KroshAntiCheat | Lightweight Anti-Cheat [Spigot/Paper]

The false speed flag issue when falling from heights while moving forward has been fixed, NoFall now activates after only 2 confirmed violations instead of 5, and the issue that made Scaffold detection significantly slower than expected for medium-level Scaffold hacks has been resolved.

Krosh Anti Cheat 3.2.3 — Feature Overview

Packet-layer + Bukkit-layer anticheat plugin for Paper 1.20.1, by MR_amir_MR. ## Detection Checks Movement - Speed — flags horizontal movement beyond max-speed, with sprint/swim/potion-effect awareness. - Fly — flags abnormal vertical rise (max-rise) without a legitimate cause (elytra, levitation, etc.). - NoFall — catches clients that suppress fall damage after a fall greater than min-fall. - Timer — Bukkit-layer check counting move packets per second (max-packets) to catch timer/speed-hack clients. - PacketTimer — same idea as Timer but measured at the raw Netty packet layer, before it reaches server-side game logic, so it can't be masked by anything happening higher up the stack. Combat - KillAura — multi-signal combat-hack detector: - Max CPS with a real exponential-moving-average smoothing (not just a raw counter). - Aim-angle validation: flags hits landed outside the attacker's actual eye-direction raytrace. - Fake-entity verification: silently spawns an invisible probe (randomized between an ArmorStand and an AI-disabled mob, since some cheat clients whitelist-exclude ArmorStands) behind a suspect; a legitimate player never attacks it, a KillAura client automatically does. - AutoClicker — flags both raw CPS over threshold and suspiciously uniform click-interval patterns (low standard deviation across a rolling sample), catching autoclickers tuned to stay under the raw CPS cap. - Reach — ping-compensated melee reach check (base-reach + capped ping-compensation, with a hard max-ping-ms to stop ping-spoofing). - Velocity (no-knockback) — flags players who barely move after taking combat damage when vanilla server-side knockback should have displaced them. - PacketValidator — packet-layer check for NaN/Infinity coordinates, out-of-world-bounds positions, and rapid-fire attacks under a minimum interval. World / Building - Scaffold — flags rapid block placement below the player, with a pitch heuristic: placing quickly without looking down (below min-down-pitch) gets a higher-weight flag, since legitimate bridging naturally involves looking at the gap. - InventoryMove — limits movement while a container UI is open, to catch "inventory-move" exploits. - Xray — three-tier ore-vision detection, purely heuristic-aware by design: - Tier A (deterministic): a break event for a block with zero exposed faces means the client had no legitimate line of sight — flagged immediately, high confidence, no false-positive risk. - Tier B (statistical): tracks the ratio of "dug straight to ore" finds vs. total blocks mined in a rolling window, ignoring ore exposed by natural cave openings. Conservative defaults, WARN by default (not KICK/BAN), meant for manual review rather than auto-punishment. - Tier C (pattern, added in 3.2.1): compares straight-line distance between separate ore finds (veins closer than vein-separation-distance are treated as one deposit) — a player who beelines to multiple, separate veins with an unnaturally direct path adds a bonus flag on top of Tie r B, distinguishing "got lucky once" from a real pattern.

Updata : x-ray. The checks will work better.

1.Added X-ray beta (with the help of probability and statistics) 2.Small update

KroshAntiCheat v1.1.6 — Update Notes Bug Fixes - Fixed a thread-safety issue in violation tracking where the violation decay task (running async) could race with violation additions (running sync), risking ConcurrentModificationException under load. - Fixed memory leaks in NoFall, Timer, Scaffold, and AutoClicker checks — per-player tracking data was never released on disconnect. - Fixed a logic bug in SpeedCheck where sprinting + Speed potion fully bypassed the check instead of just adding the expected speed bonus. - Fixed broken rolling-window logic in Timer and Scaffold checks that could false-flag legitimate players moving/building continuously. - Replaced name-based bans with a UUID-based ban system — bans can no longer be bypassed by changing your in-game name. New Detection Features - KillAura: added an aim-angle check — flags hits landed well outside the attacker's actual view direction (catches clients that skip the client-side raytrace). - KillAura: CPS detection now uses a proper exponential moving average instead of a raw per-second counter, reducing false positives from short legitimate bursts. - AutoClicker: added click-interval consistency analysis — flags suspiciously uniform click timing even below the raw CPS threshold. - Scaffold: added a look-angle heuristic — rapid downward block placement without looking down is weighted higher. - KillAura verification probe now randomly spawns as an ArmorStand or an invisible AI-disabled mob, since some clients specifically filter ArmorStands from valid targets. - New check: Velocity (No-Knockback) — detects players who fail to move after taking combat damage, when vanilla knockback should have displaced them. Quality of Life - Persistent violation/punishment logging to a log file (survives restarts). - Optional Discord webhook notifications on kicks/bans (disabled by default). - Tab-completion added for /kac. Internal - Various per-player data structures made thread-safe. - Removed a packet-layer dependency on a Paper API class not present on 1.20.1, replaced with a more compatible reflection-based approach.

⚠️ Important Notice for KroshAntiCheat v1.1 Users If you are running v1.1, please update to v1.1.5 immediately. v1.1 contains a critical bug in ViolationManager where three methods are called but never defined. This causes repeated errors in your server console every 30 seconds. Additionally, the ReachCheck may falsely flag and kick legitimate players who are standing still. Your server will not crash, but it is not running correctly. Update to v1.1.5 — it is a drop-in replacement, no config changes needed. KroshAntiCheat v1.1.5 — Changelog Bug Fixes: - FakeEntityManager: replaced getEntities().stream() scan with a direct Map<UUID, ArmorStand> lookup — faster and thread-safe - ReachCheck: stationary targets no longer cause false positives — current position is used as fallback when no movement history exists - ViolationManager: added missing decayViolations(), clearViolations() and getViolations() methods that were called in 3.1 but not defined - PacketManager: removed dependency on io.papermc.paper.network which was unavailable in Paper 1.20.1 API Improvements: - /kac checks command added — lists all registered checks with their category and enabled status - /kac version now shows active fix labels - Code cleanup across AlertManager and KACCommand

What's new in v1.1: - InventoryMove detection — flags players who move while a container screen is open - Ping-compensated Reach — adjusts the reach threshold based on the player's real server-side ping to eliminate false positives for high-latency players - Fake Entity KillAura verification — spawns an invisible probe entity behind suspected players; a legitimate player never hits it, a KillAura always does - Pre-packet layer analysis — packets are inspected before reaching the server core, catching invalid coordinates (NaN/Infinity), packet flooding, and abnormal attack rates that cheat clients try to hide from Bukkit events