Panel configuration reference

Runs every detection without acting on it. Recommended for the first day of any install and after any big script change. The hours field is a timer after which enforcement turns on by itself; 0 disables the timer so it stays on until you turn it off.

The global kill switch. Off, the resource still detects and reports everything but never bans or kicks. Learning Mode is the same idea with a timer.

What a removed player sees. {banId}, {reason} and {appealUrl} are substituted. The connection card shows the same information more legibly for banned players.

The chat and console command name. Change it if it collides with another resource.

A client that has not completed the Argus handshake within this many seconds of joining is kicked. Raise it for players on very slow connections.

After the handshake the server challenges each client on a schedule and the client answers with a signature and a census of its own detection loops. A client that stops answering has had Argus killed; one whose loops stop advancing has had them killed one by one. The timeout is how long without a valid answer before resource.client_silent fires.

Run the deferred connection checks — Chainban and ArgusNet — while the player is still on the loading screen, so a banned identity never loads in.

Resources that must not be instrumented. Same warning as config.lua: only add a script that fails to start with Argus installed. Everything else you add here makes Argus less accurate about your server.

Off means the detection does not run at all. When you turn one off the panel asks why and records it with your name and the date, so six months from now nobody re-enables something that was muted for a reason.

Ban removes the player and records a ban. Kick removes them for now. Flag records it and raises it in the panel and Discord for a human to look at. Log only records it. The shipped defaults never ban on a client-only signal.

How many hits inside a rolling window of this many seconds before the action fires. A threshold of 3 in 60 means the third hit inside any minute acts. Threshold 1 acts on the first.

Optional per-detection override of how long a ban lasts. −1 is permanent.

Master switch for model blacklists, spawn rate limits and whitelist zones. Off means entity creation is not inspected at all.

Scripted entities one player may create per 10 seconds before entity.spawn_flood fires. Ambient population the client streams in — traffic, pedestrians, parked cars — is never counted. Per-class overrides for vehicles (15), peds (20) and objects (60) sit under it; 0 means use the global limit.

Weapon-class explosions — grenades, rockets, sticky bombs, mines — one player may own per 10 s before combat.explosion_spam records a hit. Vehicle, fuel and fire explosions never count, whoever owns them.

Networked particle effects and fires one player may start per 10 s before exploit.ptfx_spam or exploit.fire_spam fires. These are the two most common crash-and-troll vectors and the limits are generous for honest scripts.

Explosion types permitted from clients. Empty allows everything, subject to the rate limits; non-empty means only those numeric types pass.

Reject entity creation from players whose Integrity Score is below this. 0 disables the gate.

Vehicles, peds, objects and weapons by model name. Block cancels the spawn, allow exempts the model from every other entity check, log lets it through and records it. A block rule also carries what happens to the player — nothing, kick, temporary ban or ban — set on the Model Library page, because stopping a spawn and removing the person are different decisions. The shipped blacklist covers military vehicles, weaponised vehicles, dangerous props, animals and heavy weapons.

Areas where entity classes may be created; with exclusive set, the listed classes may only be created inside zones. For servers where every vehicle should come out of a garage script.

Delete an offending entity instead of only recording it.

player.armour_over_max fires above this. Raise it to match what your scripts hand out rather than disabling the detection.

player.health_over_max fires when the server reads a player's health, or the ped's own maximum, above this. 0 means the game default of 200. If your scripts raise max health above 200, raise this to match rather than disabling the detection.

Degrees off the shooter's facing past which a landed hit counts toward aimbot.off_axis. Normal aim stays inside about 30°; the gap up to the default is left for the server's copy of a heading being a moment stale. Lower it only if your players' pings are consistently low.

How many hits past that angle, inside how many seconds, before it fires. One is lag, two is bad luck, three is a pattern.

Closer than this and the angle is not judged at all: at arm's length a sidestep is ninety degrees.

For aimbot.target_switch: hits on two different players inside this many milliseconds, that far apart as seen from the shooter, count as the aim having jumped rather than moved. Hits from one trigger pull never count.

For combat.mass_damage: how many distinct players, each in its own damage event, inside how many milliseconds. Raise the count on servers that run large organised shootouts.

For combat.phantom_weapon: after a swap, a hit from the previous weapon that lands inside this window is still honest. Raise it for high-latency players; below a second it will flag honest swaps.

Argus's own net event names are obfuscated per session so a dumped list goes stale on the next restart.

Payloads between the resource and the client are encrypted.

Fake event names published alongside the real ones. Nothing legitimate ever calls them, so a call is a menu enumerating events.

Applied on top of the per-event baselines Argus learns from your own traffic. Above 1 is more lenient, below 1 stricter.

Protected events are refused (block) or recorded (log) when triggered from a client. Exceptions are exempt from rate detection entirely — for the chatty-but-honest events every framework has, where the learned baseline is still not generous enough.

Reject names that are not letters, digits, spaces or _ - . [ ].

Refuse a connection whose strong identifiers are already on someone connected. Off by default: a player rejoining after a crash can briefly overlap themselves, and refusing that is worse than allowing the rare genuine clone.

Via proxycheck.io with your own API key — Argus does not proxy it, so your quota and your players' IPs stay between you and the provider. Fails open: an unreachable provider never locks the front door. Action is log or kick.

Read-only: enumerates resources, reads manifests, indexes events. Safe to leave on; it never writes to a file you own.

Whether Argus may write the integration line into other resources' manifests on its own. Off by default on purpose: it rewrites files you own, and an owner who has not agreed to that in so many words has not agreed. First boot scans, reports what it would change, and prints the one command that does it.

Escrow encrypts the source bundle, not the manifest — the server reads the manifest in plaintext to know what to load, so adding a line to it has been routine for years. Escrowed paid scripts are frequently the ones most worth protecting. Turn it off if a vendor's resource ever objects; Argus also reverts automatically if an integrated resource stops loading.

No learned event policy can kick or ban however it is individually set. Your week-one safety net, and where a fresh install starts.

A hard cap for events whose handler moves money, items or permissions, regardless of what the profile learned. This is the anti-poisoning rule: observation may lower a limit, never raise it past here. Without it, an attacker patient enough to spam slowly teaches Argus that spamming is normal.

What Argus learned about each event in your resources: discovered, profiled, constrained, high-risk or blocked. A policy starts in shadow so you see what it would have done against a week of real traffic before it can act on anyone. Discovering an event in a legitimate resource tells Argus what the event is, never that a given call is authorised.

Where every new player begins.

Points earned back per hour of clean play. Credited minute by minute while the player is online — paused for any minute in which a detection fires — and for the hours they are away between sessions.

Below this the player is banned on score alone — but only once a server-observed detection that itself kicked or banned has contributed to it. Client-reported signals can drain the score and never reach a ban by themselves. 0 means the score never bans by itself — the shipped default, so every ban traces to a specific detection.

Below this every action by the player is recorded in full detail.

Below this entity creation and event rates are tightened for that player.

How aggressively identifiers are linked into one identity. Lenient links only on the strongest identifiers; strict links on anything shared.

Which identifier kinds create a link when shared. IP is off by default because households and VPN exits share it.

Ban every linked identity when one is banned.

Read reputation data from the network of Argus servers, and send your confirmed bans back to it.

How many independent servers must have banned an identity before it counts against a player on yours.

What happens when a known identity connects. Flag by default so a human decides.

Separate webhooks for bans, detections, connections, staff actions and system events, so each goes to the channel that wants it.

Mirror chosen streams into a MySQL or Postgres database you control. The connection string is written to the resource host only and never stored in the panel in plaintext.

How long logs are kept in the panel, up to a year.

Take a screenshot of the player's game on any detection at or above this severity, at the chosen quality, and optionally attach it to the Discord ban log. Evidence for the appeal you are going to get.

A recording of the seconds before a kick or ban, made in the player's own game and attached to the detection and the ban. Armed (the default) starts recording at a player's first hit or when they enter the watch band and stops after fifteen quiet minutes, so clean players cost nothing and the run-up to nearly every action is already recorded. Always records every player, for owners who want the clip on first-hit actions and accept the cost. When the action lands, the server holds the drop for up to four seconds while the game uploads; it never waits longer. The panel plays the WebM at once and offers an MP4 a few seconds later.