NexusCore Mod (NCM)

First release — NeoForge, Fabric and Forge, all three at once, for Minecraft Java Edition 1.21.1.

Server-side only. Players join with a completely unmodified vanilla client, admin panel included.

What shipped

• Permissions — groups, multiple inheritance, wildcards and explicit denies, plus a check command that explains its answer instead of returning a bare yes or no.
• Moderation — kick, ban, tempban, unban, mute, unmute, warn, warnings, banlist. Punishments are never deleted; lifting one stamps who and when.
• Ban screens — full-screen and styled, with a live countdown and a configurable appeal line.
• Teleportation — homes, warps, spawn, /back (including back to where you died), /tpa and staff /tp, with real destination-safety checks that refuse with a reason instead of dropping you somewhere close enough.
• Player tools — heal, feed, fly, god, speed, vanish, playerinfo, seen, list, near.
• Audit log — append-only, SHA-256 hash-chained and tamper-evident, with IPs, passwords and tokens redacted as they are written.
• Admin panel — a vanilla chest menu: dashboard, paginated player list, per-player actions, moderation and permission overviews, server diagnostics. Permission is re-checked on every click.
• Vanilla command takeover — NexusCore owns the commands it replaces, so the command you already type gains a duration, a reason, history and an audit record. Set overrideVanillaCommands=false to opt out.
• Styled death messages on all three loaders, and every message rewordable via messages.json.

Stated as unproven at release

No real player had joined a server yet, so the admin panel, vanish, chat muting and ban-at-login were wired but unobserved. 178 automated tests, 0 failures.

---

⛔ This version is unsupported — do not deploy it

v1.0.0 has two confirmed critical defects and is marked unsupported in SECURITY.md.

• /teleport bypassed NexusCore completely. Vanilla registers teleport as the real command and tp as a redirect to it; only tp was taken over, so /teleport ran as pure vanilla with no permission check, no rate limit and no audit record.
• Any non-player command source was granted root. /execute as @e[…] run nexus … ran with full privileges, and operatorBootstrap=false constrained nobody.

Both are fixed in v1.1.0 — upgrade to it.

This release stays published only so the archive is complete and a bug report can be reproduced against the exact bytes.

---

📥 Also on GitHub Releases · 🌐 mwtstudios.net · 💬 Discord