Minecraft anti-cheat that shows its work.

Also in the build

• reach

  Hits landing beyond 3.3 blocks, after winding the target back to where the attacker’s connection could have shown it. Never a single hit.

  Java 1.17+, with packet capture on
• hitbox

  Repeatedly hitting a target the player wasn’t looking at. Catches kill auras and multi-auras.

  Java 1.17+, with packet capture on
• criticals

  Critical hits after a hop no real client can make.

  Java players, with packet capture on
• no-swing

  Attacks sent without the arm swing every Java client sends with them.

  Java 1.9+, with packet capture on
• velocity

  Taking less than half the knockback the server applied, across several separate hits.

  Java 1.17+, with packet capture on
• speed

  Moving further per tick than a player can run. Ice, vehicles, elytra, riptide, knockback, and speed effects are allowed for.

  Everyone
• fly

  Holding the same height in mid-air for a second or more, with nothing to explain it.

  Everyone
• ack-withheld

  Faking lag: a client that stops answering Argus’s timing checks for 10 seconds while its movement keeps arriving.

  Java 1.17+, with packet capture on
• target-switch

  Landing hits on two opponents at least 30° apart within a tenth of a second of the player’s own time, at least four times. An aura spraying attacks around a crowd.

  Java 1.17+, with packet capture on
• attack-while-using

  Repeatedly attacking while holding up a shield or spyglass, which a modern client does not send.

  Java 1.9+, needs ViaVersion on each backend server
• timer

  Sending more movement than real time allows: a sped-up game clock. Lag spikes and the catch-up after them never count.

  Java 1.13+, with packet capture on
• fast-bow

  The same limit counting only the movement sent while drawing a bow, which fast-bow cheats flood to draw instantly.

  Java 1.13+, with packet capture on
• piercing

  Hits landing through a solid wall, which the game’s own targeting does not allow. Only full, always-solid blocks count — doors, slabs, stairs and glass are treated as clear — and a wall that went up too recently for the player to have received it never counts against them. If two different players land hits through the same patch of world, Argus stops judging that patch altogether: a plugin placing or hiding blocks without telling clients explains that far better than both of them cheating.

  Java 1.17+, with packet capture on
• non-finite-position

  A position that isn’t a number at all. Nothing to do with how someone was playing — it’s a value the real client cannot express, so the packet didn’t come from one.

  Everyone, with packet capture on
• non-finite-rotation

  The same, for where the player was looking. Kept separate so evidence about one never rests on a rule about the other.

  Everyone, with packet capture on
• pitch-out-of-range

  A client reporting that it’s looking further than straight up or straight down. The real client clamps this before sending, and a server accepts such a packet without complaint — so without this check, nothing questions it.

  Everyone, with packet capture on
• position-out-of-range

  A position outside the coordinates the game can represent — not someone who walked a long way, but a number no amount of walking produces. Measured against the game’s own limit, never your world border, because borders move and a plugin can legitimately put someone past one.

  Everyone, with packet capture on
• interact-self

  An attack aimed at the player’s own character. Nobody can be in front of themselves — the game picks a target by looking out from your own eyes and leaves you out of the search — so no way of aiming produces this. It turns up in exploit payloads. Only judged once your server has told Argus which character the player is, never against a guess.

  Everyone, with packet capture on
• interact-impossible-entity

  An attack naming a creature or player that cannot exist. Your server hands out these numbers from a counter that starts at one and only climbs, so a negative one belongs to nothing that has ever been in the world, and a client can only interact with something the server has told it about.

  Everyone, with packet capture on
• duplicate-teleport-ack

  The same teleport confirmed more than once. When your server moves a player it asks them to confirm it, and the real client confirms exactly once — so a repeat did not come from one. Confirmation spam turns up in timing exploits. **Judged only on teleports Argus watched your server issue.** A confirmation naming anything else is ignored rather than questioned, because Argus attaches to players already online and cannot see a teleport sent in the instant before it finishes attaching on a join — and “I did not see that one issued” is not the same claim as “it was never issued”. **Several repeats are required, not one**, because a proxy re-sending a packet cannot be told apart from a client doing it and you may well run one.

  Java clients **1.9 and newer whose version Argus can read**, with packet capture on. Older clients do not send these confirmations at all — ViaRewind sends them on their behalf — so the packet would be the translator’s rather than the player’s, and a client whose version cannot be read is declined for the same reason
• window-not-open

  A click inside a container window your server never opened for that player. The window number comes from your server’s own message telling the client a container is open, and the real client has no way to invent one — so a click naming a different window did not come from one. Container and duplication exploits use it to reach inventories they were never shown. **Judged only once Argus has seen a window open or close for that player.** Argus attaches to anyone already online when it starts, and it also cannot see a menu opened in the instant before it finishes attaching on a join — a kit selector, say — so judgement waits on evidence rather than on timing. The cost is that a player for whom no window is ever opened is not judged by this check. A window your server has just closed, or one displaced by a second container opening, is excused for a second, because a click can already be in flight and was legitimate when it was sent. **If this check’s own reading of your outbound traffic fails repeatedly it switches itself off and says so in the console** — it then reports nobody, rather than reporting wrongly.

  Everyone, **with packet capture on**
• creative-action-in-survival

  A client using the creative-mode inventory while your server has the player in survival. In creative the game lets a client write any item straight into any slot, and your server honours it, because in creative that is the point — so the same instruction from a survival player is asking for something out of nothing, and it is where several duplication and give-yourself-anything exploits begin. Your server refuses the write but does not tell you a client tried. Judged with two seconds of slack after a game-mode change, because the mode is read once a tick while packets keep arriving: an instruction already in flight when staff take somebody out of creative was legitimate when it was sent, and nobody is reported for staff timing. Spectators count as creative here, which under-reaches rather than over-reaches. One limitation worth knowing: a plugin that tells a client it is in creative without changing the mode on the server will produce honest findings from this check, so switch it off if you run one.

  Everyone, with packet capture on
• held-slot-out-of-range

  A claim to have selected a hotbar slot that does not exist. The hotbar is nine slots and a client can only pick one of them — the number comes from a keypress or the scroll wheel, both clamped before the packet is sent. Your server already refuses anything else, but only notes it where nobody looks, so without this you would never learn a client on your server had tried.

  Everyone, with packet capture on