RCO Admin Menu is a commercial admin toolkit built natively for RedM — fifty-seven server-validated actions inside a React NUI styled like an RDR2 administration ledger.

Watch the showcase

What it offers

React Admin Panel — Western-Themed, Permission-Aware

Nine sidebar views with dedicated icons: Status, Player, Teleport, Troll, World, All Players, Utility, Vehicles, and Favorites. Views with zero available commands hide automatically — moderators never see empty tabs.

The panel supports wide mode (persisted in localStorage), global search per view, accordion command cards with staggered open animations (~280ms close transition), and star favorites saved client-side. Toggle commands show live ON/OFF badges on the card header; instant commands run on click; destructive actions require inline confirm dialogs (Kick All, Unban, Delete All Vehicles).

Every command ships with a localized label and description rendered as card subtitle. Field types include:

• Player picker — searchable popup portal with ID + character name + session name
• Searchable selects — items, jobs, peds (~1,293), vehicles (77), horses, stables, weather, bans, towns
• Dependent fields — job grade dropdown repopulates when job changes
• Choice buttons — vec2 / vec3 / vec4 coord format
• Number inputs with min/max from server config

Results render inline under the command: player info cards, inventory snapshots, updated money balance, freeze/spectate/toggle state, copied coordinates, or localized error strings — no guessing if it worked.

Live Server Status Dashboard

The Status view shows online / max slots, free slots, detected framework (RSG or VORP), server uptime, resource version, and a searchable player list with server ID, Rockstar session name, character name, and character ID. Refresh re-fetches players, status, catalog, and toggle states without closing the menu.

Player Management — Full Staff Toolkit

Kick — disconnect with required reason; formatted drop card shows admin name + reason (+ optional Discord link).

Info — server-authoritative snapshot: session ID, session name, character name, character/citizen ID, job + grade, VORP group fields, and every money account for the active framework (RSG: cash, all bank branches, blood money; VORP: money, gold, rol).

Go to / Bring / Send back — teleports use server-resolved coordinates (GetPlayerPed + GetEntityCoords under OneSync). Bring and goto remember the admin's previous position; send back restores the target's saved position from before their last admin teleport.

Spectate — toggle NetworkSetInSpectatorMode on the selected player. Re-click same target to stop. Target disconnect auto-stops spectate for every watching admin.

Freeze — server-side toggle; frozen state tracked per player and cleared on disconnect.

Revive / Heal — framework-aware. RSG routes through rsg-medic when started; VORP uses core medical APIs. Revive triggers a client post-medical visibility restore flow so ped/clothing state stays clean.

Respawn — VORP-only full respawn flow.

Economy & Inventory

Give / Remove money — pick account from framework-specific list, amount 1–1,000,000. Server validates account exists, player loaded, sufficient funds on remove. Returns authoritative new balance in the UI. Per-target money locks prevent race duplicates.

Give item — live-searchable item list built from RSGCore.Shared.Items (RSG) or VORP inventory index. RSG checks CanAddItem before adding. Optional ItemAllowlist in config filters the dropdown. Per-target item locks.

Open inventory (RSG) — opens target's rsg-inventory through the bridge.

View inventory (VORP) — read-only server snapshot displayed inline in the menu (item label × count); no client trust.

Give weapon / Clear items / Clear weapons (VORP) — full weapon and inventory wipe/grant through vorp_inventory.

Moderation, Bans & Access

Ban — target online player; duration units: hours, days, months, or permanent. Reason required (max 200 chars). Persists through each framework's native ban path (RSG ban table / VORP vorpbans). Drop card shows admin, reason, duration label, Ban ID, and configurable Discord invite URL.

Unban — searchable dropdown populated from live database ban list (not online players). Confirm dialog before removal.

Set job — runtime job list merged from framework + config defaults. Searchable job picker; grade dropdown depends on selected job. VORP supports optional custom job label field.

Set group (VORP) — set user/character group with configurable character vs user group behavior.

Whitelist / Unwhitelist (VORP) — add or remove identifiers from VORP whitelist by steam/license string.

Set Ped — 1,293 Human NPCs + MySQL Persistence

Swap any player to one of ~1,293 searchable human NPC models from the open human_peds.lua, or restore MP Freemode Male/Female clothing through rsg-appearance / vorp_character.

RDR3-specific ped handling: captures meta outfit hash before swap, reapplies via _EQUIP_META_PED_OUTFIT so NPCs don't spawn invisible, waits for IsPedReadyToRender.

Persistent mode writes model to MySQL table rco_adminmenu_peds keyed by framework + character ID. On login, server re-applies after configurable delay (SetPedApplyDelayMs). Model validated server-side against the allowlist — clients cannot inject arbitrary hashes.

Horses & Wagons

Give horse (RSG + VORP) — searchable breed list from rsg-horses/shared/horse_settings.lua when available, custom model fallback, name + sex picker. RSG adds stable selector aligned to rsg-horses stable IDs (Valentine, Rhodes, Saint Denis, Blackwater, Strawberry, Tumbleweed, Van Horn, Colter, Emerald Ranch — all configurable).

Give wagon (VORP) — insert into vorp_stables or legacy horse/wagon tables (Config.VorpStable toggle).

Teleport Suite — With Position Memory

• Teleport to waypoint (TPM) — screen fade, ground Z lookup, auto noclip exit, PlaceEntityOnGroundProperly
• Teleport to coords — validated X/Y/Z ranges (±100,000)
• Teleport to location — ten preconfigured towns (Valentine, Rhodes, Saint Denis, Blackwater, Strawberry, Armadillo, Tumbleweed, Annesburg, Van Horn, Emerald Ranch) — all editable in config; coords never come from the client
• Return — go back to position saved before your last goto/bring/TPM/location teleport
• Send back — restore a brought player's saved position

World Control — Weather, Time, Names & Global Blips

Show Names — 3D draw-text above every player currently in client OneSync scope ([ID] Name format).

Show Blips — server thread iterates all online players, reads authoritative coords, pushes snapshot to every admin with blips enabled. Updates every 500–3000ms (configurable). Creates/updates/removes map blips with player labels. 128 blip cap. Designed for OneSync: clients cannot see out-of-scope players locally, so blips are server-driven.

Set weather — 21 types (sunny through sandstorm) via weathersync with configurable transition seconds. Optional freeze weather cycle.

Set time — hour (0–23) + minute (0–59) with optional freeze clock. Smooth time transition configurable separately from weather.

Vehicle Spawner — Tracked, Networked, OneSync-Safe

77-model allowlist — buggies, carts, stagecoaches, chuckwagons, supply/log/oil/coal wagons, police/prison/armoured/war wagons, circus/dairy/doc/traveller/work wagons, handcart, canoes, rowboats, skiffs, keelboats, steam boats, tug boats, smuggler, hot-air balloon, and field guns (breach cannon, gatling, maxim, hotchkiss). Trains deliberately excluded — they break under OneSync.

Spawn flow:

1. Server issues time-limited token (20s expiry)
2. Client spawns networked vehicle in front of admin with optional draft horses (bDontAutoCreateDraftAnimals = false)
3. Client reports netId back; server validates token, creator, entity model hash
4. Entry added to server registry with creator name/session

Seat option: warp in or spawn outside. Dedicated Vehicles panel lists every tracked spawn with model label, creator, delete button, refresh, and delete all with confirmation. Configurable server cap (default 48). Creator disconnect marks entries offline but keeps history until deleted.

Freecam — Dedicated Cinematic Mode

Not noclip with a camera glued on — a separate scripted camera with the admin ped frozen in the world.

• WASD move, mouse look, Shift/Ctrl vertical, RMB boost
• Scroll FOV (20°–90°), Q/E or [/] speed with Cfx key mappings (+rcoadm_fcfast/slow)
• H toggles framework HUD hide (rsg-hud, rco-hud, or vorp_metabolism through bridge)
• X minimizes overlay to compact pill
• ESC requests server-side deactivation (authority, not client-only cheat)
• Streaming focus follows camera when far from ped
• Closes admin UI when activated
• Mutually exclusive with noclip
• Live overlay: speed, FOV, control legend, HUD state

Uses GET_CAM_MATRIX extra-native with Euler fallback for RedM compatibility.

Noclip — RedM-Aware Flight

Ped hidden locally (alpha 0 + SetPlayerInvisibleLocally) with all slung weapon entities on attach points 0–29 hidden — SetEntityVisible alone is not enough on RDR3. Weapon wheel blocked while active. Scroll-wheel speed (0.2–50). Gravity disabled in-flight. On exit: 10-second fall protection (configurable NoclipExitProtectMs) unless godmode already active. Live speed/control overlay.

Admin Self-Utilities

Godmode — server-granted invincibility toggle.

Invisibility — local ped + weapon hide (same RDR3-aware path as noclip).

Copy coords — vec2 / vec3 / vec4 from server-read position + heading; CEF-safe clipboard via hidden NUI textarea (works inside RedM CEF where navigator.clipboard fails).

Announce — server-wide "Government announcement" banner: SVG crest frame, brass wings, animated progress bar, configurable duration 3–120 seconds. Broadcast to every connected client independent of the admin menu being open.

Troll Toolkit — Seven Targeted Effects

All server-initiated on a selected player:

Durations and stamina delta live in open Config.TrollEffects.

Mass Actions — Elevated Permission Gate

Kick All — disconnect every other player with configurable mass reason; confirm dialog; 5s rate limit; mass lock.

Bring All — teleport everyone else to admin's server coords; saves each player's previous position first.

Revive All / Heal All — iterate all online players; count successes returned to UI.

All four require elevated permission: RSG ACE god (default) or VORP admin group (Config.VorpElevatedGroup). Individual ACE per command still applies on RSG.

Commercial Security Architecture

Built for hostile clients, modified NUIs, and spammed network events:

• source captured before any yield in every server handler
• Payload rejects client-supplied source, playerId, identifier
• Dynamic catalog — UI only receives commands the server confirms you may run
• Schema validation per command — types, ranges, allowlists, select option membership, unexpected field rejection
• Per-command rate limits (ms) — money/items/ban/spawn/mass ops individually tuned; 0 = unlimited where safe
• Per-player locks — money, items, ban, spawn, ped, horse, wagon, mass operations
• Request/response with unique requestId; 8-second server timeout; client timeout mirror
• Spawn anti-cheat — server token, expiry, netId + model hash verification
• Teleport authority — all coords from server-side ped reads
• Toggle state — godmode, noclip, freecam, names, blips stored server-side; client applies only after grant
• Fail closed — no permission → deny; character not loaded → deny menu open
• Cleanup — playerDropped clears locks, toggles, spectate, pending spawns; onResourceStop wipes all admin state and deletes tracked vehicles

Startup fail-fast validation — broken config, missing NUI build, invalid locale name → resource errors immediately with clear message.

RSG & VORP Framework Bridge

One folder, one gameplay codebase. Config.Framework = 'auto' | 'rsg' | 'vorp'. Detect once at startup; only the matching adapter executes (escrow-safe early return pattern).

RSG: ACE permissions per command (Config.CommandPermissions) + OpenPermission + elevated god for *All commands. Falls back to ACE command like stock rsg-adminmenu.

VORP: Group action map (Config.VorpAllowedActions) with example moderator preset listing 30+ allowed actions. Optional character-group mode, optional ACE overlay, separate user vs character group setters.

Bridge abstracts: get player, identifier, character ID, permissions, money, items, inventory snapshot/open, jobs, groups, ban/unban/whitelist, horses, wagons, weather/time, medical, notifications, appearance restore, list items/horses/jobs/bans/stables.

Optional dependencies auto-hide commands when not started — no broken buttons for missing rsg-medic, vorp_inventory, or weathersync.

Locales — English & Portuguese Included

401 strings per language: every command label/description, field label, placeholder, error code, overlay hint, drop message, ban duration label, status stat, and UI chrome string. English and Brazilian Portuguese ship out of the box. Drop any locales/*.json file and set Config.Locale — no code changes.

Customer-Editable Config (Non-Escrow)

Persistence via oxmysql

• rco_adminmenu_peds — persistent NPC ped assignments
• Ban records — through framework-native tables/events
• VORP horses/wagons — direct stable table inserts
• RSG horses — through rsg-horses API

Requires oxmysql. Does not require ox_lib.

Dependencies & Integration Matrix

Escrow: implementation (client, server, bridge, shared, compiled NUI) protected. Config + locales + human ped list remain fully editable.

Default command: /adminmenu · Version: 1.0.4 · Install: ensure resource → configure permissions → done.