Cheati

Cheati

A configurable, false-positive-conscious anticheat for Paper servers — covering movement, combat, and world/inventory exploits.

Cheati watches the same player data your server already produces and flags suspicious activity to your staff in real time. It's built around one principle: catching cheaters shouldn't mean punishing legitimate players. A huge amount of Cheati's design goes into not firing on lag, knockback, sprint-jumps, or the dozens of normal-but-unusual things players do every day.

You decide how far it goes — from quiet staff alerts, to actively blocking cheated movement, to running your own punishment commands automatically. All per-check, all configurable, all reloadable live.

What it checks

Movement — Speed, Fly, NoFall, Jesus (water-walk), Phase (wall-clip), Step, NoSlow (including cobwebs, soul sand, berry bushes, and powder snow)

Combat — Reach, KillAura, AutoClicker

World & inventory — FastBreak, Nuker, Scaffold, AutoTool

Optional packet-level — Timer (requires PacketEvents)

More than alerts

Staff alerts with a decaying violation buffer and a non-decaying lifetime count, so isolated false reads fade out while sustained cheating keeps surfacing. /cheati vl <player> to review a player's lifetime violations per check. Opt-in action prevention, per check. Movement violations are corrected with a tracked setback to the player's last known-good position (not a crude rubber-band); combat and world violations cancel the offending action; NoFall applies the fall damage that was dodged. Enable it only where you want it. Opt-in auto-punish. Instead of reinventing bans, Cheati runs your console commands at violation thresholds you set — so it plugs straight into whatever punishment plugin you already trust (LiteBans, AdvancedBan, vanilla /ban, anything).

Built to avoid false positives

This is where most of the work went:

Centralized exemptions for states where normal movement rules don't apply — flight, elytra gliding, vehicles, riptide, levitation, and more. Grace windows after teleports, respawns, knockback, world changes, logins, flight toggles, gamemode changes, and trident launches. Velocity/knockback tracking — server-applied velocity (knockback, explosions, fishing-rod pulls, wind charges) widens the relevant caps for the few ticks it actually matters, so legitimate launches don't read as Speed or Fly. Latency compensation — grace windows scale with each player's real ping, so high-latency players aren't flagged for what's really just lag. Gravity-based vertical prediction in the Fly check, compared against Minecraft's actual movement physics rather than a loose heuristic. Per-check bypass permissions — exempt a trusted account from one specific check (cheati.bypass.<check>) without dropping every other protection.

Requirements

ServerPaper 1.21+ (or a fork such as Purpur / Pufferfish)Java21+PacketEventsOptional — only needed for the packet-level Timer check

Cheati uses Paper-specific API and does not run on plain Spigot or Bukkit.

Commands & permissions

/cheati reload — live-reload the configuration /cheati alerts — toggle alert visibility /cheati vl <player> — view a player's violations

cheati.alerts — receive alerts and use /cheati alerts / /cheati vl (default: op) cheati.admin — use /cheati reload (default: op) cheati.bypass / cheati.bypass.<check> — exempt from all, or one specific check (default: false)

Configuration

Everything is configurable and documented inline in config.yml — check toggles, sensitivity thresholds, per-check prevention, grace windows, latency scaling, and auto-punish ladders. Edit and run /cheati reload to apply without a restart.

A note on tuning: every server's playerbase moves differently. Cheati ships with sensible defaults, but enforcement (prevention and auto-punish) is best switched on after watching alert traffic for your own players first. The config comments call out which values to adjust if you see a false positive or a miss.