Paragon Anticheat

!Replace this with a description Packet based anticheat for Paper 1.21.11. 63 checks, silent mod detection with per mod kicks on the very first join, seed protection, screenshare tools, raytrace anti xray plus anti freecam, and active mitigations that make cheats stop working instead of only flagging them.

Paragon watches packets, not clicks. Movement runs through a physics simulation, combat runs through statistics, and clients run through a silent translation probe that catches cheat mods with zero signs, zero editors and zero interaction. Built to be brutal on cheaters and invisible to legit players, on Java and Bedrock alike.

WHY PARAGON

MOD BLOCKER - Meteor, Wurst and 140 plus known mods get kicked on first join with the mod names on the screen (visible to those with permission).

FALSE FLAG RESISTANT - Buffered Checks, Ping Scaling, Lag Leniency and variance gates. One fast moment never punishes anyone. Only machine consistent repetition does. It's tuned to minimize false flags.

ACTIVE MITIGATIONS - Swap macro hits get cancelled, BoatFly ejects the driver, confirmed flyers get set back to verified safe ground, suspects quietly lose damage before the ban lands.

BEDROCK FRIENDLY - Geyser and Floodgate auto detection plus dot prefix matching when Floodgate is missing. Bedrock players skip mod scanning completely.

CLEAN CONFIG - The config is clean and very easy to edit and navigate, check it out yourself:

#    _____                                                                    _____
#  ( ___ )------------------------------------------------------------------( ___ )
#  |   |                                                                      |   |
#  |   |   ██▓███   ▄▄▄       ██▀███   ▄▄▄        ▄████  ▒█████   ███▄    █   |   |
#  |   |  ▓██░  ██▒▒████▄    ▓██ ▒ ██▒▒████▄     ██▒ ▀█▒▒██▒  ██▒ ██ ▀█   █   |   |
#  |   |  ▓██░ ██▓▒▒██  ▀█▄  ▓██ ░▄█ ▒▒██  ▀█▄  ▒██░▄▄▄░▒██░  ██▒▓██  ▀█ ██▒  |   |
#  |   |  ▒██▄█▓▒ ▒░██▄▄▄▄██ ▒██▀▀█▄  ░██▄▄▄▄██ ░▓█  ██▓▒██   ██░▓██▒  ▐▌██▒  |   |
#  |   |  ▒██▒ ░  ░ ▓█   ▓██▒░██▓ ▒██▒ ▓█   ▓██▒░▒▓███▀▒░ ████▓▒░▒██░   ▓██░  |   |
#  |   |  ▒▓▒░ ░  ░ ▒▒   ▓▒█░░ ▒▓ ░▒▓░ ▒▒   ▓▒█░ ░▒   ▒ ░ ▒░▒░▒░ ░ ▒░   ▒ ▒   |   |
#  |   |  ░▒ ░       ▒   ▒▒ ░  ░▒ ░ ▒░  ▒   ▒▒ ░  ░   ░   ░ ▒ ▒░ ░ ░░   ░ ▒░  |   |
#  |   |  ░░         ░   ▒     ░░   ░   ░   ▒   ░ ░   ░ ░ ░ ░ ▒     ░   ░ ░   |   |
#  |   |                 ░  ░   ░           ░  ░      ░     ░ ░           ░   |   |
#  |   |                                                                      |   |
#  |   |                          Configuration File                          |   |
#  |   |                         v1.0 - By Ascvnd!                            |   |
#  |___|                                                                      |___|
#  (_____)                                                                  (_____)
#
plugin:
  debug: false
  database-logging: true
  # Your Discord invite. It shows on kick and ban screens after
  # "If false banned Appeal @". Leave it empty and the screens will
  # just say to set it up instead.
  discord-link: ""
  broadcast-alerts: true
  alert-channel: CHAT
  alert-sound: true
  alert-sound-type: block.note_block.pling
  # Ping staff when something gets quietly stopped (a swapped hit that
  # went nowhere, a flag softened by high ping, a flyer kicked out of a
  # boat). No VL comes with these, it is just a heads up.
  alert-on-mitigation: true

lag-compensation:
  # Mitigate-only mode stays OFF (-1), on purpose. Turning it on means
  # anyone above that ping stops collecting VL from every movement and
  # combat check at once, and a cheater on a bad (or deliberately bad)
  # connection becomes untouchable. Laggy-but-legit players are covered
  # by the leniency multiplier below instead, which bends thresholds
  # rather than switching enforcement off. Set a real ping to re-enable.
  max-ping-for-movement: -1
  max-ping-for-combat: -1
  position-history-ticks: 20
  # How much slack high ping players get on thresholds (past 150ms).
  high-ping-leniency-multiplier: 1.5
  high-ping-threshold: 150
  bedrock-exempt-checks: []
  # Bedrock players go through the same checks as everyone else. Only add
  # a check here if legit Bedrock movement keeps tripping it on YOUR map.

punishments:
  # The master switch. Turn it off and nobody ever gets kicked or banned,
  # you just get detections and alerts. Handy while you learn the plugin.
  enabled: true
  ban-command: "ban %player% [Paragon] Cheating: %check% - If false banned Appeal @ %discord%"
  kick-command: "kick %player% [Paragon] Kicked for %check%"
  # What /paragon unban runs. Vanilla calls it "pardon", most ban plugins
  # call it "unban". %player% is the name you typed, works offline too.
  unban-command: "unban %player%"
  # Kicks are remembered. Once someone has collected this many, the next
  # punishment skips straight to a ban. 0 turns that off.
  max-kicks-before-ban: 3
  # Untags combat before kicking or banning (CombatLogX, CombatTagPlus,
  # DeluxeCombat when they are around, plus a short bypass), so the
  # punishment itself never causes a combat-log death.
  combatlog-untag: true
  # Breathing room between punishments for one player. A single lag spike
  # can burst a pile of flags and must never chain-kick anyone.
  cooldown-ms: 30000
  # Fresh joins can't be punished for the first N seconds. This stops the
  # nightmare loop where someone spawns somewhere the checks misread,
  # gets kicked, rejoins and gets kicked forever. Alerts still fire.
  join-immunity-seconds: 20

# Flip any check to `alerts-only: true` and it will flag and tell staff
# without ever kicking or banning. A few checks ship that way because they
# read timing or geometry the server can't verify exactly (where a target
# stood the moment a hit landed, how a client rotated between packets).
# Treat those as tips for your staff, and flip them to false once you
# trust them on your own players.

# Setback drags confirmed movement cheaters back along their own trail of
# spots that passed every check on solid ground. If they outran the trail,
# each setback walks them back by up to max-distance until they are on it
# again. Works at any ping, which is what makes ping games pointless, and
# buffered checks keep it away from legit players.
setback:
  enabled: true
  # How many blocks one setback step pulls back at most.
  max-distance: 16.0

# ════════════════════════════════════════════════════════════════════
#  MITIGATIONS ~ breaking the cheat, not just spotting it
# ════════════════════════════════════════════════════════════════════
#  These don't just flag things, they make them stop working.
mitigations:
  # Same-tick attribute swapping (vanilla bug MC-28289): swapping hotbar
  # items in the same tick as an attack smuggles the old item's damage
  # into the hit. That trick powers lunge-swap, breach and density swaps
  # and mace stun-slam macros. With this on, hits landing inside the
  # window after a swap get cancelled outright. Macro or manual, the
  # exploit just does nothing.
  attribute-swap-fix:
    enabled: true
    # 50ms is one game tick. Raise it to 100 to kill 2-tick swap tech too.
    swap-window-ms: 50
    # SMART  - hits land normally until AutoSwap smells a real macro
    #          pattern (VL on the board), then swap-hits start getting
    #          cancelled until it fades. Your legit one-tick artists keep
    #          their tech, macros lose theirs. Also shrugs off high ping
    #          packet bunching instead of ghosting hits.
    # ALWAYS - cancel every same-window swap hit, legit tech included.
    # DETECT - watch and flag only, never touch a hit.
    mode: SMART
    # SMART only starts cancelling once autoswap VL reaches this. One flag
    # is worth 3 VL, so this asks for TWO separate confirmed macro reads
    # before anything gets cancelled. Lower it and a single coincidence
    # (someone fast switching weapons mid-fight) eats their hits for a
    # second or two, which is exactly the ghost-hit feeling this fix is
    # here to prevent.
    smart-min-vl: 6

checks:
  # .... Movement ....
  flight:
    enabled: true
    kick-vl: 40
    ban-vl: 80
    vl-decay: 3
    velocity-leniency-ticks: 20

  speed:
    enabled: true
    kick-vl: 50
    ban-vl: 100
    vl-decay: 3
    # 1.0 = exactly expected speed, 1.20 = 20% tolerance for lag/knockback momentum
    max-speed-multiplier: 1.20

  step:
    enabled: true
    kick-vl: 25
    ban-vl: 50
    vl-decay: 2
    # Vanilla lets you step 0.6 up. The extra 0.05 covers the server
    # rounding its own math, nothing more.
    max-step-height: 0.65

  nofall:
    enabled: true
    alerts-only: true
    kick-vl: 20
    ban-vl: 40
    vl-decay: 2

  timer:
    enabled: true
    kick-vl: 20
    ban-vl: 40
    vl-decay: 2
    # 1.15 means 15% headroom over 20 packets a second, enough for
    # jitter and catch-up bursts without crying wolf.
    max-timer-rate: 1.15

  velocity:
    enabled: true
    kick-vl: 25
    ban-vl: 50
    vl-decay: 2
    # How much of the server's knockback someone has to actually take.
    # 0.55 is generous on purpose, lag eats knockback for breakfast.
    min-velocity-acceptance: 0.55

  phase:
    enabled: true
    kick-vl: 15
    ban-vl: 18
    vl-decay: 1

  noslow:
    enabled: true
    kick-vl: 20
    ban-vl: 40
    vl-decay: 3

  rotation:
    enabled: true
    kick-vl: 20
    ban-vl: 45
    vl-decay: 2
    max-yaw-change: 360.0
    # Extra aim math (sub-check C), OFF unless you feel brave. Rotations
    # travel as 32-bit floats, so every sample carries rounding noise, and
    # that noise folds a GCD toward zero for legit players exactly like it
    # does for aimbots. You can't separate the two without watching your
    # own players and tuning it yourself. A (bad pitch), B (NaN) and D
    # (spinbot) don't care about this switch and always run.
    gcd-check: false
    # Only matters with gcd-check on. Lower gets mouthier.
    gcd-sensitivity: 0.003

  elytrafly:
    enabled: true
    alerts-only: true
    kick-vl: 15
    ban-vl: 35
    vl-decay: 1

  jesus:
    enabled: true
    kick-vl: 10
    ban-vl: 25
    vl-decay: 1

  # Jump boosts add to the vanilla 0.42 hop. This reads the takeoff tick
  # itself, the only moment the extra push shows before the movement
  # prediction swallows it.
  highjump:
    enabled: true
    kick-vl: 16
    ban-vl: 32
    vl-decay: 2

  blink:
    enabled: true
    kick-vl: 8
    ban-vl: 18
    vl-decay: 1

  clicktp:
    enabled: true
    kick-vl: 10
    ban-vl: 20
    vl-decay: 1

  bunnyhop:
    enabled: true
    kick-vl: 12
    ban-vl: 28
    vl-decay: 2

  # Says they are on the ground with nothing underneath. A slow,
  # sneaky cousin of NoFall.
  groundspoof:
    enabled: true
    kick-vl: 20
    ban-vl: 40
    vl-decay: 2

  # Saves up movement ticks and dumps them in one burst. Looks like a
  # teleport that politely keeps the packet rate at 20 a second so the
  # Timer check stays asleep.
  tickshift:
    enabled: true
    kick-vl: 20
    ban-vl: 40
    vl-decay: 2

  # Flying boats and entity rides going uphill. Flags the driver and
  # kicks them straight out of the seat.
  boatfly:
    enabled: true
    kick-vl: 8
    ban-vl: 20
    vl-decay: 1

  # .... Combat ....
  reach:
    enabled: true
    alerts-only: true
    # Reach plays by its own rules here, not the generic cancel-hit
    # toggle. Only the hard-limit arm (blatant, no innocent story)
    # ever takes a hit away. The soft arm, where normal target wiggle
    # at real ping lives, only ever flags.
    kick-vl: 12
    ban-vl: 25
    vl-decay: 1
    # Spears get special treatment because vanilla does too: they reach
    # 4.5 blocks (2.0 minimum) while everything else stops at 3.0. Held
    # a *_SPEAR and the 4.5 floor applies itself, with a 5.6 hard cap.
    # max-reach below is the everyday non-spear baseline, leave it be.
    max-reach: 3.1
    # A little extra rope per 50ms of ping.
    ping-reach-leniency-per-50ms: 0.10

  autoclicker:
    enabled: true
    kick-vl: 18
    ban-vl: 35
    vl-decay: 2
    # Ceiling in clicks per second. 22 leaves room for butterfly clickers
    # tapping near 20.
    max-cps: 22
    # How steady clicking may get before it looks bottled. Lower gets
    # mouthier.
    min-cps-variance: 0.25
    sample-window: 40

  killaura:
    enabled: true
    kick-vl: 12
    ban-vl: 25
    vl-decay: 1
    max-attack-angle: 80.0
    multi-target-detection: true

  aimassist:
    enabled: true
    alerts-only: true
    kick-vl: 20
    ban-vl: 45
    vl-decay: 2
    # Same idea as the rotation GCD above, for aim instead. B (snap to a
    # target) ignores this switch and always runs.
    gcd-check: false
    gcd-min-samples: 40
    # Per-tick scoring against the player's own sensitivity fingerprint.
    # Opt in only, and keep it alerts-only unless you love tuning.
    gcd-mlsac: false
    gcd-mlsac-error: 0.0005
    gcd-mlsac-streak: 3

  autoblock:
    enabled: true
    alerts-only: true
    kick-vl: 10
    ban-vl: 22
    vl-decay: 1

  hitbox:
    enabled: true
    kick-vl: 12
    ban-vl: 25
    vl-decay: 1
    max-hitbox-expansion: 0.10

  critical:
    enabled: true
    alerts-only: true
    kick-vl: 10
    ban-vl: 22
    vl-decay: 1

  # Totems are about rhythm, not speed. A macro replays its delay to the
  # millisecond no matter how slow you set it, a human never does. The
  # statistics arms wait for 10+ confirmed refills before saying a word.
  autototem:
    enabled: true
    kick-vl: 15
    ban-vl: 35
    vl-decay: 1
    # Quicker than this after a pop and it is basically a robot.
    min-swap-time-ms: 80
    monitor-window-ticks: 5
    # B arm: inhuman click floor right after a pop.
    type-b-min-ms: 40
    type-b-max-ms: 250
    # C arm: suspiciously steady average with almost no spread.
    type-c-mean-ms: 200.0
    type-c-max-diff-ms: 10.0
    # D arm: refill gaps that keep landing on top of each other.
    type-d-delta-ms: 100.0
    type-d-max-ms: 845.0
    # E arm: low wobble windows, confirmed a few times over.
    type-e-sd-ms: 10.0
    type-e-mean-ms: 500.0
    type-e-min-samples: 5
    type-e-windows: 3

  angle:
    enabled: true
    alerts-only: true
    kick-vl: 12
    ban-vl: 25
    vl-decay: 1
    max-behind-angle: 90.0

  # Weapon swap macros: swap, hit, swap back, faster than hands allow.
  # Think auto spear and auto mace modules doing the work for you.
  autoswap:
    enabled: true
    alerts-only: true
    kick-vl: 15
    ban-vl: 30
    vl-decay: 2
    # B arm: how steady the swap-hit-swap rhythm may get before it
    # stops looking human.
    cadence-stddev-ms: 25.0
    # C arm: bouncing one slot pair (sword to mace and back) needs this
    # many rounds to count. Scrolling walks lots of slots, and legit
    # tech fires once a fight, never six rounds in a row.
    osc-cycles: 6
    osc-max-gap-ms: 150.0

  # Hits with no arm swing behind them. That is a silent aura, full stop.
  noswing:
    enabled: true
    alerts-only: true
    kick-vl: 16
    ban-vl: 32
    vl-decay: 2

  # Fake fall distance to steal the mace smash bonus while standing
  # still (the mace one-shot trick). This one is high confidence: your
  # server's own fall number flat-out contradicts our movement tracking,
  # so ping doesn't save anyone here.
  macedamage:
    enabled: true
    kick-vl: 16
    ban-vl: 32
    vl-decay: 1
    # B arm: smashes from the exact same height over and over. Macros
    # jump (or spoof) to the same centimeter, real terrain never repeats.
    height-stddev: 0.15
    # C arm: the breach and density swap smash. One quick swap-smash is
    # honest tech, only robot-steady streaks get flagged.
    swap-max-gap-ms: 120
    swap-count: 5
    swap-stddev-ms: 25.0

  crystalaura:
    enabled: true
    kick-vl: 12
    ban-vl: 28
    vl-decay: 2
    # E arm: place-to-hit reactions no human answers (needs a few of them).
    type-b-fast-ms: 60
    type-b-required: 4
    # F arm: reactions landing on the same millisecond, window after window.
    type-c-max-delay-ms: 1500
    type-c-delta-ms: 5

  anchoraura:
    enabled: true
    kick-vl: 10
    ban-vl: 22
    vl-decay: 1

  bedaura:
    enabled: true
    kick-vl: 10
    ban-vl: 22
    vl-decay: 1

  nohurtcooldown:
    enabled: true
    alerts-only: true
    kick-vl: 12
    ban-vl: 28
    vl-decay: 2

  # .... World work ....
  scaffold:
    enabled: true
    kick-vl: 12
    ban-vl: 28
    vl-decay: 1
    min-place-delay-ms: 55
    rotation-check: true
    pattern-check: true
    # Catches blocks placed while moving that the eyes couldn't have
    # aimed at (silent-aim scaffolds). Sitting still never counts.
    sight-check: true

  fastplace:
    enabled: true
    kick-vl: 12
    ban-vl: 25
    vl-decay: 2
    max-places-per-second: 14

  fastbreak:
    enabled: true
    kick-vl: 12
    ban-vl: 25
    vl-decay: 1
    break-time-multiplier: 0.70

  nuker:
    enabled: true
    kick-vl: 5
    ban-vl: 12
    vl-decay: 1
    # Vanilla breaks one block a tick, so 20 a second is the honest max.
    max-breaks-per-second: 22
    # STOPPER: sits on mass-breaks while the pattern is hot, and always
    # sits on breaks from impossible distance. False means watch and
    # punish only.
    mitigate: true
    # Honest survival reach, eye to block middle, plus ping slack.
    break-reach: 5.5

  airplace:
    enabled: true
    kick-vl: 8
    ban-vl: 18
    vl-decay: 1

  # Every right click, any item. Block and entity reaches past survival
  # range get cancelled on the spot, no appeal.
  interactreach:
    enabled: true
    kick-vl: 12
    ban-vl: 25
    vl-decay: 1
    place-reach: 5.0
    entity-reach: 3.5
    block-reach: 5.0

  # Digging with no honest dig behind it. PacketMine and instant AutoMine
  # live here.
  packetmine:
    enabled: true
    kick-vl: 12
    ban-vl: 25
    vl-decay: 1

  # Mining luck that math says is impossible. Stays alerts-only because
  # maps, friends and old explored caves are all honest explanations.
  # A tip for staff, never an auto punishment.
  xray:
    enabled: true
    alerts-only: true
    kick-vl: 12
    ban-vl: 25
    vl-decay: 1
    min-valuables: 6
    window-minutes: 20
    max-stone-per-valuable: 40.0
    pace-count: 4
    pace-max-gap-seconds: 45

  # .... Movement extras ....
  # Up walls with no ladder, vine or scaffolding helping.
  spider:
    enabled: true
    kick-vl: 12
    ban-vl: 28
    vl-decay: 2

  # .... Fresh combat (1.21 era + bots) ....
  # Sprint surviving hit after hit is what KeepSprint modules do. Numbers
  # game, so alerts-only until it earns your trust.
  keepsprint:
    enabled: true
    alerts-only: true
    kick-vl: 12
    ban-vl: 28
    vl-decay: 2

  # Hitting through walls. Traced server side, no excuses.
  throughwall:
    enabled: true
    kick-vl: 12
    ban-vl: 25
    vl-decay: 1

  # Spear dash macros doing the lunging for you. Rhythm based, so it
  # watches consistency and swap streaks, and stays alerts-only.
  spearlunge:
    enabled: true
    alerts-only: true
    kick-vl: 12
    ban-vl: 28
    vl-decay: 2
    # C arm: lunge replay. This many spear hits this close together sits
    # below the dash cooldown, so it isn't fingers clicking.
    rate-count: 5
    rate-max-gap-ms: 260

  # Inhuman reaction times on the trigger (crosshair auras and friends).
  # Numbers game, alerts-only until it is tuned to your crowd.
  triggerbot:
    enabled: true
    alerts-only: true
    kick-vl: 12
    ban-vl: 28
    vl-decay: 2

  # .... Modern macro flags ....
  # Auto spear lunge swap: swapping onto the spear in the same breath as
  # the dash, so the lunge carries the old weapon's punch. One quick
  # swap-lunge is honest tech, metronome streaks are macros.
  autospear:
    enabled: true
    alerts-only: true
    kick-vl: 12
    ban-vl: 28
    vl-decay: 2
    swap-max-gap-ms: 60
    swap-count: 5
    swap-stddev-ms: 25.0
    rate-count: 5
    rate-max-gap-ms: 300
  # Auto mace hitting: swings and smashes on a fixed timer no hand keeps.
  automace:
    enabled: true
    alerts-only: true
    kick-vl: 12
    ban-vl: 28
    vl-decay: 2
    cadence-mean-ms: 800.0
    cadence-stddev-ms: 20.0
    smash-count: 4
  # Auto breach swap: onto the Breach mace exactly for the shredding hit,
  # back right after, every time, on the same millisecond.
  autobreach:
    enabled: true
    alerts-only: true
    kick-vl: 12
    ban-vl: 28
    vl-decay: 2
    swap-max-gap-ms: 100
    swap-count: 5
    swap-stddev-ms: 25.0
    cadence-mean-ms: 800.0
    cadence-stddev-ms: 20.0

  # .... Odds and ends ....
  badpackets:
    enabled: true
    kick-vl: 5
    ban-vl: 10
    vl-decay: 1
    # Timing and order tricks get scored together here: bursts, snaps
    # and impossible orders. Score 4 across them, confirmed this many
    # times running, and it flags.
    proto-buffer: 4

  # Clicking like a maniac with a menu open. Walking around with one
  # open is invmove's problem, not this one's, check its note below.
  inventory:
    enabled: true
    alerts-only: true
    kick-vl: 12
    ban-vl: 25
    vl-decay: 2
    # Clicks a second allowed inside a menu, averaged over 2s. 18 sits
    # comfortably above the fastest honest sorting.
    max-cps: 18.0

  cheststeal:
    enabled: true
    kick-vl: 20
    ban-vl: 40
    vl-decay: 3

  invmove:
    enabled: true
    kick-vl: 10
    ban-vl: 22
    vl-decay: 1

  # Eating or drinking quicker than vanilla lets you swallow.
  fastuse:
    enabled: true
    kick-vl: 12
    ban-vl: 25
    vl-decay: 2

  # Fake lag on purpose to farm leniency (answers stall while movement
  # flows, keepalive times drift apart). Runs at full VL even on high
  # ping, because this one IS the lag trick.
  pingspoof:
    enabled: true
    kick-vl: 10
    ban-vl: 25
    vl-decay: 1

  # Armor appearing out of nowhere in bursts. Numbers game, so it
  # watches and tells staff instead of punishing.
  autoarmor:
    enabled: true
    alerts-only: true
    kick-vl: 12
    ban-vl: 25
    vl-decay: 2

  # Arrows leaving faster than any bow can draw.
  fastbow:
    enabled: true
    kick-vl: 12
    ban-vl: 28
    vl-decay: 2

  # Cobwebs feeling like open air.
  noweb:
    enabled: true
    kick-vl: 12
    ban-vl: 28
    vl-decay: 2

  # .... Fresh catches ....
  # Click rhythms no finger keeps up: too steady, too repeating, too
  # evenly spread. Watches quietly for now (shadow): it wants to meet
  # your real players before it may punish. Flip alerts-only off once
  # you believe what it tells you.
  clickpattern:
    enabled: true
    alerts-only: true
    kick-vl: 15
    ban-vl: 35
    vl-decay: 2
    min-cps: 10.0
    max-cv: 0.07
    max-autocorr: 0.75
    max-entropy: 0.6

  # Full damage on an empty 1.9 charge bar. Same deal, watch first,
  # punish later.
  attackcooldown:
    enabled: true
    alerts-only: true
    kick-vl: 10
    ban-vl: 25
    vl-decay: 1
    low-charge: 0.60
    buffer: 5

  # For the clever ones who stay under every single limit but trip five
  # checks at once. Adds up suspicion across the board and flags the
  # total. Tips staff off by design, never punishes.
  multisignal:
    enabled: true
    alerts-only: true
    kick-vl: 15
    ban-vl: 35
    vl-decay: 2
    flag-threshold: 2.5
    buffer: 5
    window-seconds: 30

  # ── Baritone bot ──
  # Pathfinding bots steer like no human does: direction snaps that land
  # on spike patterns, rotation steps frozen on a few fractions of a
  # degree, and long runs of yaw steering with pitch locked solid.
  # Lives on 25-packet windows with buffers, so one weird second is free.
  baritone:
    enabled: true
    kick-vl: 20
    ban-vl: 40
    vl-decay: 2

# ════════════════════════════════════════════════════════════════════
#  ANTI-XRAY ~ ores you can't see don't exist
# ════════════════════════════════════════════════════════════════════
#  Rule one: hide everything first, then reveal only what someone really
#  looks at. Buried, walled in, sitting in a cave, it makes no
#  difference: no line of sight means stone on the screen. This sits ON
#  TOP of Paper's own anti-xray, so go turn on engine-mode 1 in
#  paper-global.yml (there is a doc page for it) for the chunk packet
#  layer underneath. Run /paragon xray in game any time to see both
#  layers. When in doubt something gets shown rather than hidden, so
#  protection never turns into a weird visual glitch. Leftover work just
#  waits for the next tick instead of ever lagging the server.
anti-xray:
  enabled: true
  # RAYTRACE hides every protected block until someone looks at it.
  # This is the one you want.
  # OBFUSCATE does the same thing and stays as an alias.
  engine-mode: RAYTRACE
  hidden-blocks:
    - DIAMOND_ORE
    - DEEPSLATE_DIAMOND_ORE
    - EMERALD_ORE
    - DEEPSLATE_EMERALD_ORE
    - GOLD_ORE
    - DEEPSLATE_GOLD_ORE
    - IRON_ORE
    - DEEPSLATE_IRON_ORE
    - COAL_ORE
    - DEEPSLATE_COAL_ORE
    - LAPIS_ORE
    - DEEPSLATE_LAPIS_ORE
    - REDSTONE_ORE
    - DEEPSLATE_REDSTONE_ORE
    - COPPER_ORE
    - DEEPSLATE_COPPER_ORE
    - ANCIENT_DEBRIS
    - CAVE_AIR
  # Extra hidden blocks that only apply down in the nether, piled on
  # top of the base list while someone is there.
  hidden-blocks-nether:
    - ANCIENT_DEBRIS
    - NETHER_GOLD_ORE
    - GILDED_BLACKSTONE
    - NETHER_QUARTZ_ORE
  hidden-blocks-end:
    - ENDER_CHEST
  # Blocks the sight test looks straight through, even when Bukkit
  # insists they block the view. Glass houses need honest rays too.
  transparent-blocks:
    - GLASS
    - TINTED_GLASS
    - WHITE_STAINED_GLASS
    - OAK_LEAVES
    - ICE
    - COBWEB
    - LADDER
    - SCAFFOLDING
    - CHAIN
    - BELL
    - LANTERN
    - BARRIER
    - LIGHT
    - SNOW
    - GRASS_BLOCK
    - VINE
    - KELP
    - SEAGRASS
  # What xray users see instead of the good stuff. Pick something dull.
  replacement-block: STONE
  # .... The tracing crew ....
  # How often a slice of online players gets rechecked, in ticks.
  update-ticks: 5
  # Extra hands for the bookkeeping (the actual world tracing stays on the
  # main thread inside the budget below, Bukkit hates thread visitors).
  ray-trace-threads: 2
  # How many milliseconds one recheck tick may spend. Leftovers wait for
  # the next run. Lower means less server sweat and slower reveals.
  ms-per-ray-trace-tick: 25
  # Past this eye distance blocks are left alone entirely. Wide on
  # purpose: the millisecond budget below caps the work, not this
  # number, and TPS dips halve the workload instead of opening holes.
  ray-trace-distance: 96.0
  # Also check from third-person camera spots. Costs extra rays.
  ray-trace-third-person: false
  # Put revealed blocks back into hiding once nobody can see them.
  rehide-blocks: true
  # At or past this eye distance a block counts as unseen for re-hiding.
  # Kept wider than the trace distance so far cover never flickers.
  rehide-distance: 128.0
  # Protected blocks handled per player per run, nearest first.
  max-ray-trace-block-count-per-chunk: 160
  # More blocks to trace on top of hidden-blocks. Empty means just those.
  ray-trace-blocks: []
  # Also hide chests, shulkers and barrels until seen. Strong on survival
  # servers, but hidden containers can confuse honest players, opt in only.
  hide-block-entities: false
  # Old key names, still respected if the new ones are missing.
  raytrace-distance: 8
  raytrace-rays: 128
  reprocess-distance: 4
  obfuscate-caves: true

# ════════════════════════════════════════════════════════════════════
#  ANTI-ESP ~ starving wallhacks
# ════════════════════════════════════════════════════════════════════
#  ESP itself lives on the cheater's screen where no Paper plugin can
#  prove it, so this section starves it instead: less to see, plus a
#  mining luck audit that taps staff on the shoulder (never VL, just a
#  lead). A moved freecam camera alone learns nothing here either.
anti-esp:
  enabled: true
  audit-valuables:
    - DIAMOND_ORE
    - DEEPSLATE_DIAMOND_ORE
    - EMERALD_ORE
    - DEEPSLATE_EMERALD_ORE
    - ANCIENT_DEBRIS
    - GOLD_ORE
    - DEEPSLATE_GOLD_ORE
  # Speak up when someone finds this many valuables in the window while
  # breaking fewer blocks per find than the number below.
  audit-min-valuables: 8
  audit-window-minutes: 30
  audit-max-stone-per-valuable: 64.0
  # Living things with no line of sight never reach the client, so ESP
  # has nothing to draw through walls. A few nearest mobs and players
  # per run, one ray each. Glass and leaves never count as cover.
  entity-hiding:
    enabled: true
    radius: 64.0
    interval-ticks: 10
    players-per-run: 4
    entities-per-player: 8
    close-range: 5.0

════════════════════════════════════════════════════════════════════

SUS MENU ~ the evidence board

════════════════════════════════════════════════════════════════════

Rows 1 to 5 show flags (45 a page, newest first) and row 6 steers the

ship: back (slot 45), player head (47), close (49), client card (51),

next (53). Every label takes & colors and &#RRGGBB hex.

sus-gui:

How far back /sus and /paragon client dig for flags.

history-minutes: 10 title: "&8| &f%player% &8(&7%page%&8/&7%pages%&8)" filler-material: GRAY_STAINED_GLASS_PANE prev: material: ARROW name: "&e← Previous page" next: material: ARROW name: "&eNext page →" close: material: BARRIER name: "&cClose" client: material: BOOK name: "&bClient & suspected modules" summary: name: "&f%player%" lore: - " &8│ &7Ping &8» &f%ping%ms" - " &8│ &7Total VL &8» &f%violations%" - " &8│ &7Flags shown &8» &f%flags%" - " &8│ &7Session &8» &f%playtime%" empty: name: "&aClean record" lore: "&7No flags in the last %minutes%m." flag: name: "&b%display% &8(&7%check%&8)" lore: - " &8│ &7Category &8» &f%category%" - " &8│ &7Info &8» &f%info%" - " &8│ &7Weight &8» &f+%vl% VL &8(&7%mitigated%&8)" - " &8│ &7Ping &8» &f%ping%ms &8│ &7When &8» &f%ago%" category-materials: COMBAT: IRON_SWORD MOVEMENT: LEATHER_BOOTS WORLD: DIAMOND_PICKAXE MISC: PAPER

════════════════════════════════════════════════════════════════════

CLIENT DETECTION ~ reading name tags

════════════════════════════════════════════════════════════════════

Brand strings are self-reported, so take them with salt. Meteor (a

Fabric mod) usually says "fabric", and Wurst loves to say "vanilla",

which proves exactly nothing alone. Paragon pairs the brand with what

the player actually DOES: peek /paragon client or /sus for the guessed

module list. Only hard-block a brand here when you are truly sure.

client-detection: enabled: true announce-to-staff: true

UNKNOWN and VANILLA joins get chatty on big servers. Cheat brands and

modded loaders still get announced with these off.

announce-unknown: false announce-modded-loaders: true

Bedrock name prefix (default "."). Names starting with it count as

Bedrock next to Floodgate detection, which also covers you when

Floodgate isn't even installed. Empty turns prefix matching off.

bedrock-dot-prefix: "."

Identity alone never kicks or bans here (spoofing makes that unsafe).

Proven cheat mods get caught by the silent probe instead, see the

translation-probe section below and /paragon modcheck.

════════════════════════════════════════════════════════════════════

TRANSLATION PROBE ~ asking the client what it knows

════════════════════════════════════════════════════════════════════

Per sign, inside a single tick, the server sends a fake sign block,

the sign text (translation keys), an open-editor, an instant close

and the cleanup. That instant close makes the client hand its text

back with zero visible UI: no block, no editor, no clicking needed.

A client carrying the mod answers with the resolved words, everyone

else answers with the random fallback. Kicks, staff alerts and

/paragon modcheck drink from here.

translation-probe: enabled: true

Check every join on its own, shortly after arrival.

probe-on-join: true

Seconds before an unanswered probe is quietly dropped.

timeout-seconds: 60

How long one sign waits for its answer before its keys get marked

inconclusive and the next sign goes out.

protected-timeout-ms: 800

The decoy text on every probed line. Whoever lacks the key echoes

exactly this (plus some random glitter), whoever has the mod echoes

the real words. This little string is the whole trick.

fallback-text: "md_probe"

Name your mod, point at its translation key. Anything shipping

language keys can join the list.

keys: Meteor Client: "key.meteor-client.open-gui" Meteor Commands: "key.meteor-client.open-commands" Wurst Client: "description.wurst.hack.clickgui" LiquidBounce: "liquidbounce.generic.error" Freecam: "key.freecam.toggle" Accurate Block Placement: "text.autoconfig.accurateblockplacement.title" Item Scroller: "itemscroller.gui.button.config_gui.generic" # .... The big cheat drawer, help yourself .... Impact Client: "impact.gui.click.title" RusherHack: "rusherhack.gui.title" Inertia: "inertia.hud.title" ThunderHack: "descriptions.client.clickgui" Jex Client: "jex.name" Lumina Client: "key.lumina.open_click_gui" Hypnotic Client: "key.hypnotic-client.open-click-gui" Glazed Client: "key.glazed.activate-key" Wave Client: "key.category.wave-client.wave-client" CheatUtils: "category.zergatul.cheatutils" Client Spoofer: "clientspoofer.options.title" Custom Client Brand: "text.autoconfig.customclientbrand.title" Rebrand: "text.autoconfig.rebrand.title" X-Ray: "xray.config.toggle" SpeedHack: "key.speedhack.decrease" WallHack: "key.categories.wallhack" PingBypass: "pingbypass.key.open" AutoAttack: "key.autoattack.afkAttack" ChestESP: "key.chestesp.toggle" PlayerESP: "category.playeresp.main" KillAura: "key.killaura" Crystal Core: "key.crystalcore.toggle" Spear Core: "key.spearcore.roll" Bridging Mod: "key.category.bridgingmod.category" SeedCracker: "finder.outposts" Baritone: "baritone.overlay.cancel" BleachHack: "bleachhack.title" Mace Attack Assistance: "key.category.mace_attack_assistance" Gamma Utils: "key.gammautils.maxGamma" See-Through-Lava: "text.autoconfig.seethroughlava.title" Perspective: "key.perspective.toggle" FlyMod: "key.flymod.toggle" StepUp: "key.stepup.toggle" AutoSwitch: "key.autoswitch.toggle" AutoFish: "key.autofish.open_gui" Tweakeroo: "tweakeroo.message.toggled" Axiom: "axiom.keybind" InvMove: "key.invmove.modules" Litematica: "litematica.gui.button.change_menu.to_main_menu" Xaero Minimap: "gui.xaero_minimap_settings" Reach Circle: "text.autoconfig.reach_circles.title" BetterHitreg: "key.category.betterhitreg.hitreg" Meteor Plus: "item.meteorplus.logo" Meteor Additions: "meteor-additions.presets" Meteorist: "modmenu.descriptionTranslation.meteorist" Meteor GUI Title: "text.meteor-client.gui.title" Meteor Speed: "modules.meteor-client.speed" Wurst Main Menu: "gui.wurst.title.mainmenu" LiquidBounce Tab: "liquidbounce.tab.main" LiquidBounce Toggle: "liquidbounce.generic.enabled" CatLean: "gui.version.no" Kenzo Hack: "effect.hack_client_mod.landinghack" MadXray: "key.categories.madxray" HcScr: "key.category.hcscr.root" Mini Hacks: "gui.hacksfab.hack.button_one_shot" X-Ray Config: "xray.config.open" X13 X-Ray: "x13.mod.xray" TeleportHack: "tph.key.activate" Auto Shield Breaker: "mod.autoshieldbreaker.name" Spawn Radar: "key.category.spawn_radar.title" Omniscience: "key.category.omniscience" HitRange: "key.category.hitrange.key" ExploitPreventer: "exploitpreventer.disclaimer.title" Cart Core: "key.cartcore.crossbowcart" Combat Plus: "gamerule.category.combat-plus" Combatify: "text.config.combatify-general.option.autoAttackAllowed" GavinsMod: "gavinsmod.mod.tracer.chest" Entity Outliner: "key.entity-outliner.selector" Visible Shield CD: "config.visible_shield_cd.title" Global Macros: "text.globalmacros.title" Multi Key Bindings: "multi.toggle.key.attack" SeedCracker Map: "key.seedMap" SeedCracker Info: "info.worldSeeds" Gamma Max: "effect.gammautils.dim" Xaero Freelook: "xaero.freelook.toggle" Camera Zoom: "key.camerautils.zoom" StepUp Key: "key.stepup.toggle" Crawl Key: "key.crawl" Climb Fast: "key.climbladdersfast.toggle" Precise Placing: "key.preciseblockplacing.toggle_enabled" Faster Placement: "key.categories.fasterblockplacement" Pro Placer: "key.proplacer.fast_placement" Smart Placement: "key.smartblockplacement.switch_smart_placement" AutoTools: "key.autotools.get_tool" AutoEat: "key.category.autoeat.main" AutoTotemLight: "key.autototemlight.totem_swap" AutoElytra: "title.autoelytra.config" Auto Mace Swap: "key.maceswap.elytra" Auto Tool Swap: "toolswap.configuration.title" NoDelay: "key.nodelaymod.toggle_ndo" NoJumpDelay: "text.autoconfig.nojumpdelay.title" Player Highlighter: "key.playerhighlighter.toggle" Schematic Printer: "schematic.key.toggle" MaLiLib: "malilib.gui.title.debug" TweakerMore: "tweakermore.hotkeys.category.main" QuickTurn: "key.vekquickturn.quickturn" Elytra Swap: "key.ecs.swap" ViaFabricPlus: "base.viafabricplus.on" Trajectory: "ptp.config.trajectory_color" Hotbar Optimizer: "text.dho.config.screen" TNTHelper: "tnth.key.toggle" WorldEdit CUI: "cui.menu.toggle" Chest Tracker: "key.chesttracker.open_gui" EasierChests: "key.easierchests.sortchest" Shoulder Surfing: "key.shouldersurfing.free_look" World Preview: "world_preview.preview.title-full" WorldTools: "worldtools.key.categories" ClientCommands: "commands.cplugins.found" ClientSort: "clientsort.name" CommandKeys: "key.commandkeys.main" Account Switcher: "ias.title" Camera Tweaks: "category.cameratweaks.cameratweaks" Camera Enhancements: "camenh.config.title" VisibleBarriers: "category.visiblebarriers" SeedFinder: "generator:seedfindermod:seed_finder_world" PlayerTracker: "text.autoconfig.playertracker.option.enabled" Player Locator: "text.autoconfig.player-locator-plus.option.enabled" QuickHotkeys: "key.glitchifyed.quick_hotkeys.equip_totem" InventoryTabs: "key.inventory_tabs.key.next_tab" Vivecraft: "vivecraft.key.guiLeftClick" Flashback: "key.category.flashback.keybind" Crash Assistant: "warnings.codex_crash_assistant_comment" VoyageMap: "worldmap.title" Pixel Minimap: "key.minimap2.show_map" MapLink: "maplink.category.minimap" VoxelMap: "key.minimap.voxelmapmenu" XaeroPlus: "xaeroplus.gui.on" Xaero Chest Tracker: "xaeros-map-chest-tracker-integration.noMinimapFound.message" Trade Cycling: "key.trade_cycling.cycle_trades" Health Indicators: "key.healthindicators.renderingEnabled" Replay Mod: "key.record.desc" Zergatul Freecam: "key.zergatul.freecam.toggle" Freecam Fork: "key.category.fcam.freecam" Freecam Config: "freecam.config.title" Freecam Title: "text.freecam.title" Perspective Enabled: "perspective.enabled" Meteor Plus: "item.meteorplus.logo" Meteor Additions: "meteor-additions.presets" Meteorist: "modmenu.descriptionTranslation.meteorist" Meteor GUI Title: "text.meteor-client.gui.title" Meteor Speed: "modules.meteor-client.speed" Wurst Main Menu: "gui.wurst.title.mainmenu" LiquidBounce Tab: "liquidbounce.tab.main" LiquidBounce Toggle: "liquidbounce.generic.enabled" Konas: "key.konas.menu" CatLean: "gui.version.no" Kenzo Hack: "effect.hack_client_mod.landinghack" MadXray: "key.categories.madxray" HcScr: "key.category.hcscr.root" Mini Hacks: "gui.hacksfab.hack.button_one_shot" X-Ray Config: "xray.config.open" X13 X-Ray: "x13.mod.xray" TeleportHack: "tph.key.activate" Auto Shield Breaker: "mod.autoshieldbreaker.name" Spawn Radar: "key.category.spawn_radar.title" Omniscience: "key.category.omniscience" HitRange: "key.category.hitrange.key" ExploitPreventer: "exploitpreventer.disclaimer.title" Cart Core: "key.cartcore.crossbowcart" Combat Plus: "gamerule.category.combat-plus" Combatify: "text.config.combatify-general.option.autoAttackAllowed" GavinsMod: "gavinsmod.mod.tracer.chest" Entity Outliner: "key.entity-outliner.selector" Visible Shield CD: "config.visible_shield_cd.title" Global Macros: "text.globalmacros.title" Multi Key Bindings: "multi.toggle.key.attack" SeedCracker Map: "key.seedMap" SeedCracker Info: "info.worldSeeds" Gamma Max: "effect.gammautils.dim" Xaero Freelook: "xaero.freelook.toggle" Camera Zoom: "key.camerautils.zoom" StepUp Key: "key.stepup.toggle" Crawl Key: "key.crawl" Climb Fast: "key.climbladdersfast.toggle" Precise Placing: "key.preciseblockplacing.toggle_enabled" Faster Placement: "key.categories.fasterblockplacement" Pro Placer: "key.proplacer.fast_placement" Smart Placement: "key.smartblockplacement.switch_smart_placement" BetterHitreg Key: "key.category.betterhitreg.hitreg" AutoTools: "key.autotools.get_tool" AutoEat: "key.category.autoeat.main" AutoTotemLight: "key.autototemlight.totem_swap" AutoElytra: "title.autoelytra.config" Auto Mace Swap: "key.maceswap.elytra" Auto Tool Swap: "toolswap.configuration.title" NoDelay: "key.nodelaymod.toggle_ndo" NoJumpDelay: "text.autoconfig.nojumpdelay.title" Player Highlighter: "key.playerhighlighter.toggle" Schematic Printer: "schematic.key.toggle" MaLiLib: "malilib.gui.title.debug" TweakerMore: "tweakermore.hotkeys.category.main" QuickTurn: "key.vekquickturn.quickturn" Elytra Swap: "key.ecs.swap" ViaFabricPlus: "base.viafabricplus.on" Trajectory: "ptp.config.trajectory_color" Hotbar Optimizer: "text.dho.config.screen" TNTHelper: "tnth.key.toggle" WorldEdit CUI: "cui.menu.toggle" Chest Tracker: "key.chesttracker.open_gui" EasierChests: "key.easierchests.sortchest" Shoulder Surfing: "key.shouldersurfing.free_look" World Preview: "world_preview.preview.title-full" WorldTools: "worldtools.key.categories" ClientCommands: "commands.cplugins.found" ClientSort: "clientsort.name" CommandKeys: "key.commandkeys.main" Account Switcher: "ias.title" Camera Tweaks: "category.cameratweaks.cameratweaks" Camera Enhancements: "camenh.config.title" VisibleBarriers: "category.visiblebarriers" SeedFinder: "generator:seedfindermod:seed_finder_world" PlayerTracker: "text.autoconfig.playertracker.option.enabled" Player Locator: "text.autoconfig.player-locator-plus.option.enabled" QuickHotkeys: "key.glitchifyed.quick_hotkeys.equip_totem" InventoryTabs: "key.inventory_tabs.key.next_tab" Vivecraft: "vivecraft.key.guiLeftClick" Flashback: "key.category.flashback.keybind" Crash Assistant: "warnings.codex_crash_assistant_comment" VoyageMap: "worldmap.title" Pixel Minimap: "key.minimap2.show_map" MapLink: "maplink.category.minimap" VoxelMap: "key.minimap.voxelmapmenu" XaeroPlus: "xaeroplus.gui.on" Xaero Chest Tracker: "xaeros-map-chest-tracker-integration.noMinimapFound.message" Trade Cycling: "key.trade_cycling.cycle_trades" Health Indicators: "key.healthindicators.renderingEnabled" Replay Mod: "key.record.desc" Zergatul Freecam: "key.zergatul.freecam.toggle" Freecam Fork: "key.category.fcam.freecam" Freecam Config: "freecam.config.title" Freecam Title: "text.freecam.title" Perspective Enabled: "perspective.enabled"

Honeypot keys: real vanilla words every clean client resolves. If

one comes back unanswered, something is eating translations to hide.

Watching only, never punishing.

trap-keys: - "item.minecraft.bone" - "item.minecraft.diamond" - "gameMode.survival"

Keybind style keys: matched as key buttons, not translations, because

these phrases live in no language file at all.

keybind-keys: - "meteor.key.open-commands" - "key.wurst.zoom" - "Ethanol" - "Open paradise command" - "key.xynis.gui" - "key.autoattack.auto_attack_toggle" - "key.shieldbreaker.open_gui" - "key.chestfinder.gui" - "key.epitex.toggle_auto_armor" - "Elytra-Chestplate Swapping" - "key.worlddownloader.export" - "key.autocart.activate" - "Restore Screen" - "key.raax.toggle_xray" - "key.autoclicker-rinf.toggleacf" - "key.slotswap.swap" - "key.trade_cycling.cycle_trades" - "key.freecam.controlPlayer.toggle" - "key.freecam.tripod.reset" - "key.freecam.config.open" - "key.maceswap.swordswap" - "key.p1x3lc0w.invutil.autoTool" - "key.epitex.category_auto_armor" - "key.freecam.controlPlayer.toggle" - "key.freecam.tripod.reset" - "key.freecam.config.open" - "key.maceswap.swordswap" - "key.p1x3lc0w.invutil.autoTool" - "key.epitex.category_auto_armor" known-brands: VANILLA: ["vanilla"] LUNAR: ["lunarclient", "lunar"] FEATHER: ["feather"] FABRIC: ["fabric"] FORGE: ["forge", "fml"] NEOFORGE: ["neoforge"] QUILT: ["quilt"] LITELOADER: ["liteloader"] BADLION: ["badlion", "blc"] LABYMOD: ["labymod"] METEOR: ["meteor"] WURST: ["wurst"] LIQUIDBOUNCE: ["liquidbounce"] ARISTOIS: ["aristois"] IMPACT: ["impact"] FUTURE: ["future"] RUSHER: ["rusherhack", "rusher"] INERTIA: ["inertia"] BLEACH: ["bleachhack", "bleach"] SIGMA: ["sigma"] VAPE: ["vape"] KRYPTON: ["krypton"] DRIP: ["drip"] ASTOLFO: ["astolfo"] ENTROPY: ["entropy"] AUGUSTUS: ["augustus"] PRESTIGE: ["prestige"] BOZE: ["boze"] MYAU: ["myau"] MIO: ["mio"] AMBIENT: ["ambient"] VOIL: ["voil"] ECHO: ["echo"] BREEZE: ["breeze"] PHANTOM: ["phantom"] NURSULTAN: ["nursultan"] WILD: ["wild"] CELESTIAL: ["celestial"] AKRIEN: ["akrien"] ARBUZ: ["arbuz"] DOG: ["dog"] DQRKIS: ["dqrkis"] OPAL: ["opal"] ADMIRAL: ["admiral"] MOON: ["moon"] SLINKY: ["slinky"] KONAS: ["konas"] THUNDERHACK: ["thunderhack"] LUMINA: ["lumina"] FREECAM: ["freecam"] FORGEHAX: ["forgehax"] BARITONE: ["baritone"] SEEDCRACKER: ["seedcracker", "seedfinder", "seedmap"] XRAYMOD: ["xray", "x13"] ESSENTIAL: ["essential"] CHEATBREAKER: ["cheatbreaker", "cbclient"] XAERO: ["xaero"] REPLAYMOD: ["replaymod"] DISTANTHORIZONS: ["distant_horizons", "distant horizons"] SALWYRR: ["salwyrr"] PRISMLAUNCHER: ["prismlauncher", "polymc"] OPTIFINE: ["optifine", "of"] SODIUM: ["sodium"] IRIS: ["iris"] TLAUNCHER: ["tlauncher"] BEDROCK: ["bedrock", "geyser"]

════════════════════════════════════════════════════════════════════

MOD BLOCKER ~ who gets through the door

════════════════════════════════════════════════════════════════════

Reads the plugin channels every client announces on join. Blacklist

mode kicks whoever shows up with something from blocked-mods; flip

use-whitelist-mode and it works the other way round, only letting the

whitelisted ones in (minecraft, paper and bukkit are always fine).

Bedrock players skip this entirely, they can't carry Java mods anyway.

mod-blocker: enabled: true

How long to wait after join before checking. Channels need a moment

to arrive, 40 ticks (2 seconds) is the sweet spot.

check-delay-ticks: 40 use-whitelist-mode: false debug: false blocked-mods: - wurst - meteor-client - inertia - aristois - kami - lambda - xray - killaura whitelisted-mods: - fabric - optifine - sodium - lithium - iris kick-message: "&cDisallowed mods detected: %mods%"

════════════════════════════════════════════════════════════════════

SPOOF CHECKS ~ catching liars

════════════════════════════════════════════════════════════════════

Little cross-checks that need no mod list. They just tap staff on the

shoulder, never punish on their own.

spoof-checks:

Says "vanilla" but talks on mod channels. Real vanilla never does that.

vanilla: true

Says "Geyser" but Floodgate swears they are on Java.

geyser: true

Never sent a brand at all. Every real client sends one.

no-brand: true

Known magic channel strings from cracked and leaked clients.

cracked: true

════════════════════════════════════════════════════════════════════

MOD DETECTION ~ the bouncer

════════════════════════════════════════════════════════════════════

Watches every join twice: once right away (brand and channels), once a

few seconds later (the silent probe). Only mods marked punishable get

someone kicked, and the kick screen names them. Everything else just

becomes evidence for /paragon modcheck. A mod counts as punishable when

its built-in flag agrees AND its category switch below is on, unless you

allow-listed it. Anything in punish-mods always counts. Names match

loosely, so "meteor" catches every Meteor build out there.

mod-detection: enabled: true

How soon after join the first look happens.

passive-eval-delay-ms: 250

How soon after join the silent probe runs.

probe-delay-ms: 3000

Kick people who openly announce a cheat brand or channel.

passive-punish: true

Category switches. CHEAT means the real stuff: wurst, meteor,

prestige and friends.

punish-cheats: true punish-suspicious: false punish-launchers: false punish-utilities: false

Hands off these, no matter what (launchers, not cheats).

allowed-mods: - fire-client - dawn-client - lunar

Always punish these, whatever the categories say.

punish-mods: []

════════════════════════════════════════════════════════════════════

SEED PROTECTION ~ keeping your world seed yours

════════════════════════════════════════════════════════════════════

Seed crackers triangulate your world seed from terrain and structures.

This fights back on two fronts: players never get real answers (/seed

is blocked, /locate makes up coordinates), and your structure seeds get

shuffled in spigot.yml so structures stop matching the seed at all.

Shuffled seeds need one restart before new chunks pick them up.

seed-protection: enabled: true block-seed-commands: true extra-blocked-commands: - seedcracker - seedfind spoof-locate: true randomize-structure-seeds: true

════════════════════════════════════════════════════════════════════

SCREENSHARE ~ the interrogation room

════════════════════════════════════════════════════════════════════

/ss freeze pulls a suspect into the waiting room: blinded, slowed down,

glowing, cut off from chat and commands until staff are done with them.

Stand wherever suspects should wait and run /ss setlocation, it saves

the spot right here. /ss unfreeze walks them back to where they stood.

screenshare: enabled: true waiting-room: world: "" x: 0.5 y: 100.0 z: 0.5 teleport-back: true private-chat: true max-warns: 3

════════════════════════════════════════════════════════════════════

PLAYER REPORTS ~ letting players snitch

════════════════════════════════════════════════════════════════════

/report, for everyone. Staff hear about it in game, and if you paste a

Discord webhook below, every report lands there too, nicely formatted

with both names, a timestamp and the reported player's head.

reports: enabled: true cooldown-seconds: 30

Empty means no Discord, reports stay in game only.

webhook-url: ""

════════════════════════════════════════════════════════════════════

ALERT RESPONSES ~ softening cheaters up first

════════════════════════════════════════════════════════════════════

Before anyone gets banned, suspects quietly start hitting like wet

noodles. The more VL they stack, the weaker they get. Reduction is a

cut: 0.70 takes 70% of their damage away for the stage duration.

alert-responses: damage-reduction: enabled: true stage1-vl: 10 stage1-reduction: 0.05 stage1-seconds: 8 stage2-vl: 20 stage2-reduction: 0.35 stage2-seconds: 12 stage3-vl: 30 stage3-reduction: 0.70 stage3-seconds: 16

════════════════════════════════════════════════════════════════════

BAN ANIMATION ~ making an example of them

════════════════════════════════════════════════════════════════════

Instead of vanishing quietly, caught cheaters get pinned in place

while a giant mace drops out of the sky onto them, lightning cracks

on impact, and then the configured ban command runs. Set enabled:

false for instant bans with no theatre.

ban-animation: enabled: true type: classic_ban

Straight-down angle of the falling mace, in degrees. The texture is

drawn diagonally, so 135 stands it fully upright, head to the

ground. Nudge it only if the hammer ever looks tilted on your build.

mace-tilt-degrees: 135.0

════════════════════════════════════════════════════════════════════

DATABASE ~ where the paperwork lives

════════════════════════════════════════════════════════════════════

Flags, punishments and kick counts have to live somewhere. LOCALDB is

a data.db file right here in the plugin folder, no setup, and the

default. SQLITE is the classic paragon.db file from older builds. H2

is a heavier embedded database in its own files. YAML skips databases

entirely and uses data.yml, which you can just open and read.

database: backend: LOCALDB

How many log lines data.yml keeps per list before trimming (YAML only).

yaml-max-logs: 2000

════════════════════════════════════════════════════════════════════

ANTI-FREECAM ~ burying the underground

════════════════════════════════════════════════════════════════════

Everything below max-hidden-y is solid fill on the client until you get

close enough to actually see it. Your own tunnel opens up around you as

you walk, nearby blocks pop in on their own, and far caves only render

where you genuinely have line of sight. A detached freecam camera sees

nothing but fill. Climb back to daylight and it all re-hides at once.

anti-freecam: enabled: true

Below this Y everything hides until you go underground yourself.

max-hidden-y: 15

Chunks around you that open up with no questions asked.

reveal-width-chunks: 3

This close and blocks open up unconditionally, so your own walls and

floor are never fill, whatever the rays say.

reveal-range: 5.0

Climb this far above max-hidden-y and the underground re-hides in one go.

reveal-height: 35.0

How far past your base width genuine line of sight can still open caves.

reveal-distance-chunks: 8

Columns opened per scan tick. Higher pops in faster, lower is gentler.

max-reveals-per-scan: 8

How often the whole thing rechecks, in ticks. Lower is snappier.

scan-interval-ticks: 8

Hide mobs and friends inside hidden ground too, so they don't float

through the fill on a cheater's screen.

entity-hiding: true

What the hidden underground looks like from the outside.

fill-block: deepslate

Folder names of the worlds this guards, exactly as on disk.

protected-worlds: - world

Resend chunks after opening them, dodges a 1.21 client mesh bug.

force-chunk-refresh: true

</details>

---

## MOD DETECTION
!ImageOfModBlock
 **140+ KNOWN MODS** - Meteor, Wurst, LiquidBounce, Prestige, Aristois, ThunderHack, Xray family, SeedCracker, Baritone, helpers, minimaps and launchers.

 **MOD BLOCKER** - channel gate with blacklist and whitelist mode, on by default, for servers that want hard mod control.

 **SPOOF TRAPS** - fake vanilla brands with mod channels, fake Geyser brands, missing brands, cracked client magic strings and translation interceptors.

 **LIVE SELF TEST** - `/paragon probetest` narrates a full probe into chat and console, so you always see exactly what the scanner sees.

---

## WORLD PROTECTION

 **RAYTRACE ANTI XRAY** - hidden ores stay hidden until real line of sight exists, per dimension lists, glass aware rays, border safe. Layer it over Paper engine mode 1.
!Replace this with a description
 **ANTI FREECAM** - the underground renders as solid fill until you walk, approach or truly see it. Detached cameras see nothing. Entities hide in the dark too.

 **ANTI ESP** - protected block and container awareness plus mining luck audits for staff.

 **SEED PROTECTION** - seed commands blocked, locate answers faked, structure seeds shuffled so crackers cannot triangulate your world.

---

## STAFF TOOLKIT



 **SCREENSHARE MODE** - `/ss freeze` pulls suspects to your set room, blinded and muted, and walks them back on release. Notes, warns, history, blacklist and self admit included.

 **PLAYER REPORTS** - `/report` for everyone with cooldown, staff alerts, review list and a Discord embed webhook with reporter, reported, timestamp, reason and head thumbnail.

 **INSPECTION** - `/sus` flag timeline GUI, `/paragon client` module inference, `/paragon modcheck` full mod report, `/paragon violations` live VL, `/paragon xray` pipeline status.

 **BAN HAMMER** - a giant upside down mace falls on the cheater with lightning on impact, for automatic and manual bans alike. Plus quiet damage reduction while VL builds.

---

## COMMANDS AND PERMISSIONS

| Command | Who | What |
|---|---|---|
| `/paragon` | Everyone | Version line |
| `/paragon help` | Everyone | Command list |
| `/paragon alerts` | Staff | Toggle your flag inbox |
| `/paragon violations, info, client, xray, reports` | Admins | Inspect players and pipeline |
| `/paragon modcheck, probetest` | Modcheck and Admin | Full mod report, live probe test |
| `/paragon modblock, exempt, reset, ban, unban, reload` | Admins | Manage and punish |
| `/sus` | `paragon.sus` | Flag timeline GUI |
| `/ss` | `paragon.ss` | Screenshare workflow |
| `/report` | Everyone | Snitch with cooldown |

Per check opt outs included: `paragonac.exempt.<check>` for a whole check, `paragonac.exempt.<check><letter>` for one sub check, `paragonac.exempt.*` for everything. `paragon.bypass` skips it all, `moddetector.bypass` skips mod scanning only.

---

## STORAGE AND SETUP

| | |
|---|---|
| **Server** | Paper 1.21.11 or forks |
| **Database** | LocalDB file by default, SQLite or plain YAML if you prefer reading it |
| **Bedrock** | Geyser plus Floodgate, or dot prefix matching without Floodgate |
| **Discord** | Optional webhook for player reports |

Drop the jar in `/plugins`, restart, done. Open `config.yml`, everything reads like plain advice, and `messages.yml` styles every line the plugin ever sends.

---

## ALL 63 CHECKS

### Movement (20)

| Check | What It Catches |
|---|---|
| **Flight** | Rising outside gravity, hovering in place |
| **Speed** | Momentum breaks plus sustained over speed ceilings |
| **Step** | Stepping higher than vanilla allows |
| **NoFall** | Fake ground claims while falling |
| **Timer** | Game speed above 20 packets per second |
| **Velocity** | Ignored knockback, wall and ceiling aware |
| **NoSlow** | Full speed while eating or drawing a bow |
| **Phase** | Moving through solid blocks |
| **ElytraFly** | Impossible elytra speed and boostless climbs |
| **Rotation** | Bad pitch, NaN tricks, spinbot and AntiAim |
| **Jesus** | Walking on water and lava |
| **Blink** | Held packets with a live connection |
| **ClickTP** | Instant teleport in one packet |
| **BunnyHop** | Machine perfect jump timing |
| **GroundSpoof** | Fake on ground flags over thin air |
| **TickShift** | Stored ticks dumped in one burst |
| **BoatFly** | Flying vehicles, driver gets ejected |
| **HighJump** | Jump boosts above vanilla impulse |
| **Spider** | Climbing walls with no ladder |
| **NoWeb** | Full speed inside cobwebs |

### Combat (26)

| Check | What It Catches |
|---|---|
| **Reach** | Hits past range with attacker side rewind |
| **KillAura** | Multi target bursts plus off angle hits |
| **AutoClicker** | CPS caps, consistency and macro intervals |
| **ClickPattern** | CV, autocorrelation and entropy of clicks |
| **AimAssist** | Snap aims plus GCD sensitivity locking |
| **TriggerBot** | Machine reaction timing |
| **Critical** | Spoofed critical hits |
| **Hitbox** | Expanded hitboxes |
| **Angle** | Hitting targets behind the back |
| **AutoBlock** | Hitting while the shield is up |
| **AutoSwap** | Swap hit swap macros with pair oscillation tracking |
| **AutoSpear** | Swap to spear plus sprint lunge coupling and replay |
| **AutoMace** | Mace swings and smashes on a fixed timer |
| **AutoBreach** | Breach mace swap shredding on robot timing |
| **AttackCooldown** | Full damage at zero 1.9 charge |
| **NoSwing** | Silent aura with no arm swing |
| **KeepSprint** | Sprint kept through every hit |
| **ThroughWall** | Hits through solid blocks |
| **MaceDamage** | Grounded smash spoof, cloned heights, swap smash |
| **SpearLunge** | Swap lunges plus macro lunge replay |
| **CrystalAura** | Place and break cycles, reaction, consistency |
| **AnchorAura** | Anchor automation sequences |
| **BedAura** | Bed automation sequences |
| **AutoTotem** | Totem refills by reaction, spread and refill stats |
| **NoHurtCooldown** | Hits faster than damage cooldown |
| **FastBow** | Arrows faster than draw time |

### World (8)

| Check | What It Catches |
|---|---|
| **Scaffold** | Bridge assists by cadence, sight and pattern |
| **FastPlace** | Placing faster than possible |
| **FastBreak** | Breaking faster than tool timing |
| **Nuker** | Mass breaking with instant stopping |
| **PacketMine** | Mining with no real dig sequence |
| **Xray** | Impossible mining luck statistics |
| **AirPlace** | Blocks placed against thin air |
| **InteractReach** | Reaching blocks and entities too far away |

### Misc (9)

| Check | What It Catches |
|---|---|
| **BadPackets** | NaN spots, bad pitch, burst and order abuse |
| **PingSpoof** | Farmed latency and stalled responses |
| **FastUse** | Fast eating plus bottle, pearl and potion spam |
| **Inventory** | Inhuman menu click bursts |
| **ChestSteal** | Container looting machines |
| **InvMove** | Moving with a menu open |
| **AutoArmor** | Armor equip bursts |
| **MultiSignal** | Under the radar on every check but guilty overall |
| **Baritone** | Pathfinding bots by steering patterns |

---

*Built by **Ascvnd**. Running Paragon means cheaters meet physics, statistics and a bouncer that knows 140 mods by name.*