: model names or numeric hashes to block; a name is hashed for you
• WhitelistZones: zones where the check is skipped

AntiBlacklistAnimations

Stops a player playing a blacklisted animation and acts on them for it. The animation is stopped first, so it ends whether or not the ban lands, and this detection acts on the first match rather than waiting for a repeat. Dead or dying players are skipped.

• Animations: array of objects, each with a dict and a name, both matched exactly
• WhitelistZones: zones where the check is skipped

AntiNightVision

Acts on a player who turned night vision on. The client reads the game night vision state every two seconds and only acts on the pass where it changed from off to on, so holding it on does not stack hits and a player who already had it on when the loop started is not counted until they switch it off and on again. Nothing is read at all while the aim camera is active, so a sight that turns the state on while a player aims never reaches the count. The check is also skipped while the player is dead and while the pause menu or a NUI panel has focus. Two hits are needed before it acts and a lone hit is forgotten after 30 seconds.

• WhitelistZones: zones where the check is skipped

AntiThermalVision

Acts on a player who turned thermal vision on, read from the game see-through state. It runs on the same two second loop as AntiNightVision above, acts only on the change from off to on, is skipped in the same places, stands down the same way while the aim camera is active, and counts the same two hits with a lone hit forgotten after 30 seconds. Beyond Enable and Action it carries only WhitelistZones.

AntiVoiceSpoofing

Detects players spoofing their voice range to communicate across distances that should be impossible.

• Maximum: the highest voice range value that is considered legitimate (number)
• Whitelist: array of specific range values that are always permitted

Vehicles

Vehicle tampering

Vehicle tampering is not one detection. Raven 1.8.1 split the old AntiVehicleModification rule into fifteen separate checks under Detections.Entities, each with its own Enable and Action. That is worth knowing before you go looking for a Types list that is no longer there, and it means one noisy check can be switched off without dropping the other fourteen. Ban logs written before the split still carry the old name.

Nine of them also take WhitelistZones, which is the right fix when a garage, a tuning shop or a job script legitimately changes a vehicle in one place. Those are marked below, along with the five that ship disabled.

• AntiVehicleArmorChanger: vehicle armor edits. Takes WhitelistZones
• AntiVehicleEngineChanger: engine power edits. Takes WhitelistZones
• AntiVehicleColorChanger: color changes. Takes WhitelistZones. Ships off
• AntiVehicleLiveryChanger: livery swaps. Takes WhitelistZones
• AntiVehicleWindowsChanger: window tampering. Takes WhitelistZones. Ships off
• AntiVehicleHandlingChanger: handling edits. Takes WhitelistZones
• AntiVehiclePlateChanger: license plate changes, with Types.Text for the plate text and Types.Index for the plate style. Takes WhitelistZones
• AntiCleanVehicle: a vehicle being cleaned, meaning its dirt level reset. Takes WhitelistZones. Ships off
• AntiFlipVehicle: instant vehicle flips. Takes WhitelistZones. Ships off
• AntiBulletProofTires: bulletproof-tire toggles. Ships off
• AntiVehicleGravityChanger: vehicle gravity edits
• AntiVehicleGodmode: a vehicle made invincible
• AntiNoVehicleCollision: collision turned off on a vehicle
• AntiVehicleBoost: a vehicle boosted beyond its normal speed
• AntiDestroyVehicles: vehicles destroyed by a player who should not be able to. This is the one of the fifteen that ships with Action set to "kick" rather than "ban"

How many of the fifteen a whitelisted moderator is exempt from depends on the build. From 1.8.1 through 1.8.5 the resource list of detections a whitelisted player is skipped for names four of them: AntiVehicleArmorChanger, AntiVehicleEngineChanger, AntiVehicleGodmode and AntiVehicleBoost. The 1.8.6 resource added the other ten vehicle checks to that list, so from that build a whitelist covers fourteen of the fifteen. AntiDestroyVehicles is on no build's list, but it reads the whitelist itself before it acts, so it lands in the same place by a different route wherever it exists. That list reaches well past vehicles and also covers player checks such as AntiGodmode, AntiTeleport, AntiNoclip and AntiFreecam, which is why the tag belongs only on staff you trust. The Moderators card in the dashboard lists the exact set your resource version honours. On a build older than 1.8.1 the whitelist knows nothing about these fifteen, because they do not exist there.

AntiSpawnIsolatedVehicle

Detects vehicles spawned in an isolated or networked state that bypasses normal spawn controls.

AntiTeleportInVehicle

Detects players teleporting while inside a vehicle, which is a common speed and position exploit.

World and entities

EntitiesSpawnProtection

Blocks entities spawned without server authorization, covering NPCs, vehicles, objects, and pickups.

• RemoveNPCs: automatically remove unauthorized NPCs. The whole option is a single Enable flag, and it ships off
• Debug: extra logging, off in the shipped config. There is no reason to turn it on unless support asks you to
• Types.Pickups, Types.Peds, Types.Vehicles,Types.Objects: per-entity-type toggles. Peds andVehicles also carry a Methods object with independent Normal and Ai toggles. If both are off, that entity type is ignored
• WhitelistModels: array of model names that are always allowed to spawn
• WhitelistResources: array of resource names whose spawns are always trusted

EntitiesSpamProtection

Blocks rapid entity creation that can be used to crash or lag the server. Peds, vehicles and objects are counted separately, and each of the three carries its own numbered rules rather than a single threshold. A ban names the rule number that tripped, which tells you exactly which rule to edit.

• Types.Peds, Types.Vehicles and Types.Objects: each one is an Enable flag plus a Rules map of up to five numbered rules
• A rule is an object with a type, a Threshold (entity count) and a TimeWindow (seconds). It fires once the threshold is passed inside the window
• The rule types are normal, deleted, nearplayer and stacked, with launched accepted on Types.Vehicles only. A launched rule written on peds or objects matches nothing and never fires
• On a server below 1.8.1 the vocabulary is the older normal, deleted and ai, and the time field is named TimeFrame rather than TimeWindow
• WhitelistModels: model names the spam counter ignores, kept at the top level of the detection rather than inside a type
• WhitelistResources: resource names whose spawns the spam counter ignores, also at the top level

BlacklistEntitiesProtection

Blocks any entity whose model appears on a configurable blacklist, regardless of who spawned it.

• Models: array of model names to block

AntiEntityTakeOver

Blocks attempts to take network ownership of entities that belong to other players or the server.

AntiRemoteAttachment

Blocks remote attachment calls that can be used to grief players by attaching objects to them without consent.

AntiRemoteAttachmentV2

A second-generation remote-attachment guard that catches newer attachment exploits the original check does not cover. Keep both enabled for full coverage.

AntiControlEntity

Blocks players from forcing network control of entities they should not be able to command, such as another player's vehicle or a server-owned entity.

AntiExplosionAi

Controls how explosions are handled, covering full blocking, fake explosions, four checks on the properties of a single explosion, and explosion spam. This detection was named ExplosionProtection before Raven 1.5.9.4.

• Types.CancelAllExplosions: block all unauthorized explosions
• Types.Fake: detect fake/spoofed explosions, configurable withEnable and WhitelistExplosions array
• Types.Invisible: cancel explosions the client marked invisible, configurable with Enable and a WhitelistExplosions array
• Types.Scale: cap the damage scale an explosion carries, configurable with Enable, Maximum (shipped at 1), and a WhitelistExplosions array
• Types.NoAudio: cancel explosions the client marked inaudible, configurable with Enable and a WhitelistExplosions array
• Types.Shake: cap the camera shake an explosion carries, configurable with Enable, Maximum (shipped at 3), and a WhitelistExplosions array
• Types.Spam: detect explosion spam, configurable withEnable, a WhitelistExplosions array, and up to five numberedRules, each with a type (normal, cluster, or spread),Threshold, and TimeWindow (seconds)

Invisible, Scale, NoAudio and Shake read properties of one explosion rather than counting explosions, so they behave differently from Fake and Spam. The explosion is cancelled every time one of the four matches, but the action on the player only lands on the third match, and a match is dropped again fifteen seconds later. Each of the four also takes its own Action and falls back to the detection's Action when it does not carry one. All four ship enabled with an empty WhitelistExplosions, so a script of your own that legitimately fires a silent or an oversized explosion needs that explosion type added to the list for the check it trips.

AntiParticleAi

Controls particle effects: blocks unauthorized particles, caps particle scale, and detects spam. This detection was named ParticleProtection before Raven 1.5.9.4.

• Types.CancelAllParticles: block unauthorized particle effects
• Types.Scale: limit particle scale, configurable withEnable, Maximum (shipped at 1), and a WhitelistParticles array
• Types.Spam: detect particle spam, configurable withEnable, a WhitelistParticles array, and up to five numberedRules, each with a type, Threshold, and TimeWindow (seconds)

AntiProjectileAi

Controls projectiles: blocks unauthorized ones, limits how far from the player a projectile may be created, and detects projectile spam. The distance test is the one that catches remote projectiles, so a script that fires a rocket or a grenade on behalf of a player, from a position the script picked, is what usually trips it.

• Types.CancelAllProjectiles: block unauthorized projectiles outright
• Types.Distance: act when a projectile is created further from the player than allowed, configurable with Enable, Maximum (distance in units, shipped at 100), and a WhitelistWeapons array
• Types.Spam: detect projectile spam, configurable with Enable, a WhitelistWeapons array, and up to five numbered Rules, each with a type (normal, cluster, or spread), Threshold, and TimeWindow (seconds)

AntiFireEvent

Controls fire events that can be used to grief players or crash the server.

• Types.Block: block all unauthorized fire events
• Types.Distance: restrict fires by distance, configurable withEnable and Maximum (distance value)

AntiPlaysound

Blocks play-sound network events that can be abused to spam disruptive audio for other players.

Events and resources

AiServerEventsProtection

Blocks unauthorized server-side network events triggered by clients.

• BlockedEvents: array of event names to always block
• WhitelistEvents: array of event names that are always allowed
• WhitelistResources: array of resource names whose events are always trusted

AiClientEventsProtection

Blocks unauthorized client-side network events, preventing cross-client event injection.

• WhitelistEvents: array of event names that are always allowed
• WhitelistResources: array of resource names whose events are always trusted

AntiStartResources

Blocks players from triggering resource start commands on the server.

AntiStopResources

Blocks players from triggering resource stop commands on the server.

AntiHookNatives

Detects a cheat that has hooked the game natives the Raven client reads. On every pass of the client core loop it checks that each of those natives still answers with the type it is supposed to answer with, that GetGameTimer keeps moving forward instead of standing still or running backwards, and that the ped state natives do not contradict each other, since a ped cannot be ragdolled and sprinting at the same time. A frozen timer and a contradiction each have to hold for three passes in a row before they count, because one crossed reading on its own means nothing. Two hits are needed before it acts and a lone hit is forgotten after 30 seconds. The ban names the native, what it should have returned and what it returned instead. This and AntiTamperedEnv below it sit under Detections.Resources in the config, next to the resource checks, even though what they watch is the client itself. Neither carries options beyond Enable and Action.

AntiTamperedEnv

Detects a cheat that has rewritten the Lua environment the Raven client runs inside. It checks that the _G metatable and the native resolver behind it are the ones it started with, that the Raven table itself has not been swapped out, that globals such as exports, Citizen, LoadResourceFile and rawget still point at their original references, and that natives such as PlayerPedId and GetEntityCoords still come from the game rather than from a Lua function some resource defined. For the first 60 seconds after the client starts, a difference is taken as the new baseline instead of acted on, so a wrapper another resource installs while the server is still coming up becomes the baseline rather than a ban. Two hits are needed before it acts and a lone hit is forgotten after 30 seconds, and the ban names the global, what was expected and what was found.

AntiResourcesInjection

Blocks injection of unauthorized resources at runtime.

• WhitelistResources: array of resource names that are always permitted

Cheat tools and injection

AntiLuaMenus

Detects texture names associated with known Lua cheat menus rendered on the client.

• Textures: array of known cheat menu texture names to scan for

ClipboardScanner

Detects known cheat-related strings that have been copied to the player clipboard, which is a common indicator of script injection.

AntiExecutor

Detects cheat executors and injection tools running alongside the game. This detection replaced the earlier AntiOverlay check.

• Types.Internal: detect executors injected into the game process
• Types.BlockInput: detect tools that block normal input
• Types.External: detect executors running outside the game
• Types.Bypass: detect known detection-bypass techniques
• Types.Spoofed: detect executors that spoof their identity

AntiNuiTamper

Detects tampering with the Raven NUI, such as opening the browser DevTools panel to inspect or manipulate the client. This detection was named AntiNuiDevTools before Raven 1.5.9.4.

• Types.Inspector
• Types.Timeout

AntiScreenOcr

Detects screen-reading OCR tools that scan the game image to feed external cheats such as ESP and aimbot overlays.

Heartbeat

An anti-tamper heartbeat that verifies the Raven client has not been modified or killed. The default Action for this detection is "kick".

• Types.Timeout: flag a client that stops sending heartbeats
• Types.Model: flag an unexpected player model reported in the heartbeat
• Types.Coords: flag impossible coordinates reported in the heartbeat
• Types.Vehicle: flag a spoofed vehicle model reported in the heartbeat
• Types.Advanced: flag a frozen or unresponsive client

Other settings

Raven supports Discord webhooks for kick logs and ban logs, and they live in the config under Discord.Webhooks.ban and Discord.Webhooks.kick. The section is still there on 1.5.9.4 and newer. What changed at 1.5.9.4 is who sends the message: the Raven cloud posts the log instead of your resource, so the section is no longer shipped down to the resource and a webhook URL never reaches your game server host. You fill the two URLs in on the dashboard Main Settings page. See the Discord logs reference for setup instructions.

Screenshots and recordings captured by a detection are stored on the Raven cloud CDN atravenac.net/cdn/... and linked from the dashboard activity log, so you do not need a screenshot webhook anymore.

Punishment display is controlled by the Display settings, which configure the message shown to a kicked player and the ban screen content shown to banned players.

AutoInstallation automatically loads Raven across server resources without requiring manual integration in each resource.

• Enable: turn AutoInstallation on or off
• IgnoreResources: array of resource names to exclude from automatic loading