Aegis AntiCheat

2.7 — Release (safety-first, major)

Release date: 2025-10-28

Summary:

• This release focuses on being a "bomb" in quality: broad detection coverage while making it virtually impossible for normal players to be kicked or banned by default.
• Default mode is "monitor": no kicks, no bans, only logging and admin alerts. Operators must intentionally switch to "warn" or "enforce" after staging validation.

Key changes and additions:

1. Enforcement modes:

   • enforcement-mode: monitor | warn | enforce
   • Default: monitor (collect data and alerts; NEVER kick)
   • warn: admins alerted strongly; minimal enforcement when clear.
   • enforce: active enforcement according to configured thresholds (use only after staging).

2. New/Enhanced detections:

   • Timer: robust mean/stddev + environment checks + long sample sizes + heavy confirmation streaks.
   • AimAssist: low-variance yaw/pitch analysis around hits; requires multiple confirmations.
   • VelocitySpoof / AntiKB: detects missing/altered knockback reliably with delayed checks.
   • VClip: vertical teleport/clipping detection with confirmation streaks.
   • AutoBlock (heuristic), AutoTool, AutoArmor, AutoClicker, FastBreak, Nuker, Reach, KillAura, FastBow, FastConsume, FastPlace, Fly, Speed, Spider, Jesus, Phase, Elytra.
   • Added AutoTool and AutoBlock heuristics; note these are approximations without packet-level integration.

3. False positive reduction:

   • Confirmation streaks per-check (configurable).
   • Multi-factor confirmation (e.g., AimAssist + Reach or CPS).
   • Environment filters (skip checks while gliding, inside vehicles, in liquids, during teleports, or when bypass perms exist).
   • Conservative default thresholds and longer sample windows.
   • Soft monitoring mode: MONITOR adds "soft" weights and only logs/alerts unless mode changed to WARN/ENFORCE.

4. Diagnostics & administration:

   • /aegis info <player> prints score, flags, streaks, client brand, last teleport time.
   • /aegis dumpflags lists currently flagged players.
   • violations.log for persistent audit logging.
   • Optional Discord webhook notifications.

5. Persistence:

   • Kick counts persisted in config; by default bans disabled to avoid accidental permanent bans.

6. Safety and operational guidance:

   • Deploy to a staging server in monitor mode for 48-72 hours.
   • Collect violations.log and use /aegis info to inspect players flagged in monitor mode.
   • Tune streak and weight values before switching to warn/enforce.
   • For highest fidelity (especially AimAssist/AutoBlock), consider packet-level integration (Protocollib or custom NMS hooks).

7. Developer notes:

   • All kicks/bans are executed on the main server thread.
   • Webhook calls are async.
   • Code prioritizes null-safety and thread-safe collections.

Recommended next steps for operators:

• Run in monitor mode for 48–72 hours, exercise typical gameplay (walking, sprinting, parkour, mining, PVP, elytra), and produce logs.
• Share suspicious logs or /aegis info outputs if tuning suggestions are needed.
• Move to warn mode for a trial period before enforce, and keep automated bans disabled unless you have high confidence.

Thank you for using AegisAC. This release aims to be powerful and safe — it is designed so normal players will not be kicked/banned by default.