Aegis — Anti-Exploit & Staff Suite
14 server-side detection modules, a strike system with auto-kick / auto-ban and decay, an 8-tab live staff dashboard with 4 permission ranks, persistent storage, cross-server ban sync, Discord alerts, and a clean developer API. Open source Luau — no obfuscation, no per-game licensing.
Overview
Aegis is a modular, server-authoritative anti-exploit that protects your game against the exploit classes that actually matter — speed, teleport, fly, noclip, super-jump, fling, remote spam, humanoid tampering, god mode, and more — and pairs it with a complete staff suite: roles, permissions, chat commands, live dashboard, audit log, and spectate.All enforcement happens on the server. The client cannot lie, cannot disable a check, and cannot fake a remote call to bypass one. Deleting the client script accomplishes nothing (and gets flagged).
Why Aegis over the usual anti-exploit model?
- 14 detections, not 9 — including a backdoor detector (server-side humanoid tampering), honeypot decoy remotes with zero false positives, chat-spam detection, and a physics-consistency teleport check that ignores legit knockback instead of false-flagging it.
- Roblox native ban API with alt detection — every ban also goes through Players:BanAsync, so Roblox auto-bans the exploiter's alt accounts, universe-wide. DataStore bans remain the fallback, nothing breaks in Studio.
- Raid Guard + Panic Mode — mass alt-join surges lock the server automatically; one click freezes every non-staff player during an incident.
- Player reports — everyone gets ;report, rate-limited, straight into the staff feed, the target's history, and your Discord.
- A real staff suite, not just a feed — 4 ranks with a configurable permission matrix, 15+ chat commands, freeze, bring/goto, spectate, temp-bans with duration picker, and a persisted audit log of every staff action.
- Cross-server bans — MessagingService propagation kicks a freshly banned player from every live server within seconds, not just yours.
- Strike decay — honest players who trip a threshold once drift back to zero instead of accumulating toward a ban forever.
- Developer API — SafeTeleport, Bypass, custom detections through the same strike pipeline, incident subscriptions. Your bounce pads and cutscenes will never fight your anti-cheat.
- Built-in Test Lab — a Studio-only dashboard tab that simulates each exploit on yourself so you can watch the system catch it before you ship.
Feature list
14 Detection Modules — WalkSpeed · Teleport · Fly · Noclip (experimental) · JumpExploit · Fling · HumanoidTampering (backdoor detector) · GodMode · RemoteSpam · AltAccountFlag · InvalidAnimation · ClientIntegrity · Honeypot (decoy remotes, zero false positives) · ChatSpam5 Action Types per detection — Log, Warn, Rollback (to last verified-legal position), Kick, Ban — each with per-detection severity (1–3), strike weight, and cooldown.
Strike System — auto-kick threshold, auto-ban threshold (configurable duration or permanent), automatic decay, one-click clear.
Staff Suite — Helper / Mod / Admin / Owner ranks (UserIds, group ranks, or place ownership), rank-vs-rank protection (a Mod can't ban an Admin), 15+ chat commands with the ; prefix, on-screen toasts.
Live Dashboard (8 tabs) — Overview (uptime, FPS/memory/ping, counters, broadcast composer, panic + shutdown controls) · Live Feed (with severity sound alerts) · Players (searchable, 10 actions per row) · Bans (offline ban/unban/full-history lookup by UserId) · Stats · Audit Log · Settings (live detection toggles + 6 selectable accent themes) · Test Lab (Studio-only exploit simulator). Draggable, minimizable, auto-scales on small screens, touch-friendly with a floating staff button on mobile. Opens with F2 / Right-Ctrl / F4 / the ;aex command.
Staff toolkit extras — persistent staff notes per player, ;slowmode chat rate-limiting, ;panic server lockdown, soft shutdown with countdown, session digest posted to Discord when the server closes.
Persistent Storage (5 DataStores) — per-player incident history (last 100), ban records with instant join blocking, lifetime aggregate stats, staff audit log, and persistent staff notes. Auto-flush every 30s + BindToClose.
Discord Webhooks — severity-filtered detection alerts + staff action notifications, internally rate-limit-safe. One line of setup.
Open Source — fully readable, commented Luau. Rename it, reskin it, extend it. Unlimited games.
What's included
- 2-click install: AegisServer.rbxmx + AegisClient.rbxmx — insert, add your UserId, done
- Full open source tree (10 server files + 2 client files), Rojo/Argon-ready
- Full README: installation, tuning guide, API reference, FAQ
No anti-exploit catches 100% of everything — anyone claiming otherwise is selling obfuscated snake oil. Aegis covers the high-impact server-observable exploit classes and hands you the pipeline to add game-specific checks in minutes.
