NoCheatPlus

Detect and fight the exploitation of various flaws/bugs in Minecraft!
Introduction
NoCheatPlus attempts to prevent cheat clients from exploiting weaknesses of Minecraft or its protocol, making your server more safe. Checks cover a wide range of issues including flying and speeding, fighting hacks, fast block breaking and nukers, inventory hacks, chat spam and other types of malicious behaviour. For a more complete list have a look at the Features Page.
NoCheatPlus puts emphasis on configurability and allows you to customize actions that are carried out when a player fails a check (e.g. silent cancelling, executing commands, just logging). Bypass permissions allow to control what check to apply for which players, all checks can be deactivated in the configuration, also having the option for world-specific configuration files. Many checks allow more detailed configuration to adjust sensitivity.
Certainly NoCheatPlus is not a magical bullet, it uses a lot of heuristics and even guessing, so you will encounter false positives here and there and also not catch every single violation. Example video of how NoCheatPlus blocks cheats (outdated plugin version).
NoCheatPlus was introduced by NeatMonster, building on the code base of NoCheat by Evenprime.
Recommended
The following plugins might be useful to have a look at.
ProtocolLib
Allows NoCheatPlus to activate packet-level checks, covering a range of exploits that can't be monitored using ordinary means. Since roughly Minecraft 1.7.10, the fight.speed check can't work as expected anymore, due to changes in CraftBukkit. With ProtocolLib this can be repaired.
CompatNoCheatPlus (cncp)
Make plugins like mcMMO or MachinaCraft more compatbile with NoCheatPlus. Not all existing plugins are covered (yet), but you can leave a note or create an issue/ticket request for cncp. Phasing out: Citizens 2 should work with NCP out of the box, MagicSpells are working on compatibility too - rest will be integrated into NCP.
Orebfuscator
Orebfuscator fights all sorts of X-ray-hacks by altering the map information that is sent to the players, such that they have to mine blocks to actually reveal what is behind. Virtually a "must have". (Latest versions of Spigot contain features of Orebfuscator.)
Downloads and History of Changes
- Download officially approved versions on the Files page at BukkitDev.
- Development builds have been moved over to the Jenkins at md-5.net.
- Do not download from any other source, do not use jars other people send you.
- Change lists: Wiki (digest) | Jenkins (by build number) | GitHub (all commits).
- Source code
Plugin statistics are no longer reported to mcstats.org.
Support
Documentation Resources
- Consider first: Frequently asked Questions and Known Issues.
- Wiki (Configuration, Permissions, Commands)
- Developers might have a look at the page describing the API of NoCheatPlus.
Contact us
- Quick questions can be asked on this page,
or on IRC (Server: irc.spi.gt | Default-Port: 6667 | SSL-Port: 6697 | Channel: #nocheat | Web client: WebIRC) - For real issues or feature requests please create a new issue/ticket or add to an existing issue/ticket.
- To send information that is not to be seen by all, you can also reach us by PM to @asofold and @MyPictures. @IceAP (IRC: ICE) will also help or redirect the conversation. Please do not contact the user 'NoCheatPlus', it is for administrative purposes only and will likely not be answered in time. Keep to BukkitDev and GitHub for support, do not trust users on other forums or websites, also not if their nick names are the same as NCP staff on BukkitDev.
Please always state the output of the "ncp version" command to let us know versions in use (users of cncp also the "cncp" command).
-
View User Profile
-
Send Message
Posted Sep 12, 2015@MCTylerPVP
That seems overly optimistic towards the non-free plugins!
Seriously, it's certainly not "everything", though fight and ("emo-") fly are pretty severe at present. We'll cut down fly for sure, because that's our main field after all. Fighting will need ProtocolLib and will follow soon, though we can't really prevent bots.
-
View User Profile
-
Send Message
Posted Sep 11, 2015My friend uses JaM Client on Mineplex and bypasses everything...There's no hope for us freeloaders, IMHO. Good Luck Dev!
-
View User Profile
-
Send Message
Posted Sep 10, 2015@martini002
It "will be" (mostly) solved, once we are at it. We've just worked around a nasty type of false positive. While such always adds some danger for more exploits (...), we'll be on topic with fight checks and flying exploits from then on.
Unless it is very simple to fix, we usually try to remove false positives first, then tackle the exploits. Currently it's a little bit lengthy but we'll catch up soon.
-
View User Profile
-
Send Message
Posted Sep 9, 2015@asofold
I have ProtocolLib installed too
-
View User Profile
-
Send Message
Posted Sep 8, 2015@martini002
@PowerHustlers
It'll certainly be solved for most (possibly will need ProtocolLib though, at least for fighting)..
-
View User Profile
-
Send Message
Posted Sep 1, 2015Same player are bypassing everything.
-
View User Profile
-
Send Message
Posted Aug 30, 2015With Huzuni players are able to fly and exploit pvp hacks, i tried it and works very well, there is a big problem with that, would it be solved soon? Thanks
Edit: They can duplicate wheat and wood
-
View User Profile
-
Send Message
Posted Aug 21, 2015@Glitchblade
With "rough" compatibility we usually describe, that testing may not have been very intense (thus also beta) and that we just tried to tackle the most basic and/or severe issues, e.g. support for new types of blocks.
Essentially the beta release (3.12.0) is way outdated for 1.8. Instead the latest development builds are crafted towards a release and should be preferred for 1.8, at least until next release.
In general we keep some serious backwards compatibility, so having the latest (stable) release usually means improvements. There are rare cases when using the latest NCP on a much older version of Spigot/CraftBukkit will be more lenient, e.g. using the sprint key with flying, faster block breaking times. I'd also call the compatibility with 1.4.5-R1.0 "rough", because we hardly test that part ever.
-
View User Profile
-
Send Message
Posted Aug 21, 2015What does "rough" support mean? Is this essentially a beta release for 1.8 - 1.8.3? Is this release known to be problematic with 1.8.4+ or is it just not recommended/untested?
-
View User Profile
-
Send Message
Posted Aug 19, 2015@asofold
The client moves at full speed while the server thinks they are blocking. As a result NCP flags moving_survivalfly for moving at full speed while blocking.
https://github.com/NoCheatPlus/NoCheatPlus/blob/master/NCPCore/src/main/java/fr/neatmonster/nocheatplus/checks/moving/SurvivalFly.java#L637
@Youtube_thejust219
Granting the permission node "nocheatplus.checks.moving.survivalfly.blocking" allows the player to block while moving at normal speed.
-
View User Profile
-
Send Message
Posted Aug 19, 2015@JoinMice
该许可“nocheatplus.checks.fight”允许绕过相关的战斗所有检查。如果你想有一个球员用一个特殊的程序,而不是一个服务器端插件飞,你应该给他们的许可“nocheatplus.checks.moving.survivalfly”。那么“creativefly”检查将监视飞行速度。 (使用谷歌翻译)
-
View User Profile
-
Send Message
Posted Aug 19, 2015关于一个问题 1.7.2的 水龙头服务器 我就算给了VIP nocheatplus.checks.fight 权限他依然无法飞行 希望有人可以帮助我一下 感激不尽
-
View User Profile
-
Send Message
Posted Aug 14, 2015@Youtube_thejust219
NCP does not alter blocking in any way. That might be a server side bug (is your server up to date?), or it might be a plugin messing with stuff.Do you know what it is triggered by?--
Please keep to the ticket, if it is that issue.
-
View User Profile
-
Send Message
Posted Aug 14, 2015Players get a server-side glitch, where on their client they are normal, but on the server-side, they are blocking with their sword, they have to block & unblock for this to fix. What are the nodes to bypass this block check?
-
View User Profile
-
Send Message
Posted Aug 13, 2015@Sikatsuu
Supporting changing blocks is quite complicated in nature. After the next release there is a chance we will newly evaluate how complicated it might be or if there is a simplified model we could implement, always having in mind not allowing to fly and such. Essentially on server side, you get situations where players move through blocks, hover in the air, take 1-block distances in almost one step, and similar.
Edit: Pistons are covered in Ticket 364.
-
View User Profile
-
Send Message
Posted Aug 13, 2015Automatic piston lifting systems or slime bouncing are being blocked by this plugin. Will this ever be fixed or not? I saw several tickets about it from months ago until now, but no news it seems?
-
View User Profile
-
Send Message
Posted Aug 12, 2015@martini002
Good, thank you :).
@Bobcat00
We are heading for a release, currently trying to iron out a range of false positives, which show "best" with snow layers of differing height, we will also add a replacement for fight.speed using ProtocolLib.
The builds since 823 might have introduced new side issues with survivalfly, but they also do contain at least these improvements:
Since false positives count most for most people, it's probably rising and falling with the moving checks. I'd assume, unless for a snow-layers based server, you might be better off with the latest dev build until the next release. Can you test it with typical setups and a couple of players?
-
View User Profile
-
Send Message
Posted Aug 11, 2015I'm using build 823 (from back in May) with CraftBukkit 1.8.8. Should I update to a newer dev build? If so, which version would you recommend?
-
View User Profile
-
Send Message
Posted Aug 11, 2015@asofold
Ok buddy i just download the version 848 and i tell to my staff team if they see someone flying notify me inmediatelly, ill notify you, thanks
-
View User Profile
-
Send Message
Posted Aug 10, 2015@File14
That would indeed be interesting, also setting probabilities for cancel (or commands). Currently it's not supported, i assume it's been like that with the original NoCheat, can't be entirely sure though.
A couple of optimizations rely on cancelling and it's some question how/where exactly to work a similar solution or if to just make delay+repeat possible everywhere (might then include an overhaul of some chunk of the internal bookkeeping of violations for performance reasons). So this isn't as quick to change as it might seem at first glance.