Server-side plugin (beta) that flags x-ray behavior by analyzing CoreProtect mining logs. Requires Docker. Generates a per-session suspicion score and a visual report.