X-SHIELD (anti-cheat)

Originally created for the Werewolves vs Vampires modpack, X-SHIELD is a server administration utility for NeoForge 1.21.1. Anyone can include it in their own modpack if they need a relatively reliable anti-cheat to help detect and monitor unauthorized client modifications and resource packs.

Detection is based on what a file is and what it does — not on what it is called. Renaming xray.zip to textures.zip won't help them bypass the checks.

Architecture

Detection

• File hashing — Every mod, resource pack, and shader pack is fingerprinted with SHA-256, SHA-1, and the CurseForge fingerprint. We never trust the reported file name on its own.
• X-ray pack analysis — Resource packs are inspected for the actual techniques real x-ray packs use: blockstate redirection, hollow-shell block models, forced full brightness, retargeted ore models, core shaders inside a resource pack, and transparent filler textures. This catches packs that no blacklist has ever seen, whatever they are named.
• Reputation lookup — File hashes are checked against Modrinth and CurseForge. Known public releases stay quiet, so your server doesn't drown in false alarms when players install standard mods.
• Platform screening — Being a known release is not the same as being allowed. The project title reported by the platform is also screened, and unlike a local file name, players cannot edit that title.
• Hash and project blacklists — Block an exact file, or block a whole project by its Modrinth slug or CurseForge mod ID to make sure every version is covered.
• Unpacked files — Unpacked resource packs and shader packs are scanned, not just the .zip files in resourcepacks/.
• Integrity heartbeat — The server periodically challenges the client. If a player installs the mod only to get past the login, they are reported.

Evidence scoring

Findings are weighted rather than treated as equally serious. A hash match is proof; a keyword in a file name is worth almost nothing. Weak signals are capped and can never trigger an automatic action on their own — an automatic kick additionally requires at least one proof-level signal. You can configure every threshold.

Moderation

• Interactive in-game alerts for operators with [Spectate], [Shame], [Kick], [ModList], [Ores], and [Whitelist] buttons.
• Discord bot integration — You get one alert per player, which updates in place instead of spamming the channel, complete with paginated findings and buttons for Kick, Ban, False Positive, and Close Log. A simple webhook mode is available as an alternative.
• Self-lifting bans — The ban remembers which files caused it. The player removes them, rejoins, and the ban lifts itself. No ticket, no admin needed. Timed and permanent modes are also available.
• Persistent ore logging — Ore mining is recorded to CSV with timestamp, session, dimension, and coordinates. It survives restarts and tracks every player by default, so the history exists before anyone is flagged.
• Per-player audit logs — Found in logs/X-Shield PlayerLogs/, containing the full file list of every session.
• Alt account correlation (optional) — Compares the part of a player's file set that is not the shared modpack, so players running the plain modpack produce no signal.

Configuration

Everything is toggleable in config/xshield-server.toml: individual detection methods, evidence thresholds, automatic actions, ban behaviour, heartbeat intervals, API rate limits, ore tracking, Discord settings, and all messages.

Requirements

X-SHIELD must be installed on both the client and the server. Players without the mod cannot join.

Data disclosure

When the reputation lookup is enabled, the server sends file hashes to api.modrinth.com and api.curseforge.com to identify public releases. We do not send player names, UUIDs, or file contents to those services. Results are cached and rate limited, and you can disable both lookups if you prefer.

If you configure a Discord bot or webhook, the server sends alerts containing player names, UUIDs, and the names of flagged files to the channel you configure. The mod writes only inside the game directory and never transmits its configuration to clients.

Note

X-SHIELD is a first-line detection and administration tool. Like any client-side audit, it depends on data reported by the client, meaning it remains reliable only as long as nobody with Java knowledge intentionally cracks the mod to send fake data. Therefore, it is not a 100% substitute for server-side anti-cheat and is intended to be used alongside it. The strongest signals — hash matches, blocked projects, and demonstrable x-ray behaviour in a pack — are treated as proof; everything else is a hint. We encourage operators to review flagged players before taking action.