Scripting Permissions

Scripting: Permissions

JustHostMC enforces a strict consent and permission model for all Lua scripts. Because scripts run in a sandboxed interpreter, they must declare the permissions they need in their meta block to access functions in the Host API.

The Consent Model

• Built-in Scripts: First-party scripts embedded in the engine (like the official Vanilla, Paper, or Fabric providers) are fully trusted. The permissions they declare are granted automatically by default (though users can manually revoke them).
• User-imported Scripts: Third-party scripts are completely untrusted. They start with an empty permission grant set. If they attempt to call a protected API function, the script immediately aborts with an ErrPermissionDenied. Users are prompted with a consent dialog in the UI and must explicitly approve the declared permissions before the script can execute successfully.

Permission Kinds

Below are the 9 valid kind identifiers you can use in a script's meta.permissions block:

Provider & Setup Permissions

• network: Allows the script to perform HTTP(S) network requests and download files.
• fs_server: Allows the script to read and write files inside the server's working directory.
• install: Allows the script to resolve Java binaries and run .jar installer processes (like Forge).

Automation Permissions

• console_read: Allows the script to read the live console log stream (required for on_log).
• console_write: Allows the script to write commands to the server's standard input.
• server_control: Allows the script to start, stop, or restart server instances.
• schedule: Allows the script to register time-based actions on a schedule.
• server_query: Allows the script to list and inspect registered servers (server.list, server.info).
• player_manage: Allows the script to query players, manage ban lists, and use on_join / on_leave.

Example Declaration

A provider that downloads a server .jar from the internet will need network. If it modifies configs, it needs fs_server.

meta = {
  id = "my-custom-provider",
  -- ...
  permissions = {
    { kind = "network", reason = "Download the server jar and manifest files." },
    { kind = "fs_server", reason = "Create default configuration files." },
  },
}

Navigation

• Back to the Scripting Hub