ModGuard — Changelog

v1.0.0 — Initial Release

Features

• Encrypted handshake verification — RSA-2048 keypair generated fresh each session (never written to disk). Challenge includes a nonce, HMAC secret, and public key. Client response encrypted with AES-256-GCM, AES key wrapped with RSA using OAEP/SHA-256. Server decrypts, verifies HMAC-SHA256, and checks the mod list
• Sentinel client mod — receives the challenge, collects the mod list via FabricLoader, encrypts and returns it. Zero configuration, zero performance impact
• Mod blacklist — modblacklist.json with pre-seeded entries: meteor-client, impact, wurst, liquidbounce, aristois, sigma, thunderhack, wolfram, baritone, freecam, marlows-crystal-optimizer
• Player whitelist — bypass verification for specific players by name or UUID (whitelist.json)
• Mod history — verified mod lists are saved per player to mod-history.json and viewable with /modguard mods <player>
• Protocol versioning — client and server must agree on the protocol version. Mismatched Sentinel versions are kicked with a configurable message
• Minimum Sentinel version enforcement — configurable min-sentinel-version kicks players running outdated client mods
• Max mod count limit — optional cap on total installed mods (enable-mod-count-limit, max-mod-count)
• Geyser / Floodgate auto-bypass — Bedrock players skip verification automatically (allow-floodgate: true)
• Offline / cracked server support — offline-mode: true skips UUID-dependent checks
• Configurable kick messages — separate messages for missing-sentinel, banned-mod, outdated-sentinel, protocol-mismatch, timeout, mod-count-exceeded
• Challenge timeout — configurable seconds for client to respond before being kicked (challenge-timeout-seconds)
• Commands: /modguard blacklist <add|remove|list>, /modguard whitelist <add|remove|list>, /modguard mods <player>, /modguard check <player>, /modguard reload, /modguard status