FiveM Resource Builder

A Claude Code skill that scaffolds full FiveM and RedM resources with the security already in place. Ask for a shop, a garage, a job, a HUD; you get a working resource where every server event validates input, every price lives on the server, and nothing trusts the client.

npx fivem-resource-builder

Restart Claude Code, then /fivem-resource-builder or just say what you want:

"create a QBCore shop with a NUI" "scaffold an ESX garage" "add a secure buy event to this resource"

Why it's different

Most generators hand you an empty skeleton and wish you luck. This one writes the parts people get wrong:

• source resolved on the server, never sent by the client
• Input validated for type, range, length and NaN
• Bounded arithmetic — quantities capped before they are multiplied and totals sanity-checked afterwards, because lua54 integers wrap silently and a validated-positive quantity can still mint money
• Rate limits and anti-dupe mutexes on money and item events
• Prices read from server config, not from the NUI
• Proximity checks on world actions
• ACE for admin, not job strings — anything that can set a job otherwise inherits admin
• Shared state written server-side, so the resource survives sv_stateBagStrictMode true
• Secrets in set convars, never setr (which replicates to every client)
• playerDropped and onResourceStop cleanup, every time
• NUI that escapes user text, ships a browser preview mode, and comes with a locked-down build chain

The output is built to pass the audit (below) on the first run — and the checklist that guarantees it is kept in sync with the audit's checks, not written once and left to drift.

What you get

| Layer | What it generates | |-------|-------------------| | Manifest | cerulean, lua54, explicit file list, declared dependencies, nui_callback_strict_mode, node_version | | Framework | auto-detect bridge for ESX, QBCore, QBox (ox_core), ND_Core, standalone | | Server | validated events, bounded arithmetic, parameterized SQL, ACE permissions | | Client | two-tier threads, cached natives, preferences-only KVP, full cleanup | | Connection | deferrals that terminate on every branch, multi-identifier bans, fail-closed whitelists | | NUI | XSS-safe rendering, intent-only callbacks, CSP, preview mode, hardened build chain | | ox | lib.callback, ox_target, ox_inventory hooks, lib.points, lib.locale | | TypeScript | optional esbuild/Vite build with typed natives and NUI hot reload | | CI | luacheck GitHub Action and .luacheckrc tuned for Cfx globals |

It looks up real natives, framework exports and model hashes instead of guessing them.

Frameworks: ESX Legacy, QBCore, QBox (ox_core), ND_Core, ox_lib, standalone, and RedM (VORP, RSG, RedEM).

Builds: GTA V Legacy and Enhanced. Where the two differ — always-on pure mode, unsupported resource builders, state bag callback semantics — the generated code works on both unless you say which one you are on.

The toolkit

Three tools, one workflow.

| Stage | Tool | |-------|------| | Build | fivem-resource-builder | | Audit | fivem-security-audit | | Protect | dei_security_scanner |

Build it secure, audit the diff before you deploy, run the scanner so anything injected later gets caught.

License

MIT