What is 5m-mcp?

5m-mcp ships a single FiveM resource — named agent_api once installed — that exposes a Model Context Protocol (MCP) server. Once installed and started, any MCP-aware coding agent — Claude Code, Codex CLI, Cursor, Cline, your own — can:

• read and write resource files within a sandboxed root
• create, ensure, start, stop, restart, refresh resources
• capture console output around any command
• invoke any FiveM server native and any FiveM client native (on opted-in test subjects)
• talk to ESX, ox_lib, oxmysql via dedicated tools or reflective *_call_* dispatchers
• spawn allowlisted shell commands (npm, npx, pnpm, vite, git, node) inside a resource folder — so the agent can npx create vite then npm run build an entire UI tree
• screenshot the NUI through CEF's DevTools Protocol, with the option to isolate a specific resource's iframe

Everything runs in-process inside the FiveM server's CitizenJS runtime. No external Node sidecar, no Docker, no extra service to keep alive.

Why it exists

LLM agents are good at writing code. They're bad at running it against a stateful runtime with strong opinions — and FiveM is exactly that runtime. The friction loop without agent_api looks like:

1. Agent writes a Lua file in your editor.
2. You alt-tab to txAdmin and ensure the resource.
3. You alt-tab back to chat to paste the console output.
4. You paste a screenshot of the bug.
5. Repeat.

With agent_api, the agent itself does steps 2 through 4:

1. write_file → file lands inside the resource folder.
2. ensure_resource → console lines captured and returned in the same envelope.
3. screenshot_nui → PNG saved, agent reads it directly.

You stay in the conversation; the agent stays at the wheel.

Design tenets

• One resource. No sidecar process, no extra port to open, no daemon to babysit.
• Safe by default. Token-gated, readonly verb heuristic on every reflective call, hard blocklist for DropPlayer/ExecuteCommand/StopResource, sandboxed write roots, per-resource lock on mutators.
• Stable surface. New tools add a file under src/server/tools/; new plugins add a folder under src/server/plugins/. The error code enum is append-only.
• Plugin-first for frameworks. Every supported framework lives behind a Plugin that auto-detects via GetResourceState and registers its own tools. Adding QBCore or whatever comes next is a single folder + one push to ALL_PLUGINS.

What it is not

• Not a generic FiveM admin panel. Use txAdmin for human admin work.
• Not a way to bypass a server's permissions. ACE rules still apply.
• Not a replacement for source control. It writes into resource folders; commit them separately.
• Not a license workaround. The PolyForm Noncommercial 1.0.0 license means non-commercial use only.