FiveM Resource Builder

A Claude Code skill that scaffolds full FiveM and RedM resources with the security already in place. Ask for a shop, a garage, a job, a HUD; you get a working resource where every server event validates input, every price lives on the server, and nothing trusts the client.

npx fivem-resource-builder

Restart Claude Code, then /fivem-resource-builder or just say what you want:

"create a QBCore shop with a NUI" "scaffold an ESX garage" "add a secure buy event to this resource"

Why it's different

Most generators hand you an empty skeleton and wish you luck. This one writes the parts people get wrong:

• source resolved on the server, never sent by the client
• Input validated for type, range, length and NaN
• Rate limits and anti-dupe mutexes on money and item events
• Prices read from server config, not from the NUI
• Proximity checks on world actions
• playerDropped and onResourceStop cleanup, every time
• NUI that escapes user text and ships a browser preview mode

The output is built to pass the audit (below) on the first run.

What you get

Layer	What it generates
Manifest	cerulean, lua54, explicit file list, declared dependencies
Framework	auto-detect bridge for ESX, QBCore, QBox (ox_core), ND_Core, standalone
Server	validated events, parameterized SQL, ACE permissions
Client	two-tier threads, cached natives, full cleanup
NUI	XSS-safe rendering, intent-only callbacks, CSP, preview mode
ox	lib.callback, ox_target, ox_inventory hooks, lib.points, lib.locale
TypeScript	optional esbuild/Vite build with typed natives and NUI hot reload
CI	luacheck GitHub Action and .luacheckrc tuned for Cfx globals

It looks up real natives, framework exports and model hashes instead of guessing them.

Frameworks: ESX Legacy, QBCore, QBox (ox_core), ND_Core, ox_lib, standalone, and RedM (VORP, RSG, RedEM).

The toolkit

Three tools, one workflow.

Stage	Tool
Build	fivem-resource-builder
Audit	fivem-security-audit
Protect	dei_security_scanner

Build it secure, audit the diff before you deploy, run the scanner so anything injected later gets caught.

License

MIT