Cryptographically verified mod enforcement for Spigot/Paper servers.
Works alongside the LiteGuard client mod to ensure monitored players cannot join with banned mods installed — backed by RSA signing so responses cannot be faked.
- When a monitored player joins, the plugin sends a verification request via plugin messaging channels.
- The client mod responds with the player's full mod list, cryptographically signed with a private RSA-2048 key.
- The plugin verifies the signature. If invalid or missing, the player is kicked immediately and an alert is logged.
- If the signature is valid, the mod list is scanned for banned mods. If found, the player is kicked.
- All incidents are logged to disk and online admins are notified in real time.
Only players explicitly added to the monitoring list are checked. All other players join completely unaffected.
- Drop
LiteGuardPlugin.jarinto your server'splugins/folder. - Restart the server.
- A
plugins/LiteGuard/folder will be created automatically for alert logs.
Compatible with: Spigot / Paper 1.21.x (offline mode supported)
All commands require OP or the liteguard.manage permission.
| Command | Description |
|---|---|
/liteguard add <player> |
Add a player to monitoring — works offline |
/liteguard remove <player> |
Remove a player from monitoring |
/liteguard list |
List all currently monitored players |
/liteguard alerts |
View all recorded spoof attempts and detections |
/liteguard clearalerts |
Clear the alert log |
- All spoof attempts, missing client mod detections, and banned mod detections are logged with a timestamp and player UUID.
- Online admins with
liteguard.manageare notified in real time when an alert triggers. - Alerts are saved to
plugins/LiteGuard/alerts.logand persist across restarts.
The following mods are currently flagged:
litematicalitematica-forge
| Cryptographic signing | Every response is signed with RSA-2048/SHA-256. A valid signature can only be produced by the official LiteGuard client mod — not a fake or custom client. |
| Public key only | The plugin holds only the public key. Safe to expose even in an open source context. The private key lives exclusively in the client mod. |
| Spoof detection | Modified client mods, fake responses, or missing mod installations are all detected and logged as alerts. |
| Offline mode | Players are stored by username rather than UUID, making the plugin fully compatible with cracked servers. |
- Java 21+
- Spigot or Paper 1.21.x
- LiteGuard client mod installed on monitored players' machines
LiteGuard