Trace
Your anti-cheat flags a player. They run the scanner. You get a timestamped verdict with the results attached.
runs in 1–4 min no server install
Most FiveM cheats now hide from the tools staff have. A recording shows what a player did. It does not show what was running on their machine.
Why clips lose appeals A recording is testimony. A scan is evidence.
Loaders rebuild themselves every session. Matching a file name catches yesterday’s build and nobody else’s.
A resource that is missing from your server manifest can still run on the client. Nobody looks until someone is reported.
No file on disk, no resource, no log line. Clip review cannot see them at all.
A ban made from forty seconds of video is an opinion. It gets argued in Discord and reversed on appeal.
Staff install nothing. The player does one thing: download the scanner and run it. Everything after that runs on its own.
$ detection: player 4812
Something suspicious trips the anti-cheat already running inside your server. That in-game detection is the trigger. Trace does not watch your server and does not sit in your resources.
$ download trace-scanner
A staff member tells the flagged player to download the scanner. There is no server-side resource to install and nothing to configure on your end.
$ trace-scanner.exe
It runs on their own machine, reads what FiveM loaded, sends it to your dashboard and exits. A few seconds, and nothing stays installed afterwards.
$ dashboard: TRC-7F3A-91C2
The finished report lands on your Trace dashboard: a verdict with a confidence score, every flagged artifact with its hash, and a timestamped log you can export.
This is what the flagged player’s machine reports back, played at the speed it happens. Press the button and read it line by line.
Sample data. Player, server and hashes are fictional.
$ trace-scanner.exe --case 4812
> scanner started on client machine
> case 4812 opened, flagged by server anti-cheat
> enumerating processes ...................... 214
> reading loaded modules ..................... 96
> checking known signatures .... SIG-DB 2026.09.19
! SIG-EXEC-0417 matched in _vx_loader/client.lua
> reading execution artifacts (prefetch, amcache)
! _vx_loader.exe ran 00:14 before the scan started
> cross-referencing hash database ....... 312 hashes
! citizen-scripting-lua differs from build 9532
> uploading verdict to dashboard . TRC-7F3A-91C2
= scan complete in 3.02 s
Six checks run on every scan. Each one either matches something known, or it does not.
Finds resources running on the client that never appeared in your server manifest.
A manifest diff catches the gap even when the resource renames itself every launch, something a log-line check misses the moment the name changes.
216 enumeratedMatches byte patterns and structure hashes for known Lua executors and menu loaders.
SIG-DB 2026.09.19Hashes game and CitizenFX files against known-good builds, so patched binaries stand out.
96 modules hashedReports overlays and modules that attached themselves to FiveM after it launched.
The check runs against the process as it exists right now, not against a snapshot taken at scan start, so a loader that attaches mid-session still shows up in the same report.
FiveM onlyFlags event handlers registered for events a normal client would never receive.
Per eventNotices when a scan is interfered with, killed early or fed a spoofed result.
Every scanEvery finished scan arrives on the dashboard. Push the same verdict into Discord or into your own tooling, whichever your staff actually watch.
Roles decide who can open raw artifacts and who can mark a case reviewed. Point a webhook at Discord and the same verdict posts to your staff channel.
# open a case for a player your anti-cheat flagged curl -X POST https://api.scanwithtrace.com/v1/cases \ -H "Authorization: Bearer $TRACE_KEY" \ -H "Content-Type: application/json" \ -d '{"server_id": "eastside", "player": "steam:11000013a7c4e52"}' # => 201 { "case_id": "TRC-7F3A-91C2", "status": "awaiting_scan", "dashboard": "https://scanwithtrace.com/c/7f3a91c2" }
The case stays open until the player runs the scanner. Your webhook fires the moment the verdict is written, carrying the same fields the dashboard shows.
Privacy and scope
Trace is a scanner. It looks at FiveM and the processes attached to it, and nothing else. This is the full list.
Scanner 1.8.2 Code-signed. SHA-256 published in the docs, so you can verify the binary before you send a link.
Prices in euro, tax added at checkout where it applies. Personal renews on the term you pick unless you choose lifetime; Enterprise is billed every six months.
Personal
Everything the scanner does, for one person running it.
€8 one month
Rolling monthly access. Cancel before a renewal and nothing further is charged.
Enterprise
Ten people can request scans and open artifacts, with one audit trail across your servers.
€40 six months
10 staff seats
Ten seats, billed once for six months. Shared ban list and a single audit trail across every server you add.
Enterprise
The same thing with twice the seats and a higher scan ceiling, for a network with rotating staff.
€60 six months
20 staff seats
Twenty seats, billed once for six months. Same features as the ten-seat plan, with double the seats.
The questions staff ask first, answered plainly.
Your own anti-cheat flags the player first. A staff member then tells that player to download the Trace scanner and run it. Trace does not sit inside your server and does not watch your players.
Windows 10 and 11, on the player’s own PC, while FiveM is open. It runs for a few seconds and exits.
It can. The scanner is code-signed and its SHA-256 is published in the docs, but some antivirus tools flag any process that reads another process’s module list. Tell players what the scanner does before you ask them to run it.
In principle, yes, and we do not claim otherwise. The scanner is rebuilt on a schedule and signatures update daily. A clean report is evidence, not proof. Use it alongside staff judgement.
The same report with a CLEAN verdict, the full log and the same hashes. Clean means nothing matched at the moment of the scan.
Any FiveM server. ESX, QBCore, Qbox, ox_core, vRP and standalone setups all work. There is no server-side resource to install: the scanner runs on the flagged player’s machine and the verdict arrives on your dashboard.
Through Stripe, in euro. Personal is sold monthly, six-monthly, yearly or as a one-off lifetime license; Enterprise is billed every six months. Tax is added at checkout where it applies.
Usually not, but if its a problem from our end you get a full refund and on some cases a compensation. Ask in Discord or by email.
Use the billing portal link in your receipt email, or ask in Discord. Cancelling stops renewal, and access continues to the end of the paid period. A lifetime license has nothing to cancel.
Set it up in the time it takes to invite a bot and pick a role.