How to Make a /car Command in FiveM with AI (Step by Step)

A /car command that spawns a vehicle is one of the first things many FiveM owners want, and it is a good test of any FiveM AI. It touches a client script, a server script, a manifest, server.cfg and permissions, and it has a classic security hole if you write it carelessly. This post shows how to ask an agent running next to your server for it, what the agent does, and how to check the result in game.

If you are still choosing a tool, read the FiveM AI comparison first. The steps below use FiveAI, where an agent works inside your server-data folder.

Step 1: describe it in plain words

You do not need to name files. Say what you want, who may use it, and any limits:

Create a /car command. /car sultan spawns a Sultan next to me and puts me in the driver seat. Only admins can use it. If I type a model that does not exist, tell me.

The three details in that prompt do real work. "Only admins" stops every player from spawning cars. "Tell me" gives the command an error path. The model name as an argument keeps one command useful for every vehicle.

You can leave the framework out here, because spawning a vehicle does not depend on ESX, QBCore or Qbox. Say it when the request touches money, jobs or items, for example "charge the player $500 when they use /car".

Step 2: what the agent does

The agent follows the same routine for most requests, and you can watch it in the chat and the live console:

1. It searches first. It looks through resources/ and server.cfg for an existing car command. If one exists, it tells you and asks before touching it. Something that already exists is yours, so it does not rewrite it silently.
2. It creates a new resource. New features go in their own folder under resources/[fiveai]/ (here car-command), so your other scripts stay untouched.
3. It adds the ensure line to server.cfg so the resource starts with the server.
4. It sets up the permission. The command is restricted, which means a player needs the command.car permission. The agent grants it to a group or named players, not to everyone.
5. It starts the resource and reads the console. It may ask for your OK before starting it, because that changes the running server. Then it checks the console for errors.
6. It reports back in plain words: what it made, which files, and what to test.

One detail to expect: a permission line in server.cfg only applies after a full server restart. The agent does not restart your server on its own. It tells you the change takes effect after you restart it, for example from txAdmin.

Step 3: what the result looks like

The exact code varies, but a correct result has this shape. The manifest, fxmanifest.lua:

fx_version 'cerulean'
game 'gta5'
lua54 'yes'

server_script 'server.lua'
client_script 'client.lua'

The server script registers a restricted command and checks the argument:

RegisterCommand('car', function(source, args)
    if source == 0 then return end

    local model = args[1]
    if not model or not model:match('^[%w_]+$') then
        TriggerClientEvent('chat:addMessage', source, { args = { 'car', 'Usage: /car <model>' } })
        return
    end

    TriggerClientEvent('fiveai_car:spawn', source, model)
end, true)

The last argument, true, is what makes the command restricted. The client script checks the model exists, loads it and spawns it:

RegisterNetEvent('fiveai_car:spawn', function(modelName)
    local hash = joaat(modelName)
    if not IsModelInCdimage(hash) or not IsModelAVehicle(hash) then
        TriggerEvent('chat:addMessage', { args = { 'car', modelName .. ' is not a vehicle.' } })
        return
    end

    RequestModel(hash)
    while not HasModelLoaded(hash) do Wait(0) end

    local ped = PlayerPedId()
    local coords = GetEntityCoords(ped)
    local vehicle = CreateVehicle(hash, coords.x, coords.y, coords.z, GetEntityHeading(ped), true, false)
    SetPedIntoVehicle(ped, vehicle, -1)
    SetModelAsNoLongerNeeded(hash)
end)

And in server.cfg, next to the other permission lines, the resource name and the permission:

ensure car-command
add_ace group.admin command.car allow

Two things to check when you read what an agent produced. The command is restricted, so a normal player cannot use it, and the model name is validated before it is used. If you want the background on why these matter, read why ChatGPT writes broken FiveM scripts and the FiveM security skill guide.

Step 4: verify it in game

Do not trust a "done" message, including the agent's. Test it:

1. Restart the server if the agent said the permission needs it, then join.
2. Run /car sultan as an admin. A Sultan should appear where you stand and you should be in the driver seat.
3. Run /car notacar. You should see an error in chat and no crash.
4. Run /car sultan as a normal player. It should be refused. This is the check people skip, and it is the one that matters on a live server.
5. Look at the console. Ask the agent "are there any errors in the console?" or open the F8 console in game. A clean start has no red lines for the new resource.

If something is wrong, say what you saw: "the car spawns but I am not in the driver seat" or "the console says the resource was not found". The agent reads the console and the files and fixes the smallest thing. It does not rewrite the resource.

Make it fit your server

Once the basic command works, extend it one change at a time, and ask for each:

• "Delete my previous /car vehicle when I spawn a new one."
• "Only allow these models: sultan, buffalo, kuruma."
• "Log every /car use with the player's name."
• "Make it a job perk instead: only police can use it." For this one, tell the agent your framework. The ESX guide and the QBCore guide show the player and job APIs it should use.

Small, specific requests give small, reviewable changes. Keep resources/ in git so you can undo any of them.