Flint AntiCheat v2.0.0

2.0.0 — Flint now knows a phone from a PC

[Note] Changed the name from Titan to Flint

The biggest release yet, and it's all aimed at one problem no other anti-cheat solves:
Bedrock players who aim with their thumb.



Input-aware Hitbox

Bedrock's "tap to interact" fires the attack at where your finger taps, not at the
crosshair — and the server only ever receives camera rotation. So a legitimate phone player
lands hits tens of degrees off their reported look. Judge them with a crosshair-sized cone
and they get banned for playing normally. No threshold fixes this — it's not
mistuned, it's unmeasurable on that signal.

So Flint stopped guessing and started reading the client's input mode. Phone players get
their own profile:

• relaxed (touch, and anyone we can't identify — the default): a screen-sized 55°
  cone. Catches only hits no tap could physically produce.
• strict (keyboard/mouse, controller, VR): a 2.0° cone.

Read that second number again — splitting by input mode made Flint STRICTER, not
softer. The old single cone had to be loose enough to survive phone players, which meant
PC cheaters hid inside the allowance meant for someone's thumb. Now they don't.

The rule: evidence may only make a check stricter, never more lenient. Every Bedrock
player starts relaxed; only positive evidence of crosshair aim promotes them to strict.
A cheater who spoofs their device to claim "phone" gains nothing — relaxed is already the
default. Reach, AutoClicker and KillAura never cared about input mode and hit them at full
strength regardless.



Crosshair-aim inference — knows more than Floodgate does

Floodgate reports TOUCH for all three Bedrock touch schemes. It cannot tell
"tap to interact" from "aim crosshair" — so a phone player aiming with a real crosshair was
getting the lenient cone even on a perfectly configured server.

Flint can tell. It watches whether the camera moves at the instant of an attack. A tap
player attacks with the same thumb that drags the camera, so their camera is physically frozen
at every hit. Anyone whose camera keeps moving is aiming from a crosshair. Measured across
both device types, the three groups don't overlap — they don't even come close:

• tap-to-interact (phone): max 0.0001° of camera motion at an attack
• aim-crosshair (phone): 0.64° – 6.11°
• keyboard/mouse (PC): 15.4° – 22.3°

The threshold sits in a gap four orders of magnitude wide — not on a tuned edge.

It ships alert-only by default. An inferred promotion is a behavioural read, so a wrong
one costs you a false alert instead of a banned phone player. Floodgate-confirmed
keyboard/mouse players are a fact, not a guess, and punish normally.



Harder to bypass

• Hitbox now sees sideways misses. The angular-miss math modelled targets as a sphere
  the size of their tallest dimension, so a crosshair up to ~0.9 blocks to the SIDE of a target
  counted as a perfect 0° hit — hitbox expansion was invisible if you faced roughly the right
  way. Now measured against the box's real per-axis extents.
• Reach and Speed retuned. Reach thresholds tightened across every sub-check (A–F),
  and the airborne Speed allowance is now sized to what a real sprint-jump actually produces.
• Mob lag compensation. Nearby mobs are snapshotted every tick, so hits on moving mobs
  are judged against where the mob actually was — no more false flags fighting a zombie swarm.

Control and visibility

• Per-check bypass permissions — three granularities:
  flint.bypass (everything), flint.bypass.<check> (e.g. flint.bypass.jump), and
  flint.bypass.<check><type> (e.g. flint.bypass.jumpc). Granting a parent grants its
  children.
• PlaceholderAPI support — %flint_vl_total%, %flint_last_check%, %flint_type%,
  %flint_input%, %flint_ping%, %flint_alerts_state%. Put %flint_input% on a scoreboard or in tab
  and see at a glance who's on a phone.
• %input% in alerts — TOUCH / KEYBOARD_MOUSE / CONTROLLER / VR / UNKNOWN, in the hover
  by default. Check where your flags come from before touching a threshold.
• Missing-Floodgate warning — tells you when Bedrock players are connecting but
  Floodgate isn't on this server (the common proxy-only setup). Detection still works; what's
  lost is input mode, so everyone falls back to the relaxed profile. Now you know instead of
  silently losing the angle check.
• Device-based input inference — current Geyser+Floodgate reports UNKNOWN input mode
  for every client while the device OS comes through fine, so Flint reads the device instead.
  Without it, every Bedrock player would be treated as touch and the angle check would be dead
  for everyone.

Requirements

Minecraft 1.20 or newer (up to 26.x), Java 17+, Spigot / Paper / Folia, and
PacketEvents. Geyser + Floodgate strongly recommended — Floodgate is what makes input mode
available, and without it every Bedrock player falls back to the relaxed profile.

If Hitbox ever flags a Windows player who swears they're tapping — a Surface or touch
laptop reads as keyboard/mouse and gets the strict profile — turn off
settings.infer-input-from-device first.