enhanced-scan

Static analysis for the FiveM Enhanced migration. Point it at your server and it tells you what will break — before you find out at peak hours.

FiveM for GTA V Enhanced entered Early Access on 21 July 2026. It replaces peer-to-peer with a client–server model, swaps Mono for .NET 10, removes OneSync non-big-mode, makes Pure Mode permanent, and drops several convars and subsystems entirely. Most servers have never audited for any of it.

npx @overtickgg/enhanced-scan ./resources

No install, no account, no telemetry by default. Zero runtime dependencies.

What it checks

28 rules across four severities.

| | Rules | What it means | |---|---|---| | Critical | E001–E007 | The server or resource will not run | | High | E101–E108 | Behaviour changes silently — no error, wrong result | | Medium | E201–E208 | Deprecated but still functioning | | Opportunity | E301–E305 | New Enhanced capability you're not using yet |

Critical — will not run

• E001 C# assembly targets a pre-.NET 10 runtime (reads the target framework out of the assembly)
• E002 Escrow-protected resource — escrow is "not implemented yet" on Enhanced
• E003 Removed convar sv_netHttp2
• E004 Removed convar onesync_automaticResend (ARQ)
• E005 OneSync is not in big mode
• E006 Depends on the server ImGui interface (svgui)
• E007 fxmanifest does not declare lua54 (third-party sourced — flagged as such in the report)

High — silent behaviour change

• E101 State bag callbacks now require the entity to exist
• E102 State value set without explicit replication
• E103 Client-side player iteration under big mode
• E104 Deprecated culling native
• E105 Mumble voice native (deprecated)
• E106 ExecuteCommand without PrintRemoteCommandLog
• E107 Client modification blocked by Pure Mode
• E108 Resource appears to act as a builder

Medium — deprecated

• E201 sv_useAccurateSends → sv_syncTickRate
• E202 onesync_enableBeyond
• E203 sv_enhancedHostSupport
• E204 sv_protectServerEntities → sv_entityLockdown
• E205 Dual-client flag -cl2
• E206 Game build pinned to a non-latest version
• E207 KVP storage in use — database requires migration
• E208 Reference to FXServer.exe (renamed to cfx-server.exe)

Opportunity — new on Enhanced

• E301 sv_syncTickRate is available (1–120)
• E302 sv_resourceFileDownloadTimeout is available
• E303 RegisterCommand now returns an id for UnregisterCommand
• E304 Server-authoritative Voice API is available
• E305 /perf now exposes 80+ metrics

Usage

enhanced-scan [path] [options]

| Option | Effect | |---|---| | --html <file> | Self-contained HTML report — shareable, works offline, light and dark | | --json [file] | Machine-readable output; stdout if no filename | | --verbose, -v | Every occurrence, not just the first five per rule | | --fail-on <sev> | Exit 1 at or above this severity. critical | high | medium | info | never. Default critical | | --quiet, -q | Suppress the terminal report | | --share-stats | Share anonymous aggregate rule counts. Off by default. Prints the exact payload before sending | | --version | Print the version |

Exit codes — 0 clean, 1 findings at or above --fail-on, 2 bad usage.

Examples

# Scan a whole server root — picks up server.cfg and every resource
enhanced-scan .

# Just the resources directory
enhanced-scan ./resources

# Shareable report for your dev team
enhanced-scan . --html migration-report.html

# CI gate: fail the build on anything that changes behaviour
enhanced-scan . --quiet --fail-on high

CI

- name: FiveM Enhanced migration check
  run: npx @overtickgg/enhanced-scan . --quiet --fail-on high

What it scans

Point it at either a server root (it finds server.cfg and resources/ itself) or a resources directory.

It reads fxmanifest.lua / __resource.lua to identify resources and to classify scripts as client, server or shared — so E103 only fires on client-side code, not on the server-side call that's correct. Lua and C-style comments are stripped before matching, so commented-out code doesn't produce noise.

For E001 it opens .dll files and reads the TargetFrameworkAttribute string out of the assembly metadata, so the report names the actual framework rather than guessing.

On telemetry

Nothing is transmitted unless you pass --share-stats. There is no config file that can turn it on, no environment variable that enables it, and no first-run prompt that defaults to yes. The flag is the only path.

When you do pass it, the complete payload is printed to your terminal before it leaves. It contains rule-hit counts, severity counts, the tool version, and bucketed resource/file counts — no paths, no file names, no resource names, no source, nothing derived from your code.

This is opt-in rather than opt-out on purpose. The standing complaint about paid FiveM resources is that escrow hides behaviour nobody can audit. A free auditing tool that quietly uploaded anything would earn exactly the reputation it exists to counter.

What it does not tell you

Worth being direct about this, because a clean report is easy to over-read.

• It's static analysis. It cannot see runtime behaviour, natives called through string indirection, or anything inside an escrowed resource.
• E007 is not first-party. The Lua 5.4 requirement comes from third-party migration guides, not Cfx documentation. The report labels it as such. Verify against your own build before changing 200 manifests.
• E108 is a heuristic. It looks for a declared build step or a bundler config. Confirm before acting.
• A clean scan is necessary, not sufficient. Bench your server on Enhanced before you migrate production.

Rules are derived from Legacy vs Enhanced and Development Update #3. Every rule states its source confidence.

Development

node test/run.js     # 64 assertions, 28/28 rules covered
node bin/cli.js test/fixtures/dirty

Fixtures live in test/fixtures/ — a dirty server that trips every rule and a clean one that must produce zero findings. Adding a rule means adding both a detector and a fixture that proves it fires and a case that proves it doesn't false-positive.

Why this exists

It's the free front end of OVERTICK () — performance intelligence for FiveM servers. enhanced-scan tells you what will break. OVERTICK tells you whether the migration actually made you faster, with per-resource timing and player-count-conditioned baselines across the switch.

The scanner is free forever and has no upsell in the terminal output. Use it and ignore the rest.

MIT © 2026