WHAT IS IT?
Anti Packet Exploit runs entirely in the background — no chat alerts, no staff commands for players to probe, no noise. Exploiters get kicked automatically while your console keeps a full audit trail. They never know what hit them.
PROTECTION
36 modules total. All active 24/7.
MODULES
Dupe Protection
Code:
• Piston Dupe Piston / slime / sticky-TNT
• Inventory Dupe Equip spam, armor, creative
• Vehicle Dupe Minecart / boat / chest entity
Crash Integrity
Code:
• Book Integrity Page / char / depth limits
• Sign Integrity Line cap, control chars
• Anvil Integrity Rename overflow guard
• Item Sanitizer Crash-grade meta sweep
• Crash Protection NaN / Infinity / delta guard
Grief Protection
Code:
• Ender Pearl Spam, NaN, distance, border
• Entity Spam Spawn rate cap per chunk
• Explosion Guard Bed / anchor dupe, containers
• Lava Grief Source-block per-chunk cap
• Player Pace Block-place rate per second
Client Integrity
Code:
• Behavior Sprint / sneak desync
• Client Integrity Ghost-item, swing tracking
• Inventory Move Weighted click-rate guard
• Block Action Dig-while-GUI, same-block
• Invalid Click Negative slot, UNKNOWN action
• Bad Packets 14 Bukkit-event checks
• Item Salvage Anvil enchant overflow
Netty Pipeline
Code:
• Bad Packets H/L/N/Q Use, dig, keep-alive, window
• Payload A-F Plugin-message validation
• Window A-D Inventory click anomalies
• Position A-D Movement exploits
• Flood A-F Packet flood limits
• Creative A-G Creative-mode abuse
• Tab A-B Tab-completion abuse
• Command A Command packet malformation
Module Suite
Code:
• Action Cooldowns Per-action min-ms (Geyser)
• Projectile & Amount Velocity + stack-size sweep
Advanced Integrity
Code:
• Item NBT Deep NBT validator
• Command Crash Spam-crash + cmd validation
• Tab Complete Cap Query length enforcement
Advanced Sanitization
Code:
• Creative Sanitizer Mass creative-mode sweep
• Recipe Blacklist Block dangerous recipes
• Command Blocker Blanket command restriction
CONFIGURATION:
YAML:
# ─── Options ─────────────────────────────────────────────────────────────────
options:
silent-failures: false
kick-on-exception: true
# Whether to KICK player when a check flags them (default: false = alerts only).
# false = send alerts to staff only, player stays in game (RECOMMENDED)
# true = kick player immediately when flagged
kick-on-detect: false
kick-on-detect-message: "&cYou are sending suspicious packets."
bypass-permission: false
hidden-command: false
bstats: true
debug: false
external-config: false
server: "unnamed"
punish-delay: 1000
disable-item-decoding: "BOOKS"
geyser: false
clear-task:
enabled: true
delay: 300
printer:
automatic: false
place-threshold: 10
disable-delay: 3000
alerts: true
mechanics:
nether-portal-delay: 1000
max-arrow-velocity: 15.0
shears-cooldown: 500
break-close-inventory: false
trapdoor-rail-redstone: true
interact-container-delay: 100
alerts:
store: true
days: 14
# ─── Packet Logger ───────────────────────────────────────────────────────────
packet-logger:
enabled: false
heavy-packet-threshold: 5000000
player-mode: "whitelist"
players: []
packet-mode: "blacklist"
packets: []
# ─── Checks ──────────────────────────────────────────────────────────────────
checks:
# ── Netty ──────────────────────────────────────────────────────────────────
netty:
a:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
automatic: true
max: 98304
b:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
resolved: true
max: 15
max-characters: 255
resolved-multiplier: 3
resize: true
# ── Window ─────────────────────────────────────────────────────────────────
window:
a:
enabled: true
punish: true
max-vl: 5
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
buffer:
max: 5.0
multiply: 0.25
decay: 1.0
b:
enabled: true
punish: true
max-vl: 5
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
buffer:
max: 5.0
multiply: 0.25
decay: 1.0
c:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
max: 1500
d:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
max: 16384
# ── Creative ───────────────────────────────────────────────────────────────
creative:
a:
enabled: true
punish: true
max-vl: 5
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
buffer:
max: 5.0
multiply: 0.25
decay: 1.0
b:
enabled: true
punish: true
max-vl: 5
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
buffer:
max: 5.0
multiply: 0.25
decay: 1.0
c:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
max: 1500
d:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
max: 16384
e:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
blacklist:
- "run_command"
- "translation.test.invalid"
- "§"
f:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
max: 64
g:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
# ── Place ──────────────────────────────────────────────────────────────────
place:
a:
enabled: true
punish: true
max-vl: 5
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
buffer:
max: 5.0
multiply: 0.25
decay: 1.0
options:
max: 100
b:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
max: 70
c:
enabled: true
punish: true
max-vl: 5
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
buffer:
max: 5.0
multiply: 0.25
decay: 1.0
options:
max: 50
# ── Flood ──────────────────────────────────────────────────────────────────
flood:
a:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
max: 1100
b:
enabled: true
punish: true
max-vl: 5
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
buffer:
max: 5.0
multiply: 0.25
decay: 1.0
options:
limits:
- "CLICK_WINDOW:25"
- "CREATIVE_INVENTORY_ACTION:25"
- "PLAYER_BLOCK_PLACEMENT:100"
- "CHAT:5"
- "CUSTOM_PAYLOAD:20"
- "TAB_COMPLETE:3"
c:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
max: 10
reset-interval: 100
max-periods: 6
max-warnings: 3
big-threshold: 2048
d:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
max: 10
big-threshold: 2048
max-big: 6
# flood.f is disabled by default: it duplicates tab.a (same packet, same logic)
f:
enabled: false
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
max: 8
# ── Position ───────────────────────────────────────────────────────────────
position:
a:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
b:
enabled: true
punish: false
max-vl: 10
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
delay: 2000
hard: false
ignore-fly: true
c:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
max: 15000
d:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
max: 100000
# ── Payload ────────────────────────────────────────────────────────────────
payload:
a:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
b:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
delay: 1000
max: 15
c:
enabled: true
punish: false
max-vl: 1
min-vl: 1
punish-commands: []
d:
enabled: true
punish: true
max-vl: 5
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
buffer:
max: 5.0
multiply: 0.25
decay: 1.0
e:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
f:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
# ── Tab ────────────────────────────────────────────────────────────────────
tab:
a:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
max: 8
b:
enabled: true
punish: true
max-vl: 3
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
max: 256
# ── Command ────────────────────────────────────────────────────────────────
command:
a:
enabled: true
punish: true
max-vl: 5
min-vl: 1
punish-commands: [] # Example: '- "ape kick %player% Exploit detected"'
options:
max-length: 256
max-rate: 20
blacklist: []
# ─── Duplication Protection ───────────────────────────────────────────────────
# New in this version. Detects & neutralises common duplication exploits using
# pure server-side Bukkit events (no extra dependencies). Techniques inspired by
# the MIT-licensed ExploitShield plugin by Its_Rango.
dupe:
enabled: true
bypass-worlds: [] # worlds where ALL dupe checks are skipped (e.g. creative plots)
# Piston-based dupes (container/slime/TNT/hopper pushed across a chunk seam).
piston:
enabled: true
window-ms: 2500 # time window for the per-world rate signal
rate-limit: 12 # suspicious piston actions per world per window before flag
chain-limit: 7 # same piston firing this many times rapidly = flag
tnt-radius: 2 # blocks; TNT within this of a sticky push = STICKY_TNT
player-radius: 12 # only blame a player within this distance of the piston
kick: false # kick after repeated trips (alerts always fire)
# Inventory / armour / creative dupes.
inventory:
equip: true # rapid armour equip/unequip + shift-click armour slot
equip-rate-ms: 150 # min ms between armour-slot actions
equip-slots: [39, 40] # 39 = helmet slot, 40 = offhand (raw inventory slot IDs)
creative: true # cancel over-stacked creative cursor items
creative-extra-stack: 16 # allowance above max stack size before flagging
item-clone: true # same exact item shuffled repeatedly in a short window
item-repeat-limit: 5 # identical-item moves before ITEM_CLONE flag
# Storage-entity dupes (chest minecart / chest boat / chest horse).
vehicle:
enabled: true
boundary: true # inventory changed across a chunk seam vs snapshot
boundary-violation-limit: 5 # boundary mismatches before flag
reincarnation: true # new storage entity ~identical to a destroyed one
similarity-threshold: 0.95 # cosine similarity (0-1) for reincarnation
similarity-min-items: 10 # ignore near-empty inventories
chunk-window-ms: 3000
chunk-rate: 10 # storage-entity moves in a chunk per window (afk farm)
snapshot-ttl-seconds: 600
history-ttl-seconds: 10
# ─── Integrity / Crash protection ─────────────────────────────────────────────
# Bukkit-event based (version-safe, Folia-region-correct). Techniques inspired by
# the MIT-licensed ExploitShield (Its_Rango) and open-source ExploitFixer (ArkFlame).
integrity:
enabled: true
book: # written-book overflow crashers
enabled: true
max-pages: 100
max-page-chars: 2048
max-total-chars: 32768
sign: # sign overflow / control-char crashers
enabled: true
max-line-chars: 100
block-control-chars: true
anvil: # rename overflow
enabled: true
max-rename-chars: 50
behavior: # impossible entity-action sequences
sprint: true
sneak: true
items: # crash-grade item meta (enchants/lore/attrs/firework/banner)
enabled: true
max-enchant-level: 255
max-enchant-count: 64
max-lore-lines: 64
max-lore-line-chars: 1024
max-name-chars: 256
max-attribute-modifiers: 64
max-firework-power: 6
max-firework-effects: 16
max-banner-patterns: 24
# ─── Punishments (tiered escalation, layered over violation levels) ───────────
# For each exploit key, define rules with: threshold, action, message, command,
# cooldown (ms), repeatable. The highest matching threshold fires.
# action = NONE | ALERT | LOG | COMMAND | KICK (%player% supported in command)
# Exploit keys: PISTON_DUPE, VEHICLE_DUPE, EQUIP_DUPE, ITEM_CLONE, ARMOR_DUPE,
# ARMOR_STAND_DUPE, INVENTORY_DUPE, BOOK_CRASH, SIGN_CRASH, ANVIL_CRASH,
# BAD_ITEM, INVALID_SPRINT, INVALID_SNEAK
punishments:
PISTON_DUPE:
warn: { threshold: 1, action: ALERT }
kick: { threshold: 5, action: KICK, message: "Duplication exploit detected", repeatable: true, cooldown: 5000 }
BOOK_CRASH:
warn: { threshold: 1, action: ALERT }
kick: { threshold: 3, action: KICK, message: "Malformed book detected", repeatable: true, cooldown: 5000 }
SIGN_CRASH:
warn: { threshold: 1, action: ALERT }
kick: { threshold: 3, action: KICK, message: "Malformed sign detected", repeatable: true, cooldown: 5000 }
BAD_ITEM:
warn: { threshold: 1, action: ALERT }
# ─── Full integrity suite (extends the basic integrity: section above) ────────
# Each listener has its own enabled flag so you can flip pieces off without
# touching code. All have sensible defaults — uncomment to override.
integrity:
# ExploitShield ports — grief + crash protection
enderpearl:
enabled: true
spam-window-ms: 150
max-y: 256.0
max-distance: 80.0
strict: false
entity-spam:
enabled: true
per-chunk: 50
window-ms: 1000
types: [DROPPED_ITEM, ITEM, EXPERIENCE_ORB, ARMOR_STAND, MINECART, BOAT]
explosion-dupe:
enabled: true
rate-ms: 500
protect-containers: true
lava-grief:
enabled: true
max-per-chunk: 1
block-spread: false
item-salvage:
enabled: true
max-repair-cost: 40
max-enchant-count: 10
max-enchant-level: 10
check-impossible-combo: true
pace:
enabled: true
max-blocks-per-second: 12
client:
ghost-item: true
no-swing: true
inventory-abuse:
enabled: true
max-weight: 100
window-ms: 2000
position:
enabled: true
max-delta: 50.0
max-coord: 1000000.0
grace-ms: 7000
freeze-ms: 3000
command-crash:
enabled: true
max-length: 256
max-args: 40
spam-crash:
enabled: true
chat-cooldown-ms: 400
command-cooldown-ms: 400
item-nbt:
enabled: true
max-nbt-bytes: 9000
max-name-bytes: 256
cooldown-ms: 250
bad-packets:
held-item: true
bed-leave: true
pitch: true
flight: true
spectate: true
respawn: true
hotbar-slot: true
swap-hands: false
# ExploitFixer ports — module suite
action-cooldowns:
enabled: true
geyser-support: true
place-ms: 30
break-ms: 30
use-ms: 30
creative-sanitizer:
enabled: true
max-stack-size: 64
enchant-limit: 10
block-unbreakable: false
max-display-name: 64
max-lore: 256
max-book-pages: 100
max-book-page-length: 2048
max-firework-effects: 8
max-firework-power: 6
max-potion-amplifier: 4
max-potion-duration: 24000
blacklist:
- COMMAND_BLOCK
- REPEATING_COMMAND_BLOCK
- CHAIN_COMMAND_BLOCK
- BARRIER
- STRUCTURE_BLOCK
- STRUCTURE_VOID
- JIGSAW
- DEBUG_STICK
recipe-blacklist:
enabled: true
materials: []
command-blocker:
enabled: true
block-syntax: true
bypass-permission: "ape.bypass"
commands:
- "minecraft:tp"
- "minecraft:give"
- "minecraft:summon"
- "minecraft:execute"
- "minecraft:setblock"
- "minecraft:fill"
- "bukkit:?"
- "bukkit:help"
- "bukkit:plugins"
- "bukkit:pl"
- "bukkit:version"
- "bukkit:ver"
tab-complete:
enabled: true
max-length: 256
block-dig:
no-gui: true
block-place:
same-block: true
same-block-window-ms: 50
invalid-click:
enabled: true
prevent-swap: true
projectile:
enabled: true
max-velocity: 15.0
infinite-amount:
enabled: true
max: 127
# ─── Netty-level BadPacket checks (added 1.3.0) ───────────────────────────────
# These run through the same packet-check pipeline as your existing 30 checks.
# Punishment commands come from the global checks.<name>.options.punish list.
checks:
bad-packet:
h: { enabled: true, max-vl: 5, options: { max: 12, window-ms: 1000 } }
l: { enabled: true, max-vl: 5, options: { max: 30, window-ms: 1000 } }
n: { enabled: true, max-vl: 5, options: { max: 4, window-ms: 2000 } }
q: { enabled: true, max-vl: 5, options: { max: 6, window-ms: 1000 } }
# ─── More punishment tiers for the new exploits ───────────────────────────────
punishments:
ENDER_PEARL_GLITCH:
warn: { threshold: 1, action: ALERT }
kick: { threshold: 5, action: KICK, message: "Ender pearl exploit", repeatable: true, cooldown: 5000 }
ENTITY_SPAM:
warn: { threshold: 1, action: ALERT }
BED_EXPLOSION_DUPE:
warn: { threshold: 1, action: ALERT }
kick: { threshold: 3, action: KICK, message: "Bed dupe attempt", repeatable: true, cooldown: 5000 }
LAVA_GRIEF:
warn: { threshold: 1, action: ALERT }
ITEM_SALVAGE:
warn: { threshold: 1, action: ALERT }
kick: { threshold: 3, action: KICK, message: "Anvil NBT exploit" }
PACE:
warn: { threshold: 1, action: ALERT }
CLIENT_INTEGRITY:
warn: { threshold: 1, action: ALERT }
INVENTORY_ABUSE:
warn: { threshold: 1, action: ALERT }
POSITION_OVERFLOW:
warn: { threshold: 1, action: ALERT }
kick: { threshold: 2, action: KICK, message: "Crafted position packet", repeatable: true, cooldown: 5000 }
COMMAND_CRASH:
warn: { threshold: 1, action: ALERT }
kick: { threshold: 1, action: KICK, message: "Malformed command", repeatable: true, cooldown: 5000 }
SPAM_CRASH:
warn: { threshold: 5, action: ALERT }
ITEM_NBT:
warn: { threshold: 1, action: ALERT }
BAD_PACKET_B:
warn: { threshold: 1, action: ALERT }
BAD_PACKET_C:
warn: { threshold: 1, action: ALERT }
BAD_PACKET_D:
warn: { threshold: 1, action: ALERT }
BAD_PACKET_I:
warn: { threshold: 1, action: ALERT }
kick: { threshold: 3, action: KICK, message: "Flight exploit" }
BAD_PACKET_K:
warn: { threshold: 1, action: ALERT }
BAD_PACKET_M:
warn: { threshold: 1, action: ALERT }
BAD_PACKET_P:
warn: { threshold: 1, action: ALERT }
ACTION_COOLDOWN:
warn: { threshold: 1, action: ALERT }
CREATIVE_SANITIZER:
warn: { threshold: 1, action: ALERT }
RECIPE_BLACKLIST:
warn: { threshold: 1, action: ALERT }
COMMAND_BLOCKER:
warn: { threshold: 1, action: ALERT }
TAB_COMPLETE:
warn: { threshold: 1, action: ALERT }
BLOCK_DIG:
warn: { threshold: 1, action: ALERT }
BLOCK_PLACE:
warn: { threshold: 1, action: ALERT }
INVALID_CLICK:
warn: { threshold: 1, action: ALERT }
PROJECTILE_OVERFLOW:
warn: { threshold: 1, action: ALERT }
kick: { threshold: 1, action: KICK, message: "Projectile velocity exploit" }
INFINITE_AMOUNT:
warn: { threshold: 1, action: ALERT }
HOW IT WORKS
Every module runs silently. When a check fires:
- Violation level increments per check
- Console logs the player, check type and VL instantly
- Configured punish command executes automatically (kick / ban / mute / custom)
- APEAlertEvent fires on the Bukkit bus — external plugins can hook it
- Discord webhook support via your punish commands
Zero chat broadcasts. Zero guessable commands. Your staff won't even see it happen — but the console will.
COMMANDS
Code:
/ape reload — Reload config & all modules
/ape status — Plugin version, module count, player count
/ape modules — List all 36 active modules
/ape stats <p> — Player ping, world, gamemode
/ape kick <p> — Manual connection close
/ape verbose — Toggle packet-level output for yourself only
/ape printer — Printer/Schematica safe debug mode
/ape kickall — Emergency mass kick
CONSOLE OUTPUT EXAMPLE
Code:
[00:12:45] [ALERT] PlayerName failed Piston Dupe (1/5)
[00:12:49] [ALERT] PlayerName failed Piston Dupe (5/5)
[00:12:49] [DUPE] PlayerName | PISTON_DUPE | Chain: 8
[00:12:49] PlayerName left the game [Duplication exploit detected]
Full audit trail. No manual intervention.
REQUIREMENTS
- Paper / Folia 1.21.x
- Java 17+
- No dependencies
