CraftHub
Arbiter AntiCheat

Arbiter AntiCheat

Anti-cheat for Spigot, Paper and Purpur 1.9 & 26.2. Watches movement, combat and items, and only acts when several checks agree.

4 downloads 0 followers

Arbiter

Evidence based anti-cheat for Spigot, Paper and Purpur

Minecraft 1.9 to 26.2 Platforms One jar

Why Arbiter | Quick Start | Checks | Item Security | Compatibility | Commands | API


Arbiter adds up several small signs before it acts, so one odd tick never gets anyone punished.


Why Arbiter

Lag, bad ping, knockback and teleports make Arbiter less suspicious, not more.

Built to avoid false flags
Evidence, not single hits Findings build a risk score that fades over time
Two checks must agree Needed before any kick or punishment
Punishments are off by default You turn them on when you are ready
Safe setbacks Loop protection stops players getting stuck
Clear alerts Shows measured versus expected values

What it covers

Movement

Speed, Fly, Step, Jesus, ground spoofing and timer

Combat

Reach, hits outside the attacker's view, multi target hits and repeated aim snaps

Rotation

Invalid pitch and input analysis

Items

Item Security Engine with six item classes and an authorization system

Attributes

Audit for scale, step height, gravity, jump strength and reach

Extras

Per player and per category risk score, API for other plugins, and JSON log files, one per day

Quick Start

  1. Drop the jar into your plugins folder and start the server.
  2. Edit the generated config.yml if you want to change thresholds.
  3. Run /arbiter alerts to see findings live.
  4. Hold any legitimate custom item and run /arbiter authorize.
  5. When you trust the results, raise kick-at and punish-at in the config.

Tip: use /arbiter debug <player> to watch one player's findings as they happen.


Checks

All 11 checks
Check Group What it looks at
Speed Movement Horizontal speed against what vanilla allows, including sprint jumps, ice, slime, potions and attributes
Fly Movement Upward movement in the air that gravity doesn't explain
GroundSpoof Movement Claiming to be on the ground with nothing underneath
Step Movement Climbing higher than a jump or step allows
Jesus Movement Standing on water
Timer Packet Sending moves faster than the tick rate allows
Rotation Rotation Invalid pitch and unnatural rotation steps
Reach Combat Distance to where the target was, based on the attacker's ping
HitDirection Combat Hitting someone far outside the view direction
MultiTarget Combat Hitting three or more targets within 100 ms
AimSnap Combat Repeated hits right after big rotation snaps
Example alert 
[Arbiter] Example Speed 91%
obs 0.421 exp 0.287 n=14 ping 34ms tps 19.970 horizontal sprinting

obs is what was measured, exp is what vanilla allows.


Item Security

Every item is sorted into one of six classes.

Class Meaning Action
VANILLA Nothing custom None
SERVER_AUTHORIZED You or a plugin approved it None
CUSTOM_BUT_SAFE Custom name, lore or modest attributes None
SUSPICIOUS Looks odd Reported
INVALID Oversized data, impossible values Removed
DANGEROUS Command click events, injection strings, extreme attributes Removed

Checked on: click, creative pick, hotbar change, use, drop, book edit, block placement and a background inventory scan.

Command blocks, structure blocks and jigsaw blocks can only be placed by ops or players with arbiter.items.command.

Approve a legitimate custom item by holding it and running /arbiter authorize.


Compatibility

One jar covers every version. Things a server doesn't have are detected on startup and switched off by themselves.

Platforms

Platform Status
Spigot Yes
Paper Yes
Purpur Yes
CraftBukkit and forks Yes
Folia No
Fabric, Forge, NeoForge, Sponge No

Versions

Version Status
1.9 to 1.12.2 Yes
1.13 to 1.20.6 Yes
1.21 to 1.21.11 Yes
26.1 to 26.2 Yes

Minecraft has no 1.9.5 to 1.9.8 releases, so the 1.9 line ends at 1.9.4.
Features by version
Feature 1.9 to 1.12 1.13 to 1.20.4 1.20.5+
Movement, combat, rotation and timer checks Yes Yes Yes
Item scan: names, lore, enchantments, click events, injection strings Yes Yes Yes
Item attribute modifier checks No Yes Yes
Reach against mobs and other non player targets No Yes Yes
Attribute audit (scale, step, gravity, jump, reach) No No Yes
Reach follows the player's interaction range attribute No No Yes

Tested so far: builds and passes its unit tests. Not yet run on every server version, so tell me if something misbehaves on yours.


Commands and permissions

Commands (alias: /arb)
Command What it does
/arbiter alerts Toggle your alerts
/arbiter profile <player> Risk per category, verdict, latest findings
/arbiter inspect <player> Tracked state, exemptions, held item class
/arbiter violations <player> Last 15 findings
/arbiter debug <player> Live stream of findings for one player
/arbiter checks Checks, status and counts
/arbiter authorize [fingerprint] Approve the held item or a fingerprint
/arbiter reload Reload the config
/arbiter test Quick self test
Permissions
Permission Default
arbiter.admin op
arbiter.alerts op
arbiter.profile op
arbiter.debug op
arbiter.reload op
arbiter.authorize op
arbiter.bypass nobody
arbiter.items.command nobody
Config 
alerts:
  min-confidence: 0.40
actions:
  setback-at: 0.65
  kick-at: 0
  punish-at: 0
  punish-command: ""
evidence:
  half-life-seconds: 20
checks:
  disabled: []
item-security:
  enabled: true
  block-dangerous: true

Every option and its default is listed in the generated config.yml.


For plugin developers

Add softdepend: [Arbiter] and use the API on the main thread.

ArbiterAPI.exempt(player, CheckType.MOVEMENT, 3000, "grapple hook");
ArbiterAPI.addExpectedVelocity(player, 1.2, 1500, "dash");
ArbiterAPI.registerMovementProvider(p -> myPlugin.controls(p));
ArbiterAPI.authorizeItem(item, "MyPlugin");
ArbiterAPI.registerItemPolicy(item -> myPlugin.isMine(item));
ArbiterAPI.getRisk(player);

Good to know

  • Small speed boosts of about 10% or less over vanilla are inside the safety margin and are not flagged on purpose. Bukkit does not show player input, so Arbiter uses a cautious upper limit.
  • Items are read through the Bukkit API. Data the API can't see can't be inspected.
  • Bedrock players through Floodgate are skipped by the rotation check.
  • Skill and ability plugins that move players or deal damage should use the API exemptions.

Reporting bugs

Include your server software and version, plus the output of /arbiter profile <player> and /arbiter checks.

Source, issue tracker and wiki links will be added here once they exist.

Version Minecraft Loader Download

Arbiter AntiCheat 1.0.0

1.0.0

1.9, 1.9.1, 1.9.2, 1.9.3, 1.9.4, 1.10, 1.10.1, 1.10.2, 1.11, 1.11.1, 1.11.2, 1.12, 1.12.1, 1.12.2, 1.13, 1.13.1, 1.13.2, 1.14, 1.14.1, 1.14.2, 1.14.3, 1.14.4, 1.15, 1.15.1, 1.15.2, 1.16, 1.16.1, 1.16.2, 1.16.3, 1.16.4, 1.16.5, 1.17, 1.17.1, 1.18, 1.18.1, 1.18.2, 1.19, 1.19.1, 1.19.2, 1.19.3, 1.19.4, 1.20, 1.20.1, 1.20.2, 1.20.3, 1.20.4, 1.20.5, 1.20.6, 1.21, 1.21.1, 1.21.2, 1.21.3, 1.21.4, 1.21.5, 1.21.6, 1.21.7, 1.21.8, 1.21.9, 1.21.10, 1.21.11, 26.1, 26.1.1, 26.1.2, 26.2
bukkit, paper, purpur, spigot
Download