The config.yml walkthrough: check toggles and thresholds, violation decay, the punishment ladder, alerts, exemptions and storage — every family in one table set.
The Anti-Cheat is configured in one main file plus per-locale companions, and every check family in it is individually tunable — this page is the walkthrough, family by family. Read it together with How Detection Works (what each family watches) and False Positives & Staff Workflow (how to tune without punishing legit players). The shipped file is complete and commented — the snippet below is an illustrative structure, not the full file.
| File | What it holds |
|---|---|
config.yml | The main file: engine and simulation thresholds, the checks-1-8 per-check layer, setbacks, auto-kick, packet limiter, alerts and the storage routing |
messages.yml | Player- and staff-facing text in the server's locale (13 locales bundled, chosen from the server language) |
punishments/<locale>.yml | The punishment ladder: per-check-group command lists with thresholds, intervals and the [alert] / [log] special actions |
violations/ | Runtime data, not config — per-player snapshots (<uuid>.json) written on quit and restored on join |
These are the top-level keys that shape how every movement verdict is produced: the prediction engine's offset threshold, how advantage accumulates and decays, and how setbacks behave. They are deliberately conservative out of the box.
| Key | Default | Controls |
|---|---|---|
Simulation.threshold | 0.005 | Offset (blocks) past which a movement flags — the sensitivity of the prediction engine |
Simulation.immediate-setback-threshold | 0.1 | Offset so large the player is setback on the spot, bypassing the advantage buffer |
Simulation.max-advantage | 1 | Bounded advantage score a player can accumulate before enforcement |
Simulation.max-ceiling | 4 | Upper ceiling of the advantage accumulator |
Simulation.decay | 0.999 | Per-tick multiplier so honest lag recovers instead of compounding |
setback.teleport-back | false | Master switch for physical setbacks — false ships as alert-only mode |
setback.violation-window-ms | 1000 | Only fresh flags inside this window can trigger a setback, so stale violations never rubber-band |
setback.force-resync-interval-ms | — | Minimum spacing between forced resyncs (throttle for client corrections) |
auto-kick.max-violations | 100 | Total violations that trigger the packet-level auto-kick |
auto-kick.min-categories | 2 | Check families those violations must span — one noisy check alone can never reach it |
packet-spam-threshold | 100 | Packet limiter ceiling for flood-style packet abuse |
All 145 named checks are active out of the box, and every one is individually toggleable. The 30 checks of the dedicated 1.8 layer live in per-check subtrees under checks-1-8, each with its own enabled, human-tuned thresholds, setbackvl and decay — all honored live by /anticheat reload. The engine-level families (Simulation, Reach, TimerA, Knockback, Explosion and friends) sit at the top level beside them.
| Key (examples) | Default | Controls |
|---|---|---|
checks-1-8.Criticals.enabled | true | Toggle the critical-hits check without touching its thresholds |
checks-1-8.KillAuraD.enabled + threshold keys | true | The phase-locked crosshair-entry check — threshold keys are human-tuned, not magic constants |
checks-1-8.GhostHand.setbackvl | per check | Violation level at which the through-wall check requests a setback |
checks-1-8.AutoClicker.decay | per check | How fast this check's violations cool down after a flag |
checks-1-8.NoFallB.* | true | The 1.8 on-ground spoof family — enabled, thresholds, setbackvl and decay per subtree |
checks-1-8.ScaffoldTower.* / SnapHold.* | true | Scaffold and camera-signature checks with their own setback levels |
Reach.block-impossible-hits | — | Combat family: reject hits the lag-compensated hitboxes make physically impossible |
Reach.threshold | — | Distance threshold for the reach check, at its strongest on 1.7/1.8 clients |
Tip:Tighten one family at a time and verify with /anticheat reload — the reload is asynchronous and never disturbs the tick loop. Rolling back is a copy-paste, so keep a config per tuning stage.
Punishments are configured per check group in punishments/<locale>.yml — Simulation, Movement, Knockback, Post, BadPackets, Reach, Hitboxes, Misc, Combat and Autoclicker. Each group runs its commands at threshold:interval boundaries: a typical cascade is an [alert] at a low threshold, a warning or kick command in the middle, and a ban command at the top, each entry repeating only at its own interval. The special actions [alert] and [log] feed staff alerts and the datastore; everything else is a console command string, so the ladder speaks whatever your punishment plugin understands.
| Group | Ships with | Tuning note |
|---|---|---|
| Movement | The only group with a kick by default | Enable kicks deliberately, one family at a time |
| Simulation / Knockback / Post | Alerts only | Let violations accumulate; the auto-kick layer is the backstop |
| Reach / Hitboxes / Combat | Alerts only | Pair with lag-compensation settings before enforcing |
| BadPackets / Misc / Autoclicker | Alerts only | Protocol-level signals — good candidates for the first enforced ladder once you trust the baseline |
Warning:Set test-mode to dry-run before enabling real punishments: actions are logged instead of executed, so you can review exactly what *would* have happened to real players. Turn enforcement on only after a clean review window.
| Key / permission | Default | Controls |
|---|---|---|
alerts.print-to-console | true | Mirror every alert to the console, so the log keeps a record even with no staff online |
[alert] in a punishment group | per group | Which thresholds emit a staff alert at all |
anticheat.alerts | op | Receive and toggle the alert stream (/anticheat alerts, persists per player) |
anticheat.alerts.enable-on-join (+ .silent) | op / false | Auto-subscribe staff on join — the silent variant skips the confirmation message |
Alerts carry the check name and description on hover plus the violation count and verbose line, and an asterisk marks the build's single experimental check (NegativeTimer) so nothing is hidden. There is no Discord or Telegram webhook delivery — the pipeline was removed and any [webhook] entries in a ladder are inert; the alert stream, console mirror and the datastore's [log] action are the complete output surface.
Exemptions are permission-based, never a whitelist file: the global nodes anticheat.exempt, anticheat.nosetback, anticheat.nomodifypacket and anticheat.disabled (checks off, tracking continues), plus a per-check variant of each derived from the check's config name — anticheat.exempt.knockback, anticheat.nosetback.scaffoldtower and so on. All of them re-evaluate every 40 ticks, so a rank change or a grant during an event heals within about two seconds and never needs a reconnect. Every node defaults to false/op, so nothing is exempt until you say so — ops included until a grant is made.
Out of the box the plugin needs zero infrastructure: violations live in memory and snapshot to violations/<uuid>.json on quit, restored on join with linear decay over each group's decay window — a relog cannot launder a cheat session. For multi-server setups or durable history, the database section routes per data category:
| Key | Default | Controls |
|---|---|---|
database.enabled | false | Master switch for the datastore backends |
database.server-name | — | Name stamped on this server's rows, so shared backends can tell installations apart |
database.routing | memory | Per-category routing: memory (default), redis, mysql/mariadb, postgres, sqlite or mongo — drivers resolve at runtime |
# The shipped file is complete and commented — this is the shape.
Simulation:
threshold: 0.005
immediate-setback-threshold: 0.1
max-advantage: 1
max-ceiling: 4
decay: 0.999
setback:
teleport-back: false
violation-window-ms: 1000
auto-kick:
max-violations: 100
min-categories: 2
checks-1-8:
GhostHand:
enabled: true
setbackvl: 10
decay: 0.9Note:Config versions migrate automatically (config-flavor: V2, config-version: 26) — an older config upgrades in place without losing your edits. Config guidance from the developer is part of the license: when a family misbehaves, open a ticket with the check name and tune it together.