Anticheat for Your Minecraft Server: Grim and Paper's Anti-Xray

What each one stops

An anticheat like Grim looks at what the player says they're doing (moving, jumping, hitting, placing blocks) and compares it with what the game allows: flying, speed, no fall damage, extra reach, cancelling knockback… What it can't see is what only happens on the cheater's screen, like X-ray: seeing ores through stone sends nothing odd to the server.

For X-ray there's Paper's anti-xray: the server doesn't tell the player which ores are underground until they're right next to them, so the hack has nothing to show. No plugin needed.

Neither of them replaces the whitelist or permissions. If the server is for your friends, closing it with the whitelist stops more than any anticheat; this is for open servers, or for when people you don't know join.

Which anticheat to choose

Grim is open source and free (GPLv3 licence). It simulates the player's movement exactly as their game would calculate it, which is why it rarely gets honest people wrong. It works on Paper, Spigot, Folia and Fabric, with players from 1.8 to the latest, and needs Java 17 or higher (the one the panel sets for modern versions already is).

There are paid anticheats, like Vulcan, which are bought on SpigotMC and aren't on Modrinth: if you choose one, upload the .jar by hand to the plugins folder from “Files”. For a friends' server or a small community, Grim is enough.

Just one: two anticheats at once step on each other, give each other false positives and use twice as much. If you switch, remove the old one. And be wary of Grim “forks” that promise more: several are abandoned; the real one is GrimAC.

Installing Grim

1. Make a backup

   In the panel, “Backups”. A new plugin shouldn't break anything, but this way you can go back in a minute.

2. Search for it in “Mods & plugins”

   Search for GrimAC and install it. The panel only shows what works for your version and server type, and downloads the required dependencies with it. If on startup the console says packetevents is missing, search for it there too and install it.

3. Restart

   On startup the plugins/GrimAC folder appears in “Files” with config.yml (the settings), punishments.yml (what happens when someone is caught), messages.yml and discord.yml.

4. Check that it works

   Join the server as op and type /grim alerts: it will tell you alerts are enabled. From the panel's “Console”, alerts show up the same, without doing anything.

What Grim does out of the box (and what it doesn't)

Out of the box Grim doesn't kick or ban anyone. It does two things: it puts the player back in place when they move in a way that isn't possible (that's the “setback”: whoever flies gets pulled back and the hack stops working for them) and it alerts ops and the console when someone piles up lots of violations.

It's better to start that way: a few days just watching the alerts. A player with a bad connection, a plugin that launches people into the air or a strange horse can trigger the odd alert; a cheater triggers lots in a row.

Bedrock players who join through Geyser are left out of Grim's checks: their game moves differently and would give false positives. If you enabled Bedrock in “Mods & plugins”, that's expected.

The most used commands

/grim alerts turns alerts on or off for you. /grim verbose shows each violation the moment it happens, without waiting for them to add up: useful for watching a suspect live, noisy to keep on all the time.

/grim profile Name gives a player's version, ping and client (Fabric, Lunar…). /grim spectate Name lets you watch them without being seen and /grim stopspectating takes you back to where you were.

/grim history Name lists their sessions with how many violations they had in each: it lets you decide with data, not because of a complaint. /grim reload rereads the files after you change them, without restarting the server.

Kicking or banning automatically

It's decided in plugins/GrimAC/punishments.yml. Each group of checks (Simulation for movement, Reach, Knockback, Hitboxes, Combat…) has a commands list with lines of the form “threshold:interval command”. “100:40 [alert]” alerts on reaching 100 violations and then every 40 more; with interval 0, the command runs only once.

To kick anyone who flies non-stop, add a line like “200:0 kick %player% Movement not allowed” to the Simulation group. The violation count empties by itself after 300 seconds (remove-violations-after), so a high threshold is only reached by someone cheating continuously.

Kicking is reversible: the player joins again. Banning from here isn't so much, and a mistake bans someone honest. The careful thing is to leave banning to a person: look at /grim history and, if it's clear, /ban Name from the “Console”.

Once the file is changed, /grim reload. If there's a format error, the console says so on reload.

Alerts in your Discord

1. Create a webhook

   In your Discord server: channel settings → “Integrations” → “Webhooks” → “New Webhook”, and copy its URL. Anyone with that URL can post in the channel: don't paste it in public.

2. Paste it into discord.yml

   In “Files”, plugins/GrimAC/discord.yml: enabled: true and the URL in webhook: in quotes.

3. Reload

   /grim reload. The [webhook] lines in punishments.yml (out of the box, every 100 movement violations and on the first reach one) send the alert to the channel.

Turning on Paper's anti-xray

It comes switched off. It's in “Files”, config/paper-world-defaults.yml, under anticheat → anti-xray. Set enabled: true, save and restart the server (it doesn't apply live). It covers every world on the server.

engine-mode decides how it fools the cheater. With 1 (the default) ores that don't touch air look like stone: it costs little and stops almost everything. With 2 the server invents fake ores everywhere and X-ray shows a Swiss cheese of diamonds that don't exist; it's tougher, but sends more data to each player and you notice it on a bad connection. Start with 1.

max-block-height (64 by default) is up to what height they're hidden; diamonds, gold and deep iron stay below it. hidden-blocks is the list of what's hidden: out of the box it already includes the ores, chests and obsidian, so there's no need to touch it.

Players don't need to install anything, and whoever plays fair doesn't notice the difference: the ore appears as soon as the stone next to it is removed.

If Grim gives false alerts

First look at who: /grim profile Name. A very high ping or an old client explains lots of odd alerts. If it's always the same group of checks with every player, it's usually a plugin that moves people (launch pads, elevators, minigames): give that plugin its space or raise that group's threshold in punishments.yml.

For someone trusted who shouldn't go through Grim (an admin testing things), the grim.exempt permission leaves them out of every check: with LuckPerms, lp user Name permission set grim.exempt true from the “Console”. Don't give it to just anyone.

If Grim doesn't load, it's almost always the version: it has to be the one for your Minecraft version and with packetevents alongside. The console says so on startup; if it's not clear to you, write in the panel's “Help” with those lines.

An anticheat uses some processor for each connected player. If the server was already tight, the lag guide explains how to measure it with spark before blaming anyone.

Frequently asked questions