AddyDefender is a defensive Paper/Purpur plugin designed to reduce inventory desync, container abuse, and common dupe exploit patterns by enforcing server-authoritative validation of player behavior.
Instead of attempting to detect specific client mods (which can easily hide themselves), AddyDefender focuses on validating what players actually do, making most exploit clients ineffective.
AddyDefender combats the effects of exploit clients rather than trying to prove which client mod a player is running. Client-side detection methods are unreliable because malicious clients can hide or manipulate identifying information.
This plugin instead focuses on server-side behavioral validation and transaction safety.
AddyDefender is built around modular exploit-mitigation systems.
Applies temporary lock windows after unstable state changes such as:
- teleport
- world change
- respawn
- vehicle mount/dismount
- container close
These lock windows prevent inventory interactions during desync-prone transitions.
Limits suspicious container interaction patterns:
- normal clicks
- shift-clicks
- hotbar swaps
- drop actions
- double-click collect operations
This reduces macro abuse and container spam exploits.
Ensures container interactions match the server’s expected inventory state.
Rejects actions when:
- the server believes no valid container is open
- container states become inconsistent
- rapid container close/reopen behavior occurs
Monitors and rate-limits:
- rapid item drops
- pickup spam
- drop/pickup interaction loops
These patterns are commonly involved in duplication exploits.
Optional protection for nested containers such as shulker boxes.
Helps mitigate:
- nested container abuse
- risky container movement patterns
Disabled by default to avoid interfering with normal gameplay.
Writes structured exploit telemetry to:
plugins/AddyDefender/actions.log
Logged information includes:
- timestamp
- player name and UUID
- world and coordinates
- event type
- relevant interaction data
This allows administrators to review suspicious behavior without immediately punishing players.
AddyDefender targets modern Paper-based servers.
Minimum requirements:
- Paper or Purpur
- Minecraft 1.21.4
- Java 21 or newer
Spigot is not officially supported.
Build using Maven:
mvn clean package
The compiled plugin jar will be generated in:
target/AddyDefender-x.x.x.jar
(The exact version number will match the plugin version defined in the project.)
Note: the target/ directory contains build artifacts and is ignored by Git.
- Download the latest release.
- Place the jar in your server’s
plugins/directory. - Restart the server.
Configuration will generate automatically at:
plugins/AddyDefender/config.yml
Key configuration sections:
-
inventory-desync-guard.*Lock durations after teleport, world change, respawn, vehicle use, or container close. -
container-rate-limiter.*Per-second limits for clicks, shift-clicks, swaps, drops, and collect operations. -
transaction-consistency-guard.*Container state validation settings. -
item-drop-pickup-guard.*Drop/pickup spam detection thresholds. -
shulker-nested-guard.*Optional stricter nested container protection. -
debug-logsEnables detailed logging. -
staff-alerts.*Sends alerts to online staff when suspicious activity is detected.
| Command | Description |
|---|---|
/defender reload |
Reload configuration |
/defender status [player] |
Show module status |
/defender debug [player] |
Show debug state |
| Permission | Description |
|---|---|
defender.admin |
Access admin commands |
defender.notify |
Receive staff alerts |
AddyDefender intentionally does not attempt to detect specific cheat clients.
Client software ultimately controls what it reports to the server, which makes client identification unreliable.
Instead, AddyDefender focuses on:
- validating server-side inventory state
- enforcing safe interaction timing
- rejecting inconsistent container transactions
- logging suspicious behavior for review
This approach significantly reduces the effectiveness of exploit clients while maintaining low false positives.
AddyDefender does not:
- attempt to identify specific client mods
- automatically ban players
- guarantee prevention of every possible exploit
Instead, it reduces common exploit surfaces while preserving normal gameplay.
Contributions are welcome.
If you discover an exploit or vulnerability, please open an issue or submit a pull request.