📦 Sandboxed

Sandboxed is a modern plugin designed for plugin developers and testers. It offers safe, temporary testing worlds per player, full OP access with restrictions, automatic cleanup, session limits, Discord integration, and extensive configuration—all in a lightweight, production-safe format.

This plugin is perfect for developers who want to expose their plugins to potential buyers or testers without the risk of leaking their code or configurations.

⚠️ Important: This plugin is designed only for dev/test servers. It is not suitable for regular multiplayer gameplay or survival worlds. Or maybe it is—by tweaking a few parameters, the choice is yours.

✨ Features

• Automatically generate a world per player upon joining.

  • Timed sessions that auto-expire after a set duration.
  • Worlds are fully deleted when players leave or the server restarts.
  • OP access for full plugin testing freedom (with restrictions).
  • Admins are recognized and redirected to the default world without limits.

• Configurable visuals:

  • Tablist header/footer with placeholders and live countdown.
  • Scoreboard with session details.
  • BossBar countdown with customizable colors and text.

• Discord webhook support with rich embeds, avatars, and dynamic content.

• Safe and secured against malicious players and bots:

  • Log player UUIDs, IPs, and session details to file.
  • Block specific commands using wildcards or regex patterns.
  • Rate-limit joins per IP to prevent mass joins.
  • Customizable verification modes:
    • none: No verification.
    • gravity: Teleport up and check for a controlled fall.
    • pin: Generate a 4-digit PIN and block until it's entered.
    • gui: Open an inventory GUI with a clickable checkmark.

• Fully translated messages and UI, using YAML-based localization files per language.

  Languages included 🌍

  • English (en_us.yml)
  • Spanish (es_es.yml)
  • French (fr_fr.yml)
  • German (de_de.yml)
  • Brazilian Portuguese (pt_br.yml)
  • Simplified Chinese (zh_cn.yml)
  • Japanese (ja_jp.yml)
  • Korean (ko_kr.yml)
  • Russian (ru_ru.yml)
  • Turkish (tr_tr.yml)

🛠️ Installation

1. Drop the plugin JAR into the /plugins directory.
2. Start the server once to generate the configuration files.
3. Edit the generated config.yml to your needs.
4. Restart the server to apply all settings.
5. Optionally, customize translations in /Translations/en_us.yml and other languages.

⚙️ Configuration

The config.yml file allows you to control almost every aspect of the plugin:

Some available configurations

General Settings

• duration-seconds: Number of seconds a test session lasts (default: 900).
• template-world: The world folder to duplicate for each test session.
• rejoin-delay-seconds: Prevents re-entry within N seconds after disconnecting.

Visual Customization

• tablist-header: MiniMessage-supported header text for the player list tab.
• tablist-footer: MiniMessage-supported footer text, can include %player%, %world%, %timer%.
• scoreboard-title, scoreboard-user, scoreboard-world, scoreboard-timer: Customize scoreboard labels.
• bossbar-prefix: Text prefix shown in the bossbar countdown.
• bossbar-color: Color of the session countdown bar (e.g., BLUE, RED).
• admin-bossbar-color: Separate color for admins.
• enable-scoreboard: Enable or disable scoreboard display (true/false).
• enable-bossbar: Enable or disable bossbar display (true/false).
• enable-tablist: Enable or disable tablist display (true/false).

Admin Controls

• admins: List of usernames that are considered admins.
• admins-bypass-blocked-commands: Allows admins to skip command blocking (true/false).
• Admins use infinite sessions and see a separate bossbar.

Discord Webhook Integration

• discord-webhook-url: URL of your Discord webhook.
• discord-webhook-username: Display name for the webhook sender.
• discord-webhook-avatar: Avatar URL to use for webhook messages.
• discord-notify: Toggle webhook usage for join/leave events (true/false).

Command Blocking

• blocked-commands: List of commands to prevent. Supports wildcards (*) and regex.

🤖 Anti-Bot Verification

To protect your server from bot accounts and script-based joins, Sandboxed includes a built-in anti-bot verification system. You can choose one of four modes in your config.yml under antibot.verification-mode:

antibot:
  # Rate limits to prevent mass joins:
  rate-limit:
    max-joins-per-ip:               3    # joins per IP within time-window
    time-window-seconds:           60    # rolling window in seconds
    max-active-connections-per-ip:  2    # simultaneous players from same IP

  # Choose your verification strategy:
  verification-mode: pin

  # GRAVITY settings:
  gravity-verification:
    timeout-seconds:   3     # allowed fall time before failure
    min-y-delta:       3.5   # how far below start-height they must drop

  # PIN settings:
  pin-verification:
    timeout-seconds:      15
    actionbar-format:    "&f[PIN] Enter &x&F&F&8&C&0&0%pin% &f| Time remaining: &x&F&F&8&C&0&0%time%s"

  # GUI settings:
  gui-verification:
    inventory-size:      9
    title:              "&6&lSecurity Check"
    timeout-seconds:    15

---

More information here

📋 Behavior by Mode

none

• Skip all checks. Player immediately gets their sandbox.

gravity

1. Teleport to sandbox_limbo at Y = spawnY + start-height.
2. If they land on the barrier floor or fall below (startY − min-y-delta) within timeout-seconds, verification passes.
3. Otherwise they are kicked with a “verification failed” message.

pin

1. Teleport to sandbox_limbo at Y = 65.
2. Generate a 4-digit PIN, send it via chat and action-bar countdown.
3. Block chat, commands, movement & inventory until correct PIN is typed in chat.
4. On success, they enter their sandbox; on timeout/failure, they are kicked.

gui

1. Teleport to sandbox_limbo at Y = 65.
2. Open a small inventory (size from config) with a checkmark in a random slot.
3. Block all input until they click that head.
4. On click, they enter their sandbox; on timeout, they are kicked.

🔐 Commands and Permissions

• /sb reload – Reloads configuration and translation files.
• /sb testdiscord – Sends a sample embed to the configured webhook.
• /sb config admin add/remove <user> – Manage admin whitelist.
• /sb config cmdblock add/remove <command> – Manage command block list.
• /sb config timer set <seconds> – Adjust default test session time for test players.

The plugin relies on server OP status and listed admins: in the config but the basic permission is sandboxed.command. No permissions plugin is required but is recommended to block dangerous commands for non-admins.

🌐 Discord Example

When a player joins:

• Webhook title and description are dynamically built.
• Includes IP, join date, and admin status.
• Custom username and avatar are shown.