Built-in behavioural detection, sanctions, and the protections that ship on by default.
Anti-Cheat & Server Integrity
Your game server is authoritative — the client sends intent, never state — so the classic exploits (teleporting, editing your own gold, granting yourself items) simply don't have a path in. On top of that foundation, the engine ships a built-in anti-cheat layer that watches for the abuse authority alone can't catch: botting, farming rings, credential stuffing, and message floods.
It's an engine-level system, on by default. There's nothing to install and nothing to author.
What Always Protects You
| Protection | What it stops |
|---|---|
| Schema validation | Every message a client can send is validated against a strict schema; malformed messages are dropped |
| Rate limiting | A per-connection token bucket caps overall message rate, with tighter throttles on abilities and movement |
| Payload cap | Oversized frames are rejected outright |
| Credential handling | Credentials travel in the first authenticated frame, never in a URL, so tokens can't leak into proxy logs |
| Per-IP connection cap | One machine can't open unlimited sockets |
| Login brute-force limiter | Short-circuits repeated login attempts before the expensive password hash |
| Plugin budgets | Sandboxed plugins get a per-tick dispatch budget and bounded economy grants |
Behavioural Detection
The anti-cheat layer reads the server's own authoritative event streams — the same events that drive gameplay — and looks for patterns no legitimate player produces:
- Economy and XP velocity — gold, items or experience accruing faster than the game can actually produce them
- Combat velocity — kill rates and action cadence beyond what a human sustains
- Botting regularity — inhumanly consistent timing, and sessions that never end
- Transport abuse — message floods and reconnect churn
- Login abuse — credential stuffing and brute-force attempts
Sanctions
Suspicion drives an automatic escalation ladder, each step recorded in a persisted audit trail:
1. Flag — recorded for review, no player impact 2. Throttle — the offending action is slowed 3. Kick — the session is dropped 4. Temporary ban — the account is locked out for a period
Operators review everything from the /anti-cheat panel: current status, the event stream, active sanctions, and manual issue/revoke — with a dry-run so you can see what an action would do before it does it. The same operations are available as typed admin endpoints, so tooling and automation can drive them too.
Modes
| Mode | Behavior |
|---|---|
| Enforce (default) | Detect, score, and apply sanctions |
| Flag | Detect, score and surface for review, but never take an automated action — enforcement is operator-only. Good for a first week on a live world |
| Shadow | Detect, score and log the action it would have taken, without acting or escalating — the observation/tuning phase |
> Legitimate players sharing a network (a household, a school, a café) and normal reload churn will not trip the connection-flood detection — that leniency is built in.