Sentinel&ModGuard

ModGuard — Changelog

v1.0.0 — Initial Release

Features

- Encrypted handshake verification — RSA-2048 keypair generated fresh each session (never written to disk). Challenge includes a nonce, HMAC secret, and public key. Client response encrypted with AES-256-GCM, AES key wrapped with RSA using OAEP/SHA-256. Server decrypts, verifies HMAC-SHA256, and checks the mod list - Sentinel client mod — receives the challenge, collects the mod list via FabricLoader, encrypts and returns it. Zero configuration, zero performance impact - Mod blacklist — modblacklist.json with pre-seeded entries: meteor-client, impact, wurst, liquidbounce, aristois, sigma, thunderhack, wolfram, baritone, freecam, marlows-crystal-optimizer - Player whitelist — bypass verification for specific players by name or UUID (whitelist.json) - Mod history — verified mod lists are saved per player to mod-history.json and viewable with /modguard mods <player> - Protocol versioning — client and server must agree on the protocol version. Mismatched Sentinel versions are kicked with a configurable message - Minimum Sentinel version enforcement — configurable min-sentinel-version kicks players running outdated client mods - Max mod count limit — optional cap on total installed mods (enable-mod-count-limit, max-mod-count) - Geyser / Floodgate auto-bypass — Bedrock players skip verification automatically (allow-floodgate: true) - Offline / cracked server support — offline-mode: true skips UUID-dependent checks - Configurable kick messages — separate messages for missing-sentinel, banned-mod, outdated-sentinel, protocol-mismatch, timeout, mod-count-exceeded - Challenge timeout — configurable seconds for client to respond before being kicked (challenge-timeout-seconds) - Commands: /modguard blacklist <add|remove|list>, /modguard whitelist <add|remove|list>, /modguard mods <player>, /modguard check <player>, /modguard reload, /modguard status