Reading a FiveM Resource Manifest Before You Buy

What fxmanifest.lua is, and why it's usually readable

Per the official resource manifest reference (docs.fivem.net), fxmanifest.lua is a declarative metadata file, run in its own Lua runtime separate from the resource's actual client and server scripts, and read by the server before any of that logic loads. It's structure, not behavior — client_scripts, server_scripts, dependencies, and similar keys describe what the resource is, not what it does.

Because the server has to parse it just to load the resource at all, sellers have little reason to obscure it, and in practice most commercial resources — including escrowed ones — ship it as plain, readable text. That's a convention we've observed across the market, not a platform guarantee: asset escrow is applied per file, so treat "I can read the manifest" as something to check on the specific listing in front of you, not an assumption.

The keys worth reading before you install anything

• fx_version / game — the current FXv2 version is cerulean. A manifest still using the deprecated resource_manifest_version GUID scheme instead of fx_version is a signal the codebase's manifest hasn't been touched since a genuinely old convention — worth a maintenance question, though not proof of anything on its own.
• dependency / dependencies — exactly what else you have to own and install before this resource will run at all. A long dependency list is a real cost to price into the purchase, not a footnote to skim past.
• client_scripts / server_scripts / shared_scripts — a rough shape of where the resource's logic actually runs. A resource that touches money or permissions with a large client-side script list and a thin server-side one is worth a closer look — see our server-authority guide for what that closer look should check.
• ui_page (plus its files entry) — confirms the resource ships NUI and names its entry file. Worth knowing: per the official asset escrow documentation, NUI is not currently supported by the escrow system at all, so a resource's UI markup and JavaScript are typically inspectable by design, independent of what the seller intended for the rest of the package.
• escrow_ignore — the seller's own declared list of files exempted from encryption (docs.fivem.net documents the exact directive and its glob syntax). Where present, it's the most direct disclosure available of the open-versus-escrowed split our vetting guide asks you to demand before paying.
• provide — marks the resource as a drop-in replacement for another named resource, meaning it can start instead of that resource if something else requires it. Worth checking what it claims to replace and whether that claim matches the rest of your stack.
• lua54 — a common sight in older manifests. Current FiveM documentation states this setting is no longer necessary, since Lua 5.3 was deprecated platform-wide and all Lua scripts now run on 5.4 regardless. Its presence or absence today is a style artifact, not a compatibility signal.

What the manifest can't tell you

The manifest is an X-ray of structure, not of quality. It won't show you whether the server-side handlers actually validate what they receive, whether the database queries are indexed, or whether money survives a crash mid-transaction — those require the checks in our server-authority, database, and restart-safety guides. Reading the manifest is the two-minute step before those longer ones, not a replacement for them.

A two-minute manifest read

• Open fxmanifest.lua. Note fx_version and game.
• List every dependency entry and check you already have (or are prepared to buy) each one.
• Roughly compare the size of client_scripts against server_scripts for anything that handles money, items, or permissions.
• Check for ui_page — confirms NUI, and its file is generally readable regardless of escrow.
• Search for escrow_ignore — if present, it's a direct, seller-authored disclosure of what's open.
• Search for provide — tells you if this resource is positioning itself as a replacement for something you might already run.