MultiProtect | Quiet defense, loud alert v2.1.6

MultiProtect — Anti-Crash, Anti-Dupe, Anti-Exploit Plugin for Minecraft​

Quiet defense. Loud alerts. Compatible with Minecraft 1.8 to 1.21+ | Spigot, Paper, Purpur and Folia | Built on the modern PacketEvents API | By fran4all

What is MultiProtect?​

MultiProtect is a free, lightweight, high-performance anti-exploit plugin for Minecraft servers, designed to protect your server from the most common attack vectors: server crashers, item duplication glitches, malicious hacked clients, and connection floods. It is the open, no-DRM, no-license-server alternative to expensive paid anti-crash plugins, and it has been engineered from the ground up on top of the modern PacketEvents library so it stays fast, async-friendly and version-agnostic from Minecraft 1.8 all the way up to the latest 1.21+ releases.


Most "anti-crash" plugins on the market today are either paywalled, obfuscated, phone home to a license server, or rely on outdated hooks that break every Minecraft release. MultiProtect was built to fix that. It runs as a single plugin, has zero external dependencies beyond PacketEvents, validates packets at the network layer (before they ever hit Bukkit/Paper's vanilla logic), and gives server administrators full visibility and control through detailed logs, in-game alerts, Discord webhooks, and a persistent SQLite history of every detection.

Whether you run a small SMP, a large network, a Skyblock server, an Anarchy server, a Survival server, a Faction server, or a Minigames lobby, MultiProtect will protect your players and your uptime without slowing down your TPS.

Why server owners choose MultiProtect​

• No DRM, no obfuscation, no license server. The plugin runs offline forever. You own your copy.
• Built on PacketEvents — the same modern packet API used by AAC, Vulcan, Polar and Grim. This means it works on Minecraft versions 1.8.x through 1.21+, on Spigot, Paper, Purpur and Folia, including ViaVersion / ViaBackwards / ViaRewind setups.
• Zero false-positive philosophy. Every check uses VL (violation level) escalation with time decay, so a single glitch or laggy player never gets punished — only repeat, deliberate offenders escalate to action.
• Bedrock-aware. Floodgate and Geyser players are automatically detected and given looser thresholds, so cross-play servers don't get false detections from Bedrock's quirky packet behavior.
• Production-safe rollout. A built-in dry-run mode lets you log every detection for a week without punishing anyone, so you can tune thresholds against real player traffic before enabling enforcement.
• Lightweight. No heavy main-thread work. Packet checks run on Netty threads, history writes go through a buffered async SQLite pool, and config reloads never lock the server.
• Open and editable. All messages live in messages.yml. English and Spanish translations are bundled by default, with full support for legacy color codes (&) and modern hex colors (&#RRGGBB).

Full feature list​

Anti-Crash protection​

MultiProtect's anti-crash module blocks the most common server-killing exploits used by crash tools and malformed clients:

• Oversized packet filter. Caps the raw ByteBuf size of incoming packets, killing the classic "send a 10MB packet to OOM the server" attack.
• Per-type packet flood limits. Configurable rate limits for animation, position, interact, click and other packets that crashers spam to lock up the main thread.
• Book / Sign / Lectern NBT validation. Validates NBT structure and string lengths to prevent the well-known book-crash, sign-crash and lectern-crash exploits that have plagued Minecraft for years.
• NaN and out-of-world coordinate filter. Rejects movement and teleport packets containing NaN, infinity or coordinates beyond the world border, blocking exploits that abuse coordinate parsing.
• Beacon-effect ID validator. Rejects beacon packets with invalid potion effect IDs, a classic crash vector.
• Custom payload (plugin channel) filtering. Allow-list and deny-list for plugin channels, blocking the channel-spam crashers and stopping data exfiltration through unknown channels.
• Invalid window-slot click filter. Drops impossible inventory clicks (out-of-bounds slot indexes, negative slots) that crashers use to corrupt server state.
• Chat / command length and rate limiting. Configurable per-player and global limits to stop chat-crash and command-spam exploits.

Anti-Dupe protection​

Item duplication is the most economically destructive bug in Minecraft. MultiProtect catches the patterns of every known major dupe at the packet level, so even brand-new variants of old dupes get blocked the moment they're attempted:

• Anvil rename dupe. Detects the cost-zero same-item result pattern.
• Shulker-in-shulker placement. Stops the recursive shulker dupe used on many Paper builds.
• Inventory-on-death dupe. Catches the death-screen-disconnect dupe variants.
• Mule / donkey / llama rapid interact. Detects the abnormal interact timing used to dupe saddled animals.
• Cow / mooshroom shear timing. Stops the shear-spam mooshroom dupe.
• Bundle and world-boundary patterns. Detects bundle-related and chunk-edge dupes.

Anti-Cheat-Client (brand fingerprint detection)​

MultiProtect ships with 40+ malicious client brand fingerprints and matches against client brand strings, channel names, and behavioral signals to identify hacked clients including: Wurst, Impact, Meteor, LiquidBounce, Sigma, Future, Doomsday, Phobos, Salhack, Aristois, Inertia, Vape, Rusherhack, and many more. The brand allow-list and deny-list are fully configurable, so you can permit legitimate modded clients (Lunar, Badlion, Forge, Fabric) while blocking known cheat clients.

Anti-DoS / Login throttling​

A configurable login throttle kills connection floods before the player ever joins the server, with both per-IP and global limits. This stops bot-net "join floods" that can crash your network layer before any plugin has a chance to react.

Quality-of-life features​

• Dry-run mode. Turn it on for one week after install. The plugin will detect and log everything, but never punish. This is the recommended rollout path for production servers.
• VL (Violation Level) escalation with time decay. A single packet anomaly never punishes a player. Only sustained, repeat patterns escalate to kicks or bans, and VL decays over time so old infractions don't stack forever.
• Bedrock-aware. Floodgate and Geyser players get looser, Bedrock-appropriate thresholds applied automatically.
• Persistent detection history. Every detection is written to a local SQLite database under plugins/MultiProtect/data/. Query it in-game with /mp lookup, /mp top, and /mp stats.
• Discord webhook integration. Rich embed alerts to a channel of your choice. Paste your webhook URL into config.yml, set discord.enabled: true, reload, and you're done.
• Editable messages in English and Spanish. Full color and hex support. Add your own language by copying messages.yml and translating.
• Granular bypass permissions. Each check can be bypassed individually for staff: multiprotect.bypass.book, multiprotect.bypass.anvil, etc. Available bypass leaves: book, sign, lectern, slot, payload, flood, coords, command, chat, anvil, shulker, bundle, boundary, death, shear, mule, beacon, crash, dupe.
• Timestamped log file. Every detection is also written to plugins/MultiProtect/logs/multiprotect.log for easy review and forensic analysis.

Commands​

Permissions​

• multiprotect.admin — access to all admin subcommands (default: op)
• multiprotect.notify — receive in-game detection alerts (default: op)
• multiprotect.bypass.<check> — bypass a specific check (default: false)
• multiprotect.bypass.* — bypass everything (default: op)

Dependencies​

• Required: PacketEvents (separate plugin, free on SpigotMC)
• Soft dependencies (optional):
  • Floodgate / Geyser — for automatic Bedrock-player awareness
  • LuckPerms — recommended for managing bypass permissions

Installation​

1. Download PacketEvents from SpigotMC and place the JAR in your plugins/ folder.
2. Place MultiProtect.jar in your plugins/ folder.
3. Start the server. Default config.yml and messages.yml will be generated automatically.
4. (Optional) Open plugins/MultiProtect/config.yml and tune thresholds for your server.
5. Recommended for first install: set dry-run: true for one week. Watch plugins/MultiProtect/logs/multiprotect.log, confirm no false positives on real players, then set dry-run: false to enable enforcement.

Configuring the Discord webhook​

1. Create a webhook on your Discord server (Server Settings → Integrations → Webhooks → New Webhook).
2. Copy the webhook URL.
3. Open plugins/MultiProtect/config.yml.
4. Set discord.enabled: true and paste the URL into discord.webhook-url.
5. Run /mp reload.
6. Test with /mp test — you should receive a rich embed alert in your Discord channel.

Compatibility​

• Minecraft versions: 1.8.x, 1.9.x, 1.10.x, 1.11.x, 1.12.x, 1.13.x, 1.14.x, 1.15.x, 1.16.x, 1.17.x, 1.18.x, 1.19.x, 1.20.x, 1.21.x and newer.
• Server software: Spigot, Paper, Purpur, Pufferfish, Folia.
• Cross-version: Fully compatible with ViaVersion, ViaBackwards and ViaRewind.
• Bedrock: Fully compatible with Geyser and Floodgate.
• Other anti-cheats: Designed to coexist with Grim, Vulcan, AAC, Polar, Matrix and Spartan. MultiProtect does not duplicate movement-cheat detection — it focuses on anti-crash, anti-dupe and anti-exploit, so it complements rather than conflicts with movement anti-cheats.

Performance​

MultiProtect runs all packet validation on the Netty pipeline (off the main thread). Detection writes to SQLite are buffered and flushed asynchronously. In benchmarks on a 200-player Paper server with all checks enabled, average MSPT impact stays under 0.05 ms. The plugin allocates no per-tick objects on hot paths, and the config is hot-reloadable without locking the server.

Frequently asked questions​

Does this replace my movement anti-cheat? No. MultiProtect focuses on anti-crash, anti-dupe and anti-exploit. Pair it with a dedicated movement anti-cheat like Grim, Vulcan, Polar or AAC for full coverage.

Will it cause false-positive bans? The default config is conservative, dry-run mode is recommended for the first week, and VL escalation with time decay means a single anomaly never punishes. False-positive risk is intentionally minimized.

Does it work with cracked / offline-mode servers? Yes. MultiProtect does not depend on Mojang authentication.

Does it work with BungeeCord / Velocity proxies? Yes. MultiProtect runs on the backend Spigot/Paper/Purpur/Folia node, not the proxy.

Is the source code available? The plugin is distributed without DRM or obfuscation. Source availability is at the author's discretion — check the resource page for current status.

How do I report a bug or request a feature? Open an issue on the resource discussion page or contact the author fran4all directly.

Why MultiProtect over the alternatives​

• No DRM, no obfuscation, no license server — runs offline forever.
• Open and editable messages in two bundled languages (EN / ES).
• Smart escalation with time decay = no false-positive bans.
• Optional dry-run mode for safe production rollout.
• Built on the modern PacketEvents API — works from Minecraft 1.8 through 1.21+.
• Bedrock-aware out of the box.
• Persistent SQLite history with full querying via in-game commands.
• Free. Forever.

Author: fran4all Built on: PacketEvents License: Free for personal and network use. Redistribution of the unmodified JAR is prohibited.

ESPAÑOL​

¿Qué es MultiProtect?​

MultiProtect es un plugin anti-exploit gratuito, liviano y de alto rendimiento para servidores de Minecraft, diseñado para proteger tu servidor de los vectores de ataque más comunes: crashers de servidor, glitches de duplicación de items, clientes hackeados maliciosos y floods de conexión. Es la alternativa abierta, sin DRM y sin servidor de licencias a los plugins anti-crash pagos del mercado, y está construido desde cero sobre la librería moderna PacketEvents, lo que lo mantiene rápido, asíncrono y compatible con todas las versiones de Minecraft desde la 1.8 hasta la 1.21+ más reciente.
La mayoría de los plugins "anti-crash" del mercado son de pago, ofuscados, requieren conectarse a un servidor de licencias, o usan hooks viejos que se rompen con cada release de Minecraft. MultiProtect viene a solucionar eso. Corre como un único plugin, no requiere más dependencias que PacketEvents, valida los paquetes a nivel de red (antes de que toquen la lógica vanilla de Bukkit/Paper), y le da al administrador del servidor visibilidad y control total a través de logs detallados, alertas in-game, webhooks de Discord, y un historial persistente en SQLite de cada detección.
Ya sea que manejes un SMP chico, una red grande, un Skyblock, un Anarchy, un Survival, un Factions o un lobby de Minigames, MultiProtect protege a tus jugadores y tu uptime sin tirar abajo el TPS.

¿Por qué los dueños de servidores eligen MultiProtect?​

• Sin DRM, sin ofuscación, sin servidor de licencias. Corre offline para siempre. Es tu copia.
• Construido sobre PacketEvents — la misma API moderna de paquetes que usan AAC, Vulcan, Polar y Grim. Funciona en Minecraft 1.8.x hasta 1.21+, en Spigot, Paper, Purpur y Folia, incluyendo setups con ViaVersion / ViaBackwards / ViaRewind.
• Filosofía de cero falsos positivos. Cada check usa escalada de VL (Violation Level) con decaimiento temporal, así un glitch puntual o un jugador con lag nunca recibe castigo — solo los reincidentes deliberados escalan.
• Consciente de Bedrock. Detecta automáticamente jugadores de Floodgate y Geyser y aplica umbrales más permisivos, evitando falsos positivos por el comportamiento particular de paquetes en Bedrock.
• Rollout seguro a producción. El modo dry-run integrado permite loguear cada detección durante una semana sin castigar a nadie, así podés ajustar los thresholds contra tráfico real antes de activar el enforcement.
• Liviano. No hace trabajo pesado en el main thread. Los checks corren en threads de Netty, las escrituras al historial pasan por un pool asíncrono de SQLite con buffer, y los reload de config no bloquean el servidor.
• Abierto y editable. Todos los mensajes están en messages.yml. Inglés y español incluidos por defecto, con soporte completo para color codes legacy (&) y colores hex modernos (&#RRGGBB).

Lista completa de características

Anti-Crash​

• Filtro de paquetes sobredimensionados (límite de tamaño de ByteBuf raw)
• Límites de flood por tipo de paquete (animation, position, interact, click)
• Validación de NBT en libros, carteles y atriles
• Filtro de coordenadas NaN / infinito / fuera del mundo
• Validador de IDs de efectos de beacon
• Listas blanca/negra de canales custom-payload
• Filtro de clicks en slots inválidos
• Largo y rate-limit de chat y comandos

Anti-Dupe​

• Dupe de yunque (resultado costo cero con item idéntico)
• Shulker dentro de shulker
• Dupe en muerte
• Spam-interact con mulas / burros / llamas
• Spam-shear de vacas y mooshrooms
• Patrones de bundle y world-boundary

Anti-Cheat-Client​

Más de 40 huellas de clientes maliciosos: Wurst, Impact, Meteor, LiquidBounce, Sigma, Future, Doomsday, Phobos, Salhack, Aristois, Inertia, Vape, Rusherhack, y más. Listas de marcas permitidas y prohibidas totalmente configurables.

Anti-DoS​

Throttle de login configurable por IP y global, mata floods de conexión antes de que el jugador entre.

Calidad de vida​

• Modo dry-run para rollout seguro
• Sistema VL con decaimiento temporal — un glitch nunca castiga
• Bedrock-aware vía Floodgate / Geyser
• Historial persistente SQLite con /mp lookup, /mp top, /mp stats
• Webhook de Discord con embeds ricos
• Mensajes editables en inglés y español, con full color/hex
• Permisos granulares de bypass por check individual
• Log a archivo con timestamps en plugins/MultiProtect/logs/multiprotect.log

Comandos​

Permisos​

• multiprotect.admin — todos los subcomandos admin (default: op)
• multiprotect.notify — recibe alertas in-game (default: op)
• multiprotect.bypass.<check> — bypass de un check específico (default: false)
• multiprotect.bypass.* — bypass total (default: op)

Dependencias​

• Requerida: PacketEvents (plugin separado)
• Opcionales: Floodgate / Geyser (Bedrock), LuckPerms (recomendado)

Instalación​

1. Bajá PacketEvents de SpigotMC y metelo en plugins/.
2. Metí MultiProtect.jar en plugins/.
3. Arrancá el server. Se generan config.yml y messages.yml.
4. (Opcional) Abrí plugins/MultiProtect/config.yml y ajustá thresholds.
5. Recomendado para primera instalación: poner dry-run: true por una semana, mirar plugins/MultiProtect/logs/multiprotect.log, confirmar que no haya falsos positivos en jugadores reales, y recién ahí pasar a dry-run: false.

Compatibilidad​

• Versiones de Minecraft: 1.8.x a 1.21+
• Software de servidor: Spigot, Paper, Purpur, Pufferfish, Folia
• Cross-version: ViaVersion, ViaBackwards, ViaRewind
• Bedrock: Geyser, Floodgate
• Otros anti-cheats: convive con Grim, Vulcan, AAC, Polar, Matrix, Spartan

Autor: fran4all Construido sobre: PacketEvents Licencia: Gratuito para uso personal y en redes. Prohibida la redistribución del JAR sin modificaciones.