DevTools

DevTools can execute submitted server-side code and therefore have the same authority as the gamemode process. They are disabled by default.

json

{
  "devtools": {
    "enabled": false,
    "allowed_social_clubs": [],
    "allowed_names": [],
    "allow_localhost": true,
    "max_code_bytes": 65536
  }
}

For a development server, enable the feature only with a narrow identity allowlist. A player name is presentation data, so prefer stable Social Club identifiers when possible. allow_localhost permits local access and should not be interpreted as protection when untrusted users can run processes on the same host.

Never enable unrestricted DevTools on a public production server. DevTools code can read server files, access environment secrets, mutate entities, call Node APIs, and terminate the process.

max_code_bytes limits submitted source size; it is not a security sandbox. Record administrative use in your operational logs.

DevTools ​

DevTools