Do I need GTA V or a FiveM server to test a script?

No. The tester parses and checks the resource and runs its Lua in a CfxLua sandbox in your browser. For anything that depends on the game world or a real database, the report tells you exactly what still needs a real server.

No. Analysis and simulation run in a Web Worker in your browser. Only "Open in RPCrate AI" sends the files to your RPCrate account, and only after you log in.

Does a passed test mean the script works on my server?

It means the simulated behaviour passed. It is strong evidence for event wiring, security checks and Lua errors, not a guarantee for game natives, OneSync or your exact framework version.

Which frameworks are supported?

QBCore, Qbox and ESX, plus ox_lib, ox_inventory, ox_target, qb-target and oxmysql. Static checks use their pinned upstream APIs; the sandbox loads clearly labelled test doubles that list what they implement.

Can it fix the errors?

Open the resource in RPCrate AI: it gets the findings and test results, proposes a change you can review as a diff, saves it as a new version and the Lab runs the checks and scenarios again.

FiveM Script Tester

Upload a resource and see what's wrong before it reaches your server: manifest, Lua, framework API and event security, plus a CfxLua sandbox that runs its events, threads, exports and NUI callbacks. Your code stays in your browser.

Drop a resource ZIP here

A FiveM resource folder as .zip (max 5 MB), a single .lua file, or paste code. Nothing is uploaded: analysis and simulation run in this tab.

Static checks and the CfxLua simulation run locally in a Web Worker. Your files are only sent to RPCrate when you choose "Open in RPCrate AI". Simulated results don't prove that a resource works on a real FXServer or in GTA V.

What the tester checks

Lua syntax including FiveM's CfxLua extensions (vectors, compound assignment, safe navigation, backtick hashes)
fxmanifest.lua: fx_version, game, scripts and globs that match no file, NUI files that aren't sent, lua54, ox_lib initialisation, dependencies
QBCore, Qbox, ESX, ox_lib, ox_inventory and ox_target calls against pinned upstream versions, including client/server side
Natives that don't exist or exist only on the other side, from Cfx.re's published typings
Net events handled without RegisterNetEvent, callbacks never registered, own exports never defined
Server events that trust client values for money, items or jobs, privileged actions without permission checks, source used after Wait
Endless loops without Wait and resource start/stop handlers that run for every resource

What runs, what is simulated, what needs a real server

Runs for real: your Lua on CfxLua 5.4 compiled to WebAssembly, with FiveM's scheduler (CreateThread, Wait, SetTimeout), events, msgpack and json, resource start and stop.

Simulated by RPCrate: a server and one client per player, TriggerServerEvent/TriggerClientEvent with source, exports between resources, state bags, NUI callbacks, commands with aces, resource KVP, and test doubles of QBCore, Qbox, ESX, ox_lib, ox_inventory, ox_target, qb-target and oxmysql.

Needs a real server: game natives (entities, vehicles, peds, world), OneSync, the database, real framework data and JavaScript or C# scripts. When code calls these, the result says "partially tested" and lists the calls.

Worked examples

A purchase event that trusts the client

RegisterNetEvent('shop:buy', function(item, price)
    local src = source
    local Player = QBCore.Functions.GetPlayer(src)
    if not Player or not Items[item] then return end
    if Player.Functions.RemoveMoney('cash', price, 'shop') then
        Player.Functions.AddItem(item, 1)
        TriggerClientEvent('shop:bought', src, item)
    end
end)

The price comes from the client, so any player can buy for nothing — or send a refund of any size. The analyser flags the pattern (LAB-SEC-001); the hostile-payload scenario then sends crafted events as a player without a job and shows the money the server handed out.

Fix: look the price up on the server (Items[item].price) and ignore what the client sends.

An event that FiveM silently drops

-- client.lua
TriggerServerEvent('shop:sell', 'bread')

-- server.lua
AddEventHandler('shop:sell', function(item) … end) -- LAB-EVT-001

The client triggers it with TriggerServerEvent, but the server only uses AddEventHandler. FiveM drops it with "was not safe for net" — the simulation shows the same line in the trace, and LAB-EVT-001 points at the handler.

A loop that freezes the client

CreateThread(function()
    while true do -- LAB-SCH-001
        if open then DisableControlAction(0, 1, true) end
    end
end)

while true do … end without Wait never yields. LAB-SCH-001 marks the loop, and in the sandbox the watchdog stops the thread with "missing Wait in a loop?" instead of freezing your browser.

FAQ

Do I need GTA V or a FiveM server to test a script?: No. The tester parses and checks the resource and runs its Lua in a CfxLua sandbox in your browser. For anything that depends on the game world or a real database, the report tells you exactly what still needs a real server.
Is my code uploaded?: No. Analysis and simulation run in a Web Worker in your browser. Only "Open in RPCrate AI" sends the files to your RPCrate account, and only after you log in.
Does a passed test mean the script works on my server?: It means the simulated behaviour passed. It is strong evidence for event wiring, security checks and Lua errors, not a guarantee for game natives, OneSync or your exact framework version.
Which frameworks are supported?: QBCore, Qbox and ESX, plus ox_lib, ox_inventory, ox_target, qb-target and oxmysql. Static checks use their pinned upstream APIs; the sandbox loads clearly labelled test doubles that list what they implement.
Can it fix the errors?: Open the resource in RPCrate AI: it gets the findings and test results, proposes a change you can review as a diff, saves it as a new version and the Lab runs the checks and scenarios again.

Fix what the tester found

Open the resource in RPCrate AI to repair findings with a reviewable diff, rerun the tests and download the result — or check a manifest with the fxmanifest generator.

The sandbox runs FiveM's CfxLua through FiveLab (MIT), pinned at a reviewed revision.

More free tools

All free tools →