BaritoneRemover - Bot & Cheat Detection

What it does

Despite the name, BaritoneRemover does not only look for Baritone. It detects
boting in general: any client software that automates movement, aiming,
mining or block placement on behalf of a player.

Everything runs on the server, from packets the client already sends
(PacketEvents based). Nothing to install on the player side, no world scanning,
no resource pack.

Checks

Rotation

• Repeated (A / C) - rotation changing in a repeated sequence
• TimeBetween (A / B) - suspiciously consistent timing between block breaks,
  and between block placements

Target lock (Baritone-specific signatures)

• TargetLock (A) - repeated acquisition of the same canonical mining targets
• TargetLock (B) - one-packet snaps to Baritone's pathing placement target
• TargetLock (C) - Baritone's fixed 26-degree traverse mining pitch with
  sustained yaw jitter
• TargetLock (D) - precise aim held steady across distinct mining targets

Movement

• AutoWalk (A) - walking while changing yaw but never pitch
• Repeated (B / D) - movement repeated in a fixed sequence

Combined

• Combined (A) - several weaker signals flagged together

Each check builds a violation level (VL). VL decays on its own when a player
stops behaving suspiciously, so single odd inputs do not stick around.

Alerts and punishment

• Staff alerts go to anyone with br.alert, with the check description on hover
• Per check config: enable, punish, punish-vl, punish-command
  (supports %player%)
• Punishment message and prefix are MiniMessage formatted, so you can colour
  and style them freely
• Optional Discord webhook for alerts, with Discord rate limits respected and
  per-player throttling so one player cannot flood the channel

False positive safeguards

• Checks are fully disabled while TPS drops below min-tps
• Optional ping-disable: players at or above the ping threshold are not
  checked
• Bedrock players through Floodgate are excluded from the checks that do not
  apply to them (for example boat movement and TargetLock (C))
• br.bypass exempts a player entirely
• Packet buffers are capped, so a misbehaving client cannot bloat memory

Config and commands

All options live in config.yml and new keys are merged in on update, so your
edits survive upgrades.

• /br reload - reload the config and reset tracked data
• /br debug - toggle debug output for yourself, the console, or both

Permissions: br.alert, br.debug, br.reload, br.bypass

Debug output is also written to daily log files under
plugins/BaritoneRemover/debug/. Set temp-debug-log: true to delete them on
shutdown.

Compatibility

• Servers: Spigot, Paper, Purpur, Folia, Bukkit
• Minecraft: 1.8 through 1.21+ Java Edition
• Bedrock players on Floodgate/Geyser are handled
• Open source under AGPL-3.0

Discord ·
Source ·