🦆 DuckyAC

Configurable protection for Minecraft servers, with packet-based checks and tools for staff review.

DuckyAC monitors movement, combat, block interactions and player actions. It combines packet history with server state, collision shapes and configurable evidence buffers to identify suspicious behavior and give staff useful alerts.

75 configurable check variants · Official release · Java 21 · PacketEvents

Download · Changelog · Source code · Report an issue · Discord

---

✨ Features

• Movement checks: speed, flight, strafing, wall climbing, liquid walking, knockback, collisions and boat flight.
• Combat checks: reach, hitbox angles, attacks through blocks, target switching, critical-hit patterns and packet bursts.
• Building and player checks: scaffold patterns, trap placement, mining, item-use timing and invalid packet sequences.
• Configurable responses: violation levels, alert-only operation, command punishments, event cancellation and setbacks where supported.
• Staff review: clickable controls to confirm detections, mark false positives and undo decisions.
• Detection records: local JSON Lines storage with movement measurements, ping, TPS and check-specific context.
• Server-aware checks: configurable TPS limits and check-specific handling of teleports, external motion, game modes and terrain.
• Integrations: Discord webhooks and a public Bukkit service API for add-ons.

All bundled check variants are part of the official release. Individual checks retain their own enable switches and response settings.

📦 Requirements and installation

Component	Requirement
Server	Spigot or Paper; the current build targets the Spigot 1.20.6 API
Java	Java 21 or newer
Dependency	PacketEvents, Spigot plugin; DuckyAC builds against version 2.11.2
Configuration	Schema version 29, generated and migrated by the plugin

1. Install PacketEvents in your server's plugins/ directory.
2. Download DuckyAC and place its JAR in the same directory.
3. Start the server and check that both plugins enable successfully.
4. Edit plugins/DuckyAntiCheat/config.yml to choose checks, alert thresholds and responses.
5. Grant staff the appropriate permissions and use /duckyac reload after configuration edits.

For an upgrade, back up the existing plugin configuration and learning-data/ directory, replace the JAR while the server is stopped, then start the server to run migrations. The current build target above describes this source tree; use the Minecraft compatibility listed for the specific downloadable version when choosing a release.

---

🔍 Checks

🏃 Movement and vehicles

Check	Detection focus
AirJumpA	Repeated unnatural upward movement while airborne
FlyA	Sustained upward flight patterns
InvalidPositionA	Prolonged hovering and falling inconsistent with gravity
SpeedA	Excessive horizontal movement and modified low-hop motion
StrafeA	Implausible airborne direction changes
BunnyHopA	Repeated modified jump and air-control cycles
VelocityA-B	Reduced horizontal and vertical knockback response
PhaseA	Movement through solid collision shapes
StepA	Steps exceeding the allowed height
SpiderA-C	Stable wall climbing, repeated wall jumps and vertical climb impulses
FastClimbA-B	Excessive climb speed and clip-style movement on climbable blocks
JesusA-D	Liquid-surface movement, vertical offsets, ground claims and launches
GroundSpoofA-B	Ground-state claims inconsistent with server support
NoSlowDownA-H	Excessive movement while using items, sneaking or crossing slowing blocks
NoWebA	Suspicious movement inside cobwebs
InventoryMoveA	Movement correlated with inventory clicks
VehicleFlyA	Unsupported boat hovering, ascent and suppressed gravity, including chest boats

Terrain-aware checks use collision shapes to account for partial blocks such as carpets, slabs and stairs. VehicleFlyA combines occupied-boat positions with fresh vehicle packets and grace periods for water, bubble launches, damage and server corrections.

⚔️ Combat

Check	Detection focus
ReachA	Excessive block interaction distance
ReachB	Excessive entity attack distance, using historical hitboxes and latency compensation
HitboxA	Implausible attack angles
ThruBlocksA-B	Attacks through obstructing blocks
KillAuraA-B	Rapid target switching and missing swing evidence
CriticalsA	Suspicious critical-hit movement correlated with confirmed damage
FakeLagA	Repeated movement stalls followed by compressed packet flushes
FastBowA	Bow releases inconsistent with draw time
VehicleOneHitA	Bursts of attacks attempting to destroy a boat or minecart in one click

🪂 Elytra

Check	Detection focus
ElytraAimA	Suspicious attack cadence while flying with an elytra
ElytraCriticalsA	Repeated critical-hit behavior during elytra use
ElytraFlyA-C	Direct flight control, sustained physics deviations and automated pitch cycles
ElytraFireworkA	Highly regular automated rocket use and related inventory patterns
ElytraPacketsA	Repeated start-flying actions while already gliding

🧱 Building and placement

Check	Detection focus
AirPlaceA	Placement without plausible nearby support
AutoTrapA-B	Rapid enclosing patterns and packet-to-placement consistency
FastPlaceA-B	Excessive placement rate and unusually regular placement intervals
InvalidPlaceA	Placement inconsistent with the player's viewing angle
ScaffoldA-B	Implausible placement angles and automated placement timing

⛏️ Player actions and packets

Check	Detection focus
AutoTotemA	Extremely fast totem swaps
FastEatA	Food or potion consumption completed too quickly
FastBreakA-B	Block breaks or digging completions earlier than expected mining time
FastExpA	Implausible bursts of experience-bottle use
NukerA	Excessive or distant block-digging targets
MultiActionsA	Conflicting actions performed concurrently
BadPacketsA-F	Rotation patterns, invalid pitch or slots, action sequences, teleport confirmations and digging sequences
TimerA-D	Movement clock drift, packet rates and repeatedly compressed movement intervals

---

⚙️ Configuration

The default configuration contains the full list of settings and descriptions. Each check has its own section; additional options depend on the detector.

VehicleFlyA example:

vehicle-fly-a:
  enabled: true
  alert-only: false
  min-tps: 19.0
  window-ticks: 8
  required-samples: 3
  gravity-tolerance: 0.12
  buffer-threshold: 2.0
  alert-cooldown-ms: 300
  max-alerts: 5
  command: "kick %player% Invalid boat flight (VehicleFlyA)"
  debug: false

At 20 TPS, continuous unsupported flight can produce the first VehicleFlyA alert after approximately 550 ms of eligible sampling, following any grace period. Continued violations can alert at approximately 300 ms intervals.

• enabled controls whether a check runs.
• alert-only, where supported, keeps detections from executing the configured punishment command.
• cancel-event and setback-enabled, where supported, control separate prevention actions.
• max-alerts and command configure command-based punishment.
• min-tps, buffers, tolerances and grace periods control when evidence is accepted.

Several checks start in alert-only mode. KillAuraB and BadPacketsC start disabled and can be enabled individually. Review each check's response options when choosing your server policy.

🧑‍⚖️ Staff review and detection records

Authorized staff can use the controls attached to alerts to confirm a detection, mark a false positive or undo a label. Marking a false positive removes that alert's VL contribution when the stored violation is still active. Undo restores a contribution that was removed.

Detection records include the alert ID, player and check, plugin version, ping, TPS, game mode and available movement or check-specific measurements. Labels and detection features are restored after a restart. They provide a dataset for review and future model training.

machine-learning:
  enabled: true
  store-unlabeled: true
  storage-directory: "learning-data"

Records are stored under plugins/DuckyAntiCheat/learning-data/ by default. Button text, hover text and staff messages are configurable.

🛡️ Commands and permissions

Command	Permission	Purpose
/duckyac reload	duckyac.reload	Reload configuration
/duckyac-debug debug <mode> [packet_name]	duckyac.debug	Inspect packet traffic; modes: C2S, S2C, BOTH, OFF
/duckyaclabel <action> <alert-id>	duckyac.learning.label	Apply correct, false or undo; also used by alert buttons

Permission	Purpose
duckyac.alerts	Receive violation alerts
duckyac.learning.label	Review and label detections
duckyac.bypass	Bypass all checks
duckyac.bypass.*	Grant individual check bypasses through the permission group
duckyac.bypass.<config-section>	Bypass a particular check, for example duckyac.bypass.vehicle-fly-a

Permission names can differ for legacy checks; the registered permission entries and each check's bypass lookup define the accepted names.

📩 Discord

Enable the discord section and provide a webhook URL to send configured violation and punishment messages to your staff channel. The webhook username, avatar and message templates are configurable.

🔌 Developer API

DuckyAC exposes its API through Bukkit's Services Manager. Add softdepend: [DuckyAntiCheat] or depend: [DuckyAntiCheat] to your plugin description and compile against the DuckyAC JAR.

import pl.barpad.duckyanticheat.api.DuckyAntiCheatAPI;
import pl.barpad.duckyanticheat.api.DuckyAntiCheatProvider;

DuckyAntiCheatAPI api = DuckyAntiCheatProvider.require();
int reachVl = api.getViolationLevel(player, "ReachB");
boolean vehicleFlyEnabled = api.isCheckEnabled("vehicle-fly-a");

The API supports check metadata and configuration, player violation profiles, violation reporting with detection context, punishment commands, clearing violations and runtime registration of external checks. Integrations can listen to DuckyViolationEvent and DuckyPunishmentEvent; violation events expose the associated alert ID.

Check IDs are normalized, so ReachB, reach-b and Reach B resolve to the same check. External check registrations last for the current plugin session.

🛠️ Build from source

With Java 21 or newer installed, run:

.\gradlew.bat clean build

On Linux or macOS:

./gradlew clean build

The JAR is written to build/libs/. Automated tests cover detection models, packet registration, configuration, permissions and learning-data persistence.

🤝 Support

Report bugs through GitHub Issues or join Discord. Include the DuckyAC and PacketEvents versions, server software, relevant check settings and steps to reproduce the behavior. Labeled detection records and debug measurements help investigate false positives.

📜 License

DuckyAC is licensed under GPL-3.0.