Swarm Scripts
Nyxia Development
SwarmAC
The anti-cheat everything else on this platform's panel is built around. Confidence-scored detection with a decay system, not a single client report deciding a ban — server-authoritative where it matters, with a live admin panel behind it.
- Godmode, noclip, freecam & entity-spawn detection
- Configurable Safe / Balanced / Strict protection profiles
- Guided, licence-bound one-click city installer
- Live city connection & detection monitoring from the panel
- Boot-time resource scan syncs real inventory/trunk limits to cut false bans
- Confidence-scoring engine with evidence decay, not instant hard bans
- Swarm AI — a real vision model reviews every screenshot and live-watch frame for what heuristics alone can't see
Backdoors Aren't Hypothetical — Introducing Swarm-Secure
Cracked and reuploaded resource packs have been quietly shipping remote-code-execution backdoors alongside the scripts you think you're installing — and it doesn't stop at your FiveM city. Some of what we've found runs fully unsandboxed, with the same reach as any other program on the machine your server lives on. This isn't a theoretical risk we're marketing against — they're documented, active operations, and we've handled live copies of both ourselves.
Security researcher ImJer obtained the operation's own live database directly from its command-and-control infrastructure and published a full technical breakdown — deobfuscated payloads, infrastructure map, and victim statistics included.
Read the full analysis on GitHubA second, separate operation branded "Kercher-panel.me" — a different tool from the one above, and it doesn't hide inside your resources folder at all. It plants an entire fake resource inside FXServer's own bundled system files, disguised as an official Cfx.re asset, and ships a compiled native binary carrying a real OS shell-execution primitive — this one can reach past your FiveM city and onto the machine itself.
We found it, decoded it, and quarantined it directly on infrastructure we manage. SwarmAC now checks for it by resource name, content signature, and network destination.
We don't just read about these — we catch them
On infrastructure we manage, we've found and neutralized live copies of both operations above — one disguised with generic filenames inside otherwise-legitimate resources, the other planted as an entire fake resource inside FXServer's own bundled system files. We decoded each payload ourselves, down to the compiled binary, and confirmed exactly how they phone home. Tested end-to-end against real, live specimens, not lab simulations.
- Find. SwarmAC's threat-defense engine decodes and verifies candidate payloads across your entire resource tree, including FXServer's own bundled system files — not a filename guess, a real content check.
- Stop. The infected resource is halted immediately, the moment it's confirmed — before it gets another chance to run.
- Fix. This is the part most tools stop short of. Swarm-Secure is what actually rewrites the infected file — connected however your city is hosted — so you're not left with a stopped resource and a manual cleanup job.
Works whether your city runs on its own dedicated machine or a shared host you only reach over SFTP/FTP — Swarm-Secure adapts to the connection, not the other way around.
See it in the Client AreaIllustrative example — resource name and indicator shown are placeholders, not the actual detection signature. We don't publish exactly what we match on.
What SwarmAC Watches For
Every module below feeds the same scoring engine — nothing on this list is a single silent trigger.
Godmode & Health Hacks
Flags players taking damage the server doesn't agree with.
NoClip & Teleport
Catches movement and position changes that shouldn't be physically possible.
Freecam
Detects free-camera mode on supported server artifact versions.
Silent Aim
Flags shots that lock on or land without the player's actual aim ever crossing the target.
Visual ESP
Detects behaviour consistent with wallhacks and box/skeleton overlays.
Swarm AI — Visual Review
A vision-AI model reviews every screenshot and live-watch frame directly — ESP overlays, box/skeleton wallhacks, anything drawn into the game's own rendered frame, the one class of cheat pure server-side logic can never see on its own. Self-hosted, not a third-party API — nothing leaves your infrastructure.
Mod-Menu Signatures
Watches for known mod-menu command, keybind, network-event and global-table fingerprints — menu detection, in plain terms.
Blacklisted Entity & Vehicle Spawns
Server-authoritative check on illegally spawned props, vehicles and peds — spawned-item detection.
Blacklisted Network Events
Flags known malicious or blacklisted server events being triggered — triggered-event detection.
Weapon & Explosion Abuse
Blacklisted weapons and unauthorised explosions, checked server-side.
Runtime & Environment Tamper
Checks for modified game values and injected client-side code — as close to file-integrity checking as FiveM's client sandbox allows.
Chat & Identity Spoofing
Server-authoritative check against a player's real identity, not their displayed chat name.
How Detection Actually Works
No single flag ends a session. SwarmAC scores every detection, weighs it, and lets evidence build (or decay) before it does anything final — and now has a real vision-AI model reviewing the evidence itself, not just the numbers behind it.
Detect
Client and server modules watch for godmode, noclip, freecam, weapon/menu signatures, explosion abuse, illegal entity spawns and environment tampering in parallel.
Score
Each detection type carries its own weight. A player's score rises with every flag and decays back down over time if nothing else trips — a one-off false positive doesn't sink you.
Build A Case
Once a player's score crosses the evidence threshold, SwarmAC opens a case with the detection history and captured screenshots attached — visible to your admins in the panel, not silently discarded.
Swarm AI Reviews
Every screenshot attached to that case — and, during a live watch, a sample of the feed itself — goes to a vision-AI model that looks at what's actually on screen: does it back up the flag, or contradict it? Self-hosted, so nothing leaves your infrastructure to get an answer.
Act
Cross the soft-ban threshold and SwarmAC acts automatically. Everything below that stays a reviewable case, now with Swarm AI's own read on it attached — your call, not a black box.
Thresholds, weights and which modules run at all are configurable per city — Safe, Balanced and Strict profiles set sensible defaults, but every number underneath is yours to tune.
The SwarmAC Admin Panel
Every SwarmAC key comes with access to the web panel — the control room for licensing, cases and live server state. It's not a separate purchase.
Licence Management
Issue day, week, month or lifetime keys. Each key is shown to you once at creation and stored server-side as a hash from then on — even we can't read it back afterward.
Trust Centre & Resource Whitelist
Every resource on your server lands in a review queue — trusted, monitored, blocked or awaiting a decision — so you know exactly what's running before it's silently allowed.
Weapon Pack Control
Import and manage weapon packs against the trust system, so a custom weapon pack doesn't get flagged as a blacklisted weapon by mistake.
Guided City Installer
Name your city, generate a licence-bound installer, and follow a four-step install progress bar — the raw licence key is never exposed to whoever runs it.
Protection Profiles
Switch the whole city between Safe (roleplay-friendly, maximum tolerance), Balanced (recommended) or Strict (competitive PvP) without touching individual thresholds.
SwarmView Live POV
Pull up a suspected player's own view directly in the panel — see exactly what they can see, through their own eyes, without alt-tabbing into the game to spectate them.
Case & Evidence Review
Every case SwarmAC opens lands here with its full detection trail and attached screenshot evidence, so your admins are deciding on proof, not a chat log claim.
Ban Management
Every soft-ban and manual ban lives in one list — who, why, when, and a one-click reversal if a call needs correcting.
Live Server Monitoring
See every connected city, its last check-in, and its sync status at a glance — you'll know if a server goes quiet before a player has to tell you.
SwarmScan Resource Sync
On boot, SwarmAC pulls your city's real inventory and trunk weight limits and syncs them to the panel — so detection thresholds match your actual server config instead of a generic guess, cutting false-positive bans.
Admin Audit Log
Every action taken in the panel is logged against the admin who took it — full accountability across a multi-admin team.
Built-In Documentation
Setup guides and reference docs live inside the panel itself, next to the settings they explain, instead of a separate wiki you have to go hunting for.
Secure By Default
Super-admin accounts use scrypt-hashed passwords, signed HTTP-only session cookies, and automatic lockout after repeated failed logins.
On connect, players pass through the SwarmShield security gate — a four-step API link, identifier and protection check that runs before they're fully in your city.
What's Coming Next
SwarmAC isn't finished shipping. These are active builds, not vague promises — here's what's landing before we're done.
Identity-Based Anti-Spoofing
HWID and IP bans are the industry default — and both are trivial to get around with a spoofer or a new connection. We're building a ban that follows the player, not just the machine or the network they happened to use that day.
Swarm CCTV
One spectate window at a time doesn't cut it when you've got several players worth a second look. Swarm CCTV puts multiple suspects' true views up side by side, live, straight from the panel.
Live Player Map
Every connected player, positioned on a real map of your city, moving as they move — walking, driving, swimming, shown as it happens instead of a stale snapshot.
This page will keep growing as each of these ships — nothing here is final until it's actually live in the panel.
Pick A Licence Term
Every tier ships the full detection engine and panel access — the only difference is how long the key stays active.
The standard for live servers — ongoing protection with room to renew.
Buy NowBuy Now signs you in (or creates a Client Area account) and takes you straight to secure checkout.