NoCheatPlus

Detect and fight the exploitation of various flaws/bugs in Minecraft!
Introduction
NoCheatPlus attempts to prevent cheat clients from exploiting weaknesses of Minecraft or its protocol, making your server more safe. Checks cover a wide range of issues including flying and speeding, fighting hacks, fast block breaking and nukers, inventory hacks, chat spam and other types of malicious behaviour. For a more complete list have a look at the Features Page.
NoCheatPlus puts emphasis on configurability and allows you to customize actions that are carried out when a player fails a check (e.g. silent cancelling, executing commands, just logging). Bypass permissions allow to control what check to apply for which players, all checks can be deactivated in the configuration, also having the option for world-specific configuration files. Many checks allow more detailed configuration to adjust sensitivity.
Certainly NoCheatPlus is not a magical bullet, it uses a lot of heuristics and even guessing, so you will encounter false positives here and there and also not catch every single violation. Example video of how NoCheatPlus blocks cheats (outdated plugin version).
NoCheatPlus was introduced by NeatMonster, building on the code base of NoCheat by Evenprime.
Recommended
The following plugins might be useful to have a look at.
ProtocolLib
Allows NoCheatPlus to activate packet-level checks, covering a range of exploits that can't be monitored using ordinary means. Since roughly Minecraft 1.7.10, the fight.speed check can't work as expected anymore, due to changes in CraftBukkit. With ProtocolLib this can be repaired.
CompatNoCheatPlus (cncp)
Make plugins like mcMMO or MachinaCraft more compatbile with NoCheatPlus. Not all existing plugins are covered (yet), but you can leave a note or create an issue/ticket request for cncp. Phasing out: Citizens 2 should work with NCP out of the box, MagicSpells are working on compatibility too - rest will be integrated into NCP.
Orebfuscator
Orebfuscator fights all sorts of X-ray-hacks by altering the map information that is sent to the players, such that they have to mine blocks to actually reveal what is behind. Virtually a "must have". (Latest versions of Spigot contain features of Orebfuscator.)
Downloads and History of Changes
- Download officially approved versions on the Files page at BukkitDev.
- Development builds have been moved over to the Jenkins at md-5.net.
- Do not download from any other source, do not use jars other people send you.
- Change lists: Wiki (digest) | Jenkins (by build number) | GitHub (all commits).
- Source code
Plugin statistics are no longer reported to mcstats.org.
Support
Documentation Resources
- Consider first: Frequently asked Questions and Known Issues.
- Wiki (Configuration, Permissions, Commands)
- Developers might have a look at the page describing the API of NoCheatPlus.
Contact us
- Quick questions can be asked on this page,
or on IRC (Server: irc.spi.gt | Default-Port: 6667 | SSL-Port: 6697 | Channel: #nocheat | Web client: WebIRC) - For real issues or feature requests please create a new issue/ticket or add to an existing issue/ticket.
- To send information that is not to be seen by all, you can also reach us by PM to @asofold and @MyPictures. @IceAP (IRC: ICE) will also help or redirect the conversation. Please do not contact the user 'NoCheatPlus', it is for administrative purposes only and will likely not be answered in time. Keep to BukkitDev and GitHub for support, do not trust users on other forums or websites, also not if their nick names are the same as NCP staff on BukkitDev.
Please always state the output of the "ncp version" command to let us know versions in use (users of cncp also the "cncp" command).
-
View User Profile
-
Send Message
Posted Mar 28, 2015@Bobcat00
That is the current default actions :p (those have an extra vl>30: .... :icf).
@YoungPvProck
You should keep it at default, NCP will decide by Minecraft version then. Is there are reason to "disable" it? What do you want to reach?
-
View User Profile
-
Send Message
Posted Mar 28, 2015Whic other options you can add for this feature "knockbackvelocity"? I would like to disable but now it come with "default"
-
View User Profile
-
Send Message
Posted Mar 28, 2015@asofold
OK, thanks. I changed the moving.passable action to:
cancel vl>10 log:passable:0:5:f cancelMaybe that should be the default value. :-)
-
View User Profile
-
Send Message
Posted Mar 28, 2015@Bobcat00
If it doesn't matter that cheaters can move through solid blocks, you could of course turn off the check (even selectively for a world). Otherwise i'd say leave the check on and remove the log actions for passable.
The passable-violations at login and for (some) teleports are not false positives in terms of what the check is checking for (moving through solid blocks), of course those players are not cheating. At present an actual cheater would probably cause much fewer violations with passable, so in fact one would have to look for that, which in my opinion renders the passable logging as it's done right now mostly useless :).
The slowly descending moves are sent by the client during receiving + rendering the chunks after join/far-teleporting, they are a workaround added by Mojang because without that their vanilla flying check would kick players for flying if they log in in-air.
In theory extremely slow/delayed clients might receive the passable teleports with a (strange) delay after their chunks rendered, so they already started moving - in effect they might get teleported back after starting to move. That situation might also cause morepacketsviolations and probably survivalfly too, not sure it still can happen, it seemed to be very rare.
So once more, as the passable violations mostly appear while the player is not even seeing the map, i suggest keeping the check active but remove the log action(s) from the passable actions entry in the cofniguration.
-
View User Profile
-
Send Message
Posted Mar 28, 2015@asofold
I think the moving.passable notifications come from the teleport problem. I see people with slow Internet connections getting multiple moving warnings and the Y location given is just going down a very small amount, while X and Z remain the same.
Are you saying that I should leave the check on and remove the notifications? Which is better for the player? Is he better off if NCP cancels the falling?
-
View User Profile
-
Send Message
Posted Mar 28, 2015@ItsLemonmelon
Answered in the ticket thread...
-
View User Profile
-
Send Message
Posted Mar 28, 2015I can't change prefix, why?
-
View User Profile
-
Send Message
Posted Mar 28, 2015@Bobcat00
As far as i can judge false positives should be rather less - what situations are problematic?
Passable will always generate messages after people join/teleport, but those are necessary for protection (not the messages but the cancelling of actions), so ensure to have another reason to turn the check off (and not the notifications).
-
View User Profile
-
Send Message
Posted Mar 27, 2015@asofold
I turned off moving.passable because of all the false positives. I hope you can improve the processing in the future. I'm using build 813.
-
View User Profile
-
Send Message
Posted Mar 26, 2015@TJ1632
Modify the rules in the config file to remove the 'cancel' action. See https://github.com/asofold/NCPDocs/blob/master/wiki/configuration/checks%2Fchecks.creole
-
View User Profile
-
Send Message
Posted Mar 26, 2015@asofold What would I need to do in order to make it so that my staff got notifications but that the plugin didn't affect gameplay. If a player was hacking all I would want to happen is for my staff to be made aware; not have the plugin try to stop the hacker.
-
View User Profile
-
Send Message
Posted Mar 25, 2015@Difd9
60-80 players already is a lot, "most" servers have much less players, of course you get "constant" input. False positives exist, partly for reasons, but at least they exist - in some checks you might configure to your needs, but for protectiong against some things one has to live with a few false positives in general (not meant final, but Minecraft+multiplayer isn't a combination that allows efficient anti cheating with some precision and without false positives).
The leniency thing probably can't be added so easily, because we have a lot of configurability already and global/generic levels might just break custom configurations. Maybe there will be auto-config commands some day or we just fix things.
Ping - we do account for server-side lag and on some checks for client-side lag too, we can't allow arbitrary amounts of congestion/lag, some checks are configurable concerning that.
What version of Minecraft are you using and what version of NCP (just paste the output of the "ncp version" command)? Sometimes people just use outdated versions of NCP, ensure to use the lates (beta) release from BukkitDev at present.
-
View User Profile
-
Send Message
Posted Mar 25, 2015HOLY FALSE POSITIVES! When I even have less then 100 players on my server (60-80) I get reports NONSTOP. like seriously. I love the idea of an anti cheat but everyone keeps telling me: Anti-cheat is hitler. TPing people back even if they are not hacking. Could you add different levels of protection to the cheat plugin (for example a line that says leniency: 1-5 one being current settings 5 being for a server like mine) Also, PLEASE make it so that ping is a factor of how tight the anti cheat is. This plugin is completely unusable
-
View User Profile
-
Send Message
Posted Mar 24, 2015@MCTylerPVP
NCP roughly does:
Preventing cheating is probably the most important for most people who use this plugin :). The default alerts could be "better", however many people usually want many different "betters", so we put it roughly were most users might be. The alert system has not been made for showing to ordinary players, it's rather aimed at informed server staff (admins, mods, also server owners), due to false positives some configurations might need a little instruction or experience to actually judge.
Informing players is a noble thing, but it'll end up not being too accurate, because nowadays hack clients tend to stay under the radar by adapting to anti cheating plugins, so unless for the "too simply coded hack clients", you'll be asking yourself "is this a false positive?". For some cheats one of the biggest jobs NCP is doing, is to set limits for cheat client developers, so they have to adapt to not get detected, hopefully allowing legit players to stand a chance in game play.
@Robson112011
In theory you can use the latest version - we have kept the basic compatibility modules for 1.5.x, however it's been quite a while since we have tested 1.5.x ourselves, so it might be we have killed off compatibility with a general Bukkit-API dependency update. In any case if you use the latest (beta) release from BukkitDev, please test it on a test server first if any errors appear, we will still attempt to keep compatibility up, provided we are supplied with bug reports and that you test our suggested fixes.
The current state of NCP should be "better" than the old versions, concerning cheating. Performance-wise it can't really be guessed in one go, because on the one hand there have been performance improvements like asynchronous logging or just optimizations, on the other hand the number of checks rather has increased and some of the damage API handling will be more inefficient on 1.5.x.
So i suggest you try the latest (beta, 3.12.0 or later) release and please report back if there are any errors and maybe in any case the output of the "ncp version" command, so we can see if everyting is put right.
-
View User Profile
-
Send Message
Posted Mar 24, 2015What the most recommended version for use in bukkit 1.5.2? Ps: I'm using 3.11.1, but I do not know if it is working correctly as the good old 3.9.3.
-
View User Profile
-
Send Message
Posted Mar 24, 2015@asofold
I guess I missed the point of this plugin and perhaps its functions are over my head. What I want is that if someone is cheating in the game I would at least like to notify other players as to the fact that they are not playing in a fair game. If I turn the messages off I might as well remove the plugin and save Ram. I will try to tweak the settings so "normal" commands do not send alerts...Thank you!
-
View User Profile
-
Send Message
Posted Mar 23, 2015@MCTylerPVP
How about turning the console messages off, if you don't want any? Do note this is Minecraft-multiplayer and not a 2-bit simulation of "good weather vs. bad weather" :p, false positives are pretty common. We will certainly always work towards reducing false positives, however we do rely on user-feedback to fine-tune settings, and we do encourage server owners to configure for their needs, there are too many different approaches to what people want to see and what not.
-
View User Profile
-
Send Message
Posted Mar 22, 2015@asofold
I'll try your latest version 1st then I will look at alternative solutions...Thanks!
-
View User Profile
-
Send Message
Posted Mar 21, 2015@MCTylerPVP
@MyPictures
The passable check triggering after teleports/join is a usual thing to happen. It might reach some level with slowly rendering clients.
The passable violations don't really tell much, because one attempt to move through a 5 blocks thick wall gets you one violation, but the vanilla Minecraft client might produce level 40 just with rendering chunks and sending "fake slow falling" moves while rendering chunks.
It's probably totally legitimate to remove the log actions from the passable check.
-
View User Profile
-
Send Message
Posted Mar 21, 2015@MCTylerPVP
That doesn't always work of course. There can be multiple issues that cause this (maybe that /back plugin also teleports the player inside the block a little or blockshapes are somehow wrong on your setup).
You could adjust the actions of Passable to only throw notifications at higher violation levels: https://github.com/MyPictures/NoCheatPlus/wiki/Global#actions
If you believe that the issue is coming from our side then feel free to open up a "defect" ticket and fill out every information we need. After that we could debug it together.
@danielfr789
Yea we know. You can use the beta build on dev.bukkit.org 813. That implements support for 1.8.3.
@ELSaitam
Yes. 813 supports even 1.8.3 now.