Early access · Lua 5.4 · OneSync

The core your server can trust.

UgCore is a FiveM framework built server-first. Clients send intent, the server decides. Every net event is validated, rate limited and scored. Owners enable only the modules they need, and developers get a typed API.

Build your first resource Install UgCore API reference →

modules, enable what you need

layers of client protection

UI dependencies in the core

Built different, on purpose

Most frameworks trust the client and patch holes later. UgCore starts from the opposite end.

Server-authoritative

Prices, amounts and outcomes are computed on the server. Positions are read from the ped, never from the client.

Validated by default

No net event or callback registers without a bounded schema and a rate limit. Unbounded input is impossible to accept.

Guard scoring

Suspicious behavior adds to a decaying score per player. Thresholds warn, kick or ban, and your anticheat can hook in.

Headless

The core draws nothing. It returns result codes and emits events, so any UI resource can sit on top.

Modular

Ten modules, from accounts to sessions. Disabled modules leave no tables, no events and no namespace behind.

Owner-friendly config

One config/ folder, generated on first boot and never overwritten. Typos get suggestions, bad values stop boot with every error listed.

A callback in eight lines

Declare what you accept and how often. UgCore runs the global budget, the concurrency cap, the rate limit, the loaded and permission checks and the schema before your handler sees anything.

Bad input never reaches your code. It reaches the player’s Guard score.

Learn callbacks →

local S = UgCore.Schema

UgCore.Callback.Register('Withdraw', {
    schema = S.Define({ S.Integer({ min = 1, max = 100000 }) }),
    rate = { max = 3, per = 5000 },
    requirePlayer = true,
}, function(source, amount)
    local ok, balance, errorCode = UgCore.Accounts.Remove(source, 'bank', amount, 'ATM withdrawal')

    return { ok = ok, balance = balance, error = errorCode }
end)

local ok, result, errorCode = UgCore.Callback.Await('my-bank:Withdraw', 500)

if not ok then
    -- errorCode is one of: rate_limited, invalid_args, not_loaded, timeout, ...
    return
end

print(('New balance: %d'):format(result.balance))

fx_version 'cerulean'
game 'gta5'
lua54 'yes'

ug_core_version '1.0.0'

dependency 'ug-core'

shared_script '@ug-core/import.lua'
server_script 'server.lua'
client_script 'client.lua'