Getting started
How a scan works
The four steps from a flagged player to evidence.
Every Trace scan follows the same four steps. Staff install nothing. The player does one thing: download the scanner and run it. Everything after that runs on its own.
The four steps
-
Your anti-cheat flags a player
Something suspicious trips the anti-cheat already running inside your server. That in-game detection is the trigger. Trace does not watch your server and does not sit in your resources.
- Trigger
- in-game detection
- Runs on
- your server
-
Staff make the user download the Trace scanner
A staff member tells the flagged player to download the scanner. There is no server-side resource to install and nothing to configure on your end.
- Staff action
- one message
- Server install
- none
-
The player runs the scanner
It runs on their own machine, reads what FiveM loaded, sends it to your dashboard and exits. A few seconds, and nothing stays installed afterwards.
- Duration
- 3 to 6 s
- Leaves behind
- nothing
-
You read the verdict
The finished report lands on your Trace dashboard: a verdict with a confidence score, every flagged artifact with its hash, and a timestamped log you can export.
- Where
- Trace dashboard
- Formats
- JSON, CSV, PDF
No PIN, no link, no approval step
The player downloads the scanner and runs it. There is no code to type, no generated link and no in-game approval.
What a scan looks like
This is the output of a sample scan (player, server and hashes are fictional). Lines starting with ! are findings.
$ trace-scanner.exe --case 4812
> scanner started on client machine
> case 4812 opened, flagged by server anti-cheat
> enumerating processes ...................... 214
> reading loaded modules ..................... 96
> checking known signatures .... SIG-DB 2026.09.19
! SIG-EXEC-0417 matched in _vx_loader/client.lua
> reading execution artifacts (prefetch, amcache)
! _vx_loader.exe ran 00:14 before the scan started
> cross-referencing hash database ....... 312 hashes
! citizen-scripting-lua differs from build 9532
> uploading verdict to dashboard . TRC-7F3A-91C2
= scan complete in 3.02 s
After the scan
The scanner uploads one finished report and exits, leaving nothing installed. The verdict appears on your dashboard. See Reading a verdict.