FiveM Enhanced MCP
Provides tools for FiveM development, including exact native lookups, official documentation search, platform capability baselines, CEF/NUI compatibility auditing, fxmanifest validation, resource structure reviews, event and State Bag security reviews, and performance test planning.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@FiveM Enhanced MCPCheck whether GET_PLAYER_PED is client-scoped and cite the source."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
FiveM Enhanced MCP
An unofficial, source-grounded MCP server and Codex skill for professional development on FiveM for GTAV Enhanced.
It gives coding agents exact native lookups, current platform constraints, manifest and security reviews, NUI compatibility evidence, and direct primary sources. Unknown, stale, ambiguous, and conflicting facts remain explicit instead of being guessed.
This independent project is not approved, sponsored, endorsed, or maintained by Rockstar Games or Cfx.re. It supports GTAV Enhanced only and contains no Rockstar or Cfx.re brand assets.
Why this exists
FiveM answers are often technically plausible but wrong for the target product, runtime, API set, artifact, or gamebuild. Legacy guidance and third-party framework assumptions can make that worse. This project provides a deliberately narrow context layer that:
distinguishes GTAV Enhanced behavior from Legacy behavior;
resolves natives by exact name or hash and preserves client/server scope;
cites official Cfx.re or Rockstar-controlled sources directly;
validates resource structure, manifests, events, State Bags, and NUI targets;
treats remote content as untrusted data;
requires runtime evidence before calling code performant.
The MCP server supplies facts and diagnostics. The host agent still writes and edits code. v0.1 does not generate code, modify project files, administer a server, deploy resources, or download FiveM artifacts.
Related MCP server: mcdev-mcp
Product boundary
Included | Intentionally excluded |
FiveM for GTAV Enhanced | FiveM Legacy and RedM |
Framework-neutral resources | ESX, QBCore, ox_lib, and other frameworks |
Client, server, shared, and NUI facts with explicit scope | Marketplace, escrowed, paid, leaked, or private resources |
Official documentation, native declarations, and source metadata | Game assets, artifact binaries, and server administration |
Read-only reviews and cache refresh | Code generation, filesystem changes, deployment, and administration |
See ADR 0001 for the rationale.
Quickstart
Requirements
Node.js 22 or newer
npm 10 or newer
Git
A current Docker Desktop installation with MCP Toolkit enabled is optional for container or Docker MCP Gateway usage.
Run from source
git clone https://github.com/ghost-maxi/fivem-enhanced-mcp.git
cd fivem-enhanced-mcp
npm ci
npm run build
npm startThe server communicates over stdio. Standard output is reserved for MCP
messages.
On Windows, use npm.cmd if PowerShell blocks npm.ps1.
Connect to Codex
Add the GitHub-backed marketplace and install the bundled plugin:
codex plugin marketplace add ghost-maxi/fivem-enhanced-mcp
codex plugin add fivem-enhanced-mcp@fivem-enhancedAlternatively, build the project and register the absolute path to the compiled entry point:
codex mcp add fivem-enhanced -- node /absolute/path/to/fivem-enhanced-mcp/dist/index.cjs
codex mcp listRestart the Codex app after changing MCP configuration. For the intended
workflow, the plugin bundles the fivem-enhanced-engineering Codex skill with
the MCP server. The skill guides source verification and review; the server
provides typed evidence.
Run with Docker
docker build -t fivem-enhanced-mcp:local .
docker run --rm -i \
--read-only \
--tmpfs /tmp \
--mount source=fivem-enhanced-cache,target=/data/cache \
--env FIVEM_ENHANCED_MCP_CACHE_DIR=/data/cache \
fivem-enhanced-mcp:localOr use the checked-in Compose definition:
docker compose run --rm fivem-enhanced-mcpUse Docker MCP Gateway
Docker MCP Toolkit supports local YAML server descriptors. From the repository root:
docker build -t fivem-enhanced-mcp:local .
docker mcp profile create --name fivem-enhanced --server docker://fivem-enhanced-mcp:local
docker mcp gateway run --profile fivem_enhanced --dry-run
docker mcp client connect codex --global --profile fivem_enhancedReview the dry-run output before connecting. Keep this profile limited to the expected server. See the full Docker MCP Gateway runbook.
Configuration
All settings are optional:
Variable | Purpose | Default |
| Local normalized source cache | Platform cache directory |
| Official-source request timeout |
|
MCP tools in v0.1
Tool | Purpose | Effect |
| Search allowlisted official Enhanced documentation with scope and citations | Read-only |
| Resolve an exact native name or hash without guessing missing definitions | Read-only |
| Retrieve the dated Enhanced capability baseline and required context | Read-only |
| Report the source-backed CEF/Chromium target and its evidence scope | Read-only |
| Check supplied NUI source against the live verified browser milestone | Read-only |
| Validate manifest entries, dependencies, runtime constraints, and deprecations | Read-only |
| Review a supplied resource tree against framework-neutral boundaries | Read-only |
| Detect client-trust and network-event security risks | Read-only |
| Detect replication and serialization hazards in supplied usage | Read-only |
| Produce a reproducible profiler, resmon, network, and NUI measurement plan | Read-only |
| Report freshness and failures for sources checked by this process | Read-only |
| Refresh only the local source cache from allowlisted official origins | Cache write only |
Analysis tools do not modify the user's repository. refresh_sources is the
only tool that writes, and its write boundary is the configured cache directory.
Results use explicit states such as verified, inferred, ambiguous,
conflict, stale, and not_found, with direct source URLs and scope
metadata.
Architecture
flowchart LR
Host["Codex or another MCP host"]
Skill["Enhanced engineering skill"]
Server["Typed MCP tools over stdio"]
Domain["Enhanced-only domain services"]
Index["Exact native lookup + weighted docs search"]
Cache["Provenance-aware local cache"]
Official["Allowlisted official sources"]
Result["Status + scope + citations"]
Host --> Skill
Host --> Server --> Domain
Domain --> Index --> Cache
Cache <--> Official
Domain --> Result --> HostExact native identifiers take precedence over full-text search. Source updates are validated before replacing the last known-good cache. Remote documents are data, never instructions.
Current v0.1 limits
Original GTA V natives are resolved by exact name or hash from the official client-native JSON.
CFX declarations are resolved by exact name and preserve their declared API set. If the declaration does not publish a hash, the MCP returns no hash instead of deriving one.
Official-document search covers the focused Enhanced engineering corpus listed in the source policy; it is not a general web search.
Static validators are heuristics. A clean result does not replace FiveM, browser, profiler, resmon, or security testing.
The embedded Enhanced capability baseline becomes
staleafter 30 days and must then be checked against current official documentation.
Read the full architecture and source policy.
Sources and licensing
Canonical inputs include:
The repository's MIT License applies only to this project's original code and documentation. It does not relicense FiveM, GTA, official documentation, native corpora, or third-party content. Because several official source repositories do not expose a repository-wide license, this project references or locally caches necessary data at runtime and does not vendor or redistribute those corpora.
Marketplace, Asset Escrow, paid, leaked, and private resources are excluded. See the Source Policy and the current Creator Platform License Agreement.
Development
npm ci
npm run format:check
npm run lint
npm run typecheck
npm test
npm run test:coverage
npm run build
npm run plugin:validate
npm run smoke:mcpRun every check with:
npm run validateBehavioral changes need tests for success, ambiguity, conflict, stale data, and failure paths. Performance claims need reproducible runtime evidence.
Contributing and security
Read CONTRIBUTING.md before opening a pull request.
Report vulnerabilities privately according to SECURITY.md.
Review notable changes in CHANGELOG.md.
Use GitHub Issues for non-sensitive defects and proposals.
License
Original project code and documentation are available under the MIT License.
Available Tools
12 toolsaudit_nui_compatibilityAudit NUI compatibilityARead-only
Load FiveM's current CEF pin, then statically audit JavaScript, TypeScript, JSX, TSX, or CSS against that verified Chromium milestone. This is a heuristic build-time review, not a runtime browser test.
| Name | Required | Description | Default |
|---|---|---|---|
| loader | Yes | ||
| source | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| scope | Yes | |
| status | Yes | |
| sources | Yes | |
| summary | Yes | |
| findings | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only/harmless behavior. The description adds valuable behavioral context: it loads FiveM's current CEF pin, statically audits code, and is heuristic rather than authoritative. This goes beyond the annotations without contradicting them, though it doesn't detail return values or edge cases.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences, front-loaded with the core action ('Load... then statically audit'). Every word earns its place; no fluff or repetition of schema details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema, annotations, and sibling context, the description fully covers the tool's purpose and its constraints. It clarifies the heuristic nature and the dependency on FiveM's CEF pin, making it complete for an AI agent to make an informed invocation decision.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description compensates by enumerating the supported file types (JavaScript, TypeScript, JSX, TSX, CSS), which directly maps to the 'loader' enum. The 'source' parameter's purpose is clear from the audit context, even if not spelled out explicitly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('audit') and a clear resource ('NUI compatibility' with supported file types). It distinguishes itself from sibling tools by specifying that it loads FiveM's CEF pin and performs a static, build-time review rather than a runtime test.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly frames when to use the tool: for static, build-time compatibility checks against the verified Chromium milestone. It explicitly excludes runtime browser testing, which helps differentiate from possible runtime test tools, though it does not name specific sibling alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_performance_test_planCreate a FiveM performance test planARead-only
Create a reproducible measurement plan using profiler, resmon, network, or NUI evidence. It never claims a speedup without measurements.
| Name | Required | Description | Default |
|---|---|---|---|
| runtime | Yes | ||
| scenario | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| scope | Yes | |
| status | Yes | |
| sources | Yes | |
| summary | Yes | |
| findings | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds a meaningful behavioral trait: 'It never claims a speedup without measurements,' which sets expectations for evidence-based output. This goes beyond the annotations by specifying a policy.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the verb and object. Every word provides value: the evidence types and the no-speedup claim. No fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has only two parameters and an output schema, so return values are covered. However, the description lacks guidance on what constitutes a valid 'scenario' or how 'runtime' influences the plan. This creates a gap in fully supporting a correct invocation, though the low complexity keeps it from being critically incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate by explaining parameters. However, it does not mention 'scenario' or 'runtime' at all. The enum values for runtime are self-explanatory, but 'scenario' is undefined beyond a length constraint, leaving the agent to guess its meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('Create') and resource ('reproducible measurement plan'), and specifies the evidence types (profiler, resmon, network, or NUI). This distinguishes it from sibling tools like get_native or audit_nui_compatibility, which serve different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for creating a measurement plan but does not explicitly state when to use this tool over siblings or mention any exclusions. The phrase 'Create a reproducible measurement plan...' indicates the context, but no alternatives or prerequisites are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_cef_targetGet current FiveM CEF targetARead-only
Read and parse the current CEF/Chromium build pin from the official FiveM repository. Use before choosing an NUI browser target.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| scope | Yes | |
| status | Yes | |
| sources | Yes | |
| summary | Yes | |
| findings | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds that it reads from the official FiveM repository and parses the build pin, but does not disclose additional behaviors such as network access, caching, or rate limits. It provides minimal extra value beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, with the action and resource stated first, followed by a practical usage hint. Every word earns its place with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only tool with no parameters and an output schema present, the description provides the essential information: what it does and when to use it. No important gaps are apparent, and the context is fully adequate for the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so there are no parameter semantics to explain. The baseline for 0-parameter tools is 4, and the description properly avoids unnecessary parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Read and parse' and identifies the exact resource: 'the current CEF/Chromium build pin from the official FiveM repository'. This clearly distinguishes it from sibling tools like audit_nui_compatibility or get_native, which serve different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The instruction 'Use before choosing an NUI browser target' provides a clear and explicit usage context. It does not mention alternatives or exclusions, but for a 0-parameter read-only getter, this is sufficient guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_nativeGet an exact FiveM nativeARead-only
Look up an exact native name or hash in official sources. The caller must provide the execution API set; unknown identifiers return not_found.
| Name | Required | Description | Default |
|---|---|---|---|
| kind | Yes | ||
| apiSet | Yes | ||
| identifier | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| scope | Yes | |
| status | Yes | |
| sources | Yes | |
| summary | Yes | |
| findings | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate a safe read operation. The description adds valuable behavioral context: 'unknown identifiers return not_found' and the requirement to specify the API set, which are not covered by annotations. No contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core action, and every word contributes. It is concise without being under-specified.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with an output schema, the description adequately explains the lookup purpose, required disambiguation (apiSet), and error behavior (not_found). It could go deeper on case sensitivity or exact matching rules, but the essentials are covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description partially compensates by clarifying 'identifier' as a native name or hash and 'apiSet' as the execution API set. However, it does not explicitly address the 'kind' parameter, though the name/hash enum is implied. Some meaning is added, but not fully.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Look up' and names the resource ('exact native name or hash') and source ('official sources'). It distinguishes itself from the sibling 'search_fivem_docs' by emphasizing exact lookup rather than search.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for exact native lookup and notes a requirement (must provide execution API set), but it does not explicitly mention when to prefer this tool over alternatives like search_fivem_docs, nor does it state any exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_platform_capabilitiesGet GTAV Enhanced capabilitiesARead-only
Return the verified GTAV Enhanced baseline and the context that must be known before writing code.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| scope | Yes | |
| status | Yes | |
| sources | Yes | |
| summary | Yes | |
| findings | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, and the description does not contradict them. It adds the context that the result is 'verified' and intended as pre-coding knowledge, but it does not disclose additional behavioral traits such as whether it performs version checks or network calls. With annotation coverage, a score of 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one clear, front-loaded sentence that efficiently states the purpose and usage context without any filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no parameters and an output schema exists, so the description does not need to explain return values. The description adequately conveys the tool's role as a pre-coding baseline provider. It could elaborate on what the baseline includes, but given the presence of an output schema and low complexity, it is sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool accepts zero parameters, so the input schema fully covers parameter semantics. The description does not need to elaborate on parameters, and the baseline for 0 params is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'Return[s] the verified GTAV Enhanced baseline and the context that must be known before writing code.' The verb 'Return' and resource are specific, and the purpose is distinct from sibling tools like search_fivem_docs or get_native. Slight vagueness in 'baseline' prevents a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context with 'before writing code,' suggesting when to call this tool. However, it does not explicitly compare with alternatives or state when not to use it, which limits the guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
refresh_sourcesRefresh official source cacheAIdempotent
Explicitly refresh the local cache from allowlisted official Cfx.re and citizenfx sources. It does not modify any FiveM project or external service.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| scope | Yes | |
| status | Yes | |
| sources | Yes | |
| summary | Yes | |
| findings | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnlyHint=false, idempotentHint=true, destructiveHint=false), the description adds valuable context: it explicitly states the tool refreshes from allowlisted official sources and that it does not alter FiveM projects or external services. This clarifies that the only mutation is to the local cache, providing a complete safety profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loads the primary action ('Explicitly refresh'), and includes only relevant information. Every word serves a purpose, with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with an output schema present, the description is entirely sufficient. It covers what the tool does, the sources it uses, and its non-destructive nature. There is no additional complexity that requires further explanation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is nothing for the description to explain. The schema coverage is trivially 100%, and no parameter information is needed. The description adds no parameter details, but that is appropriate given the input schema is empty.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: explicitly refreshing the local cache from allowlisted official Cfx.re and citizenfx sources. It uses a specific verb (refresh) and identifies the resource (local cache) and the sources, distinguishing it from sibling tools like source_health or get_native. The additional clarification that it does not modify any FiveM project or external service further disambiguates its scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when a cache refresh is needed, but it does not explicitly state when to use this tool versus alternatives such as source_health, or mention any prerequisites or exclusions. No alternative tools are referenced, so guidance is limited to the implied context of manual cache refresh.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
review_event_securityReview FiveM event securityARead-only
Perform a static heuristic review of supplied code for untrusted network input, broadcasts, unstable source usage, and event-context mistakes.
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | ||
| language | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| scope | Yes | |
| status | Yes | |
| sources | Yes | |
| summary | Yes | |
| findings | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the description adds the 'static heuristic' nature and specific review focus, which goes beyond the annotations. It does not contradict annotations and provides useful context about the review's scope and limitations (heuristic implies possible false positives).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that front-loads the action and lists the specific review aspects. No redundant words or filler, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema and annotations covering safety, the description is complete enough for the tool's purpose. It conveys the scope (static heuristic review) and the specific security concerns, though it could add a brief mention of the language parameter or typical use case, but these are not critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for parameter meanings. It references 'supplied code' (implying the 'code' parameter) but does not explain the 'language' parameter at all. The description adds minimal value beyond the schema's enum values, leaving the language parameter's role ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: performing a static heuristic review of supplied code for specific security issues (untrusted network input, broadcasts, unstable source usage, event-context mistakes). This specific verb+resource+scope distinguishes it from sibling tools like review_resource_structure and review_state_bag_usage, which focus on different aspects.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used when a user wants to review code for security concerns, but it does not explicitly state when to use it versus alternatives or mention any exclusion criteria. Unlike a high-scoring example, it lacks explicit 'when to use' or 'use instead' guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
review_resource_structureReview a resource structureARead-only
Review a supplied resource file list against the documented FiveM requirements and this project's explicit client/server/shared/NUI house standard.
| Name | Required | Description | Default |
|---|---|---|---|
| paths | Yes | ||
| uiRequired | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| scope | Yes | |
| status | Yes | |
| sources | Yes | |
| summary | Yes | |
| findings | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds useful context by specifying that the review checks against 'documented FiveM requirements' and the 'client/server/shared/NUI house standard', giving the agent a sense of what criteria are applied. It does not mention side effects, rate limits, or auth, but the non-destructive nature is reinforced by the verb 'Review'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that leads with the action verb 'Review' and the object, followed by the criteria. There is no redundant phrasing, and every word contributes to the meaning. It is appropriately sized for the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that an output schema exists (so return values need not be described) and annotations cover safety, the description is largely complete. It conveys the tool's purpose, what it checks against, and the target audience (project-specific standards). However, the lack of parameter semantics and explicit usage guidance leaves minor gaps, but overall it is sufficient for a review tool with a clear scope.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explicitly explain the parameters. 'paths' is only vaguely implied by 'resource file list', and 'uiRequired' is only hinted at via 'NUI house standard'. The description fails to compensate for the lack of schema descriptions, leaving the agent to infer the meaning and format of the inputs, especially the boolean 'uiRequired' flag.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('Review') and resource ('supplied resource file list'), and specifies the criteria ('documented FiveM requirements and this project's explicit client/server/shared/NUI house standard'). This distinguishes it from sibling tools like validate_fxmanifest (which likely validates manifest syntax) by focusing on structural review against both external and project-specific standards.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool: when you need to check a resource file list against FiveM requirements and the project's house standard. It does not explicitly name alternatives or exclusions, but the scope is clear enough to differentiate from sibling tools like review_event_security or validate_fxmanifest. It lacks explicit 'use this instead of X' guidance, but the context is sufficiently defined.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
review_state_bag_usageReview State Bag usageARead-only
Perform a static heuristic review for nested State Bag serialization, scope-event scaling, and client replication risks.
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | ||
| language | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| scope | Yes | |
| status | Yes | |
| sources | Yes | |
| summary | Yes | |
| findings | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds the 'static heuristic' nature, indicating analysis without execution, and lists the specific risk categories it checks. This provides behavioral context beyond the annotations, though it does not detail the output format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that efficiently conveys the action and the three review focus areas without unnecessary words or repetition. It is concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has an output schema (not shown), so return values are presumably documented there. The description clearly scopes the review to three risk areas and implies a code context via the language parameter. However, it does not explicitly mention that the code should be for a specific platform or that input code must be provided, though these are inferable from the sibling tools and schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, and the description does not mention the parameters 'code' or 'language' at all. The parameter names are somewhat self-explanatory, but the description fails to explain that 'code' is the source code to review and 'language' selects the language-specific parser. This is a notable gap given the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Perform') and resource ('State Bag usage') with three concrete focus areas: nested State Bag serialization, scope-event scaling, and client replication risks. This clearly distinguishes it from sibling tools like review_resource_structure or audit_nui_compatibility, which target broader or different concerns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for code review related to State Bags, but it does not explicitly state when to use this tool versus alternatives or provide exclusions. The focus on State Bag risks provides clear context, but there is no direct guidance on selecting it among sibling review tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_fivem_docsSearch official FiveM docsARead-only
Search a focused corpus loaded from official Cfx.re documentation. Use for GTAV Enhanced resource, runtime, NUI, networking, security, and performance questions.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| scope | Yes | |
| status | Yes | |
| sources | Yes | |
| summary | Yes | |
| findings | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=true, and destructiveHint=false, so the safety profile is covered. The description adds that the search is over a 'focused corpus' and from 'official Cfx.re documentation,' which is useful context. But it does not disclose other behavioral traits like return format, pagination, or rate limits. This aligns with the baseline where annotations carry safety and the description contributes minimal extra behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, front-loaded with the core action. Every word earns its place, and the structure is easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is a simple search over a specified corpus, and the description covers purpose, scope, and usage topics. With safe annotations and an output schema present, this description is sufficient for an agent to select and invoke the tool correctly without additional context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents both parameters with constraints (query: minLength/maxLength; limit: default/min/max). The description does not explain parameter semantics further, and schema coverage is 0%. While the parameter names are intuitive for a search tool, the description adds no value beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Search a focused corpus loaded from official Cfx.re documentation' with a specific verb (search) and resource (focused corpus). It also differentiates from siblings by specifying the domain (GTAV Enhanced, runtime, NUI, etc.), making it distinct from other tools like get_native or validate_fxmanifest.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit usage context: 'Use for GTAV Enhanced resource, runtime, NUI, networking, security, and performance questions.' This tells the agent when to invoke the tool. However, it does not mention when not to use it or mention alternative tools, so it is slightly below the highest bar.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
source_healthReport official source healthARead-only
Report freshness, cache state, and errors for official sources checked by this MCP process.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| scope | Yes | |
| status | Yes | |
| sources | Yes | |
| summary | Yes | |
| findings | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds specific behavioral context by listing what is reported (freshness, cache state, errors), which aligns with read-only status and no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with the verb 'Report' and no filler. Every word adds value, making it appropriately sized and structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple status-reporting tool with no parameters, a read-only annotation, and an output schema, the description is complete enough. It states the subject and key report aspects. Minor gaps exist (e.g., when to use vs. refresh_sources), but complexity is low.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the description cannot add parameter meaning. Per baseline for 0-param tools, this is a 4. The description fully explains what the tool does without needing parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Report' with resource 'official sources' and scope 'checked by this MCP process.' It clearly distinguishes this from the sibling refresh_sources, which implies updating rather than reporting status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use guidance or alternative comparison is provided. The context implies a reporting/status role, but there is no mention of how it relates to refresh_sources or when one would prefer this over other tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
validate_fxmanifestValidate fxmanifest.luaARead-only
Validate supplied fxmanifest.lua text for current Enhanced-only resource rules, compiled script outputs, NUI packaging, and deprecated or experimental fields.
| Name | Required | Description | Default |
|---|---|---|---|
| manifest | Yes | ||
| resourceFiles | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| data | No | |
| scope | Yes | |
| status | Yes | |
| sources | Yes | |
| summary | Yes | |
| findings | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds value by disclosing the specific rule categories checked (Enhanced-only, compiled outputs, NUI packaging, deprecated/experimental fields), which goes beyond the annotations. No contradictions found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that immediately states the purpose and lists specific validation aspects without any redundant phrasing. Every word contributes meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (validation with one required and one optional parameter), the description covers the core behavior and validation categories. The presence of an output schema and annotations compensates for lack of return detail. However, the unexplained 'resourceFiles' parameter prevents a perfect score.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description only explains the 'manifest' parameter implicitly via 'supplied fxmanifest.lua text'. It does not explain 'resourceFiles' at all, leaving a significant gap for the optional array parameter. Even though there are only two parameters, half are undocumented in both schema and description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses a specific verb ('Validate') with a distinct resource ('supplied fxmanifest.lua text') and enumerates specific validation dimensions (Enhanced-only rules, compiled script outputs, NUI packaging, deprecated/experimental fields). This clearly distinguishes it from sibling tools like audit_nui_compatibility or review_resource_structure.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly communicates when to use this tool by listing the exact validation criteria, which aligns with validating a manifest before deployment. It does not explicitly name alternatives or exclusions, but the scope is clear enough to guide tool selection among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
12 tool updates
v0.1.0- First observed
audit_nui_compatibility - First observed
create_performance_test_plan - First observed
get_cef_target - First observed
get_native - First observed
get_platform_capabilities - First observed
refresh_sources - First observed
review_event_security - First observed
review_resource_structure - First observed
review_state_bag_usage - First observed
search_fivem_docs - First observed
source_health - First observed
validate_fxmanifest
TDQS
Most tools have clearly distinct purposes: search, native lookup, platform info, CEF pin retrieval, NUI audit, manifest validation, resource structure review, security review, state bag review, performance planning, and source health. The overlap between audit_nui_compatibility and get_cef_target is minimal since one is informational and the other performs a full audit, and review_resource_structure vs validate_fxmanifest target different artifacts.
The majority of tool names follow a verb_noun pattern (search_fivem_docs, get_native, validate_fxmanifest, review_event_security, refresh_sources), but a few deviate, such as source_health (noun_verb) and audit_nui_compatibility (uses 'audit' instead of 'review'). Overall the pattern is mostly consistent and readable.
12 tools is well within the ideal 3-15 range and each tool serves a specific part of the FiveM development workflow. The count feels appropriately scoped for a specialized MCP server covering documentation, native reference, platform capabilities, code review, security analysis, performance testing, and source cache management.
The tool surface covers the core workflows for a FiveM development assistant: searching docs, looking up natives, checking platform baseline, auditing NUI compatibility, validating manifests, reviewing resource structure/security/state bags, creating performance test plans, and managing source freshness. Minor gaps exist such as no direct code generation or runtime debugging, but these are outside the apparent scope.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
RedM / RDR3 docs MCP server: native lookups, semantic search, VORP, RSGCore, oxmysql.
MCP server for developer documentation, generated by doc2mcp.
MCP server for dev documentation, generated by doc2mcp.
MCP server for doc2mcp documentation, generated by doc2mcp.
Related MCP Servers
- AlicenseBqualityDmaintenanceProvides comprehensive access to MCP documentation through structured guides, full-text search, and interactive development workflows for building servers and clients.337MIT
- AlicenseAqualityAmaintenanceAn MCP server that empowers AI coding agents to work effectively with Minecraft mod development, providing static analysis of decompiled source code and runtime interaction with a running Minecraft instance.314413MIT
- FlicenseBqualityBmaintenanceMCP server for searching, browsing, and analyzing decompiled Minecraft source code locally. Supports symbol lookup, text search, reference lookup, and lightweight RAG.11-
- AlicenseBqualityCmaintenanceA focused MCP server for FiveM teams to scaffold resources, generate NUI templates, and perform safe file edits.11181MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/ghost-maxi/fivem-enhanced-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server