LILO 2.4.1

LILO publishes live Minecraft player positions and session events from a Paper
server to an HTTP endpoint chosen by the server operator. LILO produces and
delivers the data only; the receiving service stores it, displays it, and
controls who can read it.

Requirements

• Paper 26.2
• Java 25
• An HTTP or HTTPS receiving endpoint that you operate
• A shared secret of at least 32 characters

No client mod is required, no other plugin is required, and nothing is
downloaded at runtime. Gson 2.14.0 is bundled and relocated inside the JAR.

Changes in 2.4.1

• Migrates an existing config.yml on startup by checking a set of exactly 20
  non-secret defaults and adding only the entries that are missing from the
  file. Explicit operator values, unknown keys, and authentication settings are
  preserved, and api.secret-key is never written by the migration. If nothing
  is missing, the file is left alone.
• Packages the project license, notice, third-party notices, and the Gson
  Apache License 2.0 text in the distributable JAR.

Network and data

LILO makes outbound HTTP or HTTPS requests to the api.url you configure, and
to no other destination. It does not contact a fixed developer, vendor, or
telemetry endpoint, and it does not connect directly to a database.

Requests go to {api.url}/players/push, {api.url}/players/{uuid}/offline,
and {api.url}/players/current.

Requests can contain player UUIDs, usernames, worlds, coordinates, timestamps,
sequence numbers, activity events, and disconnect state. The server name is
included in the push and offline payload envelopes. Further player fields are
optional and controlled by the operator: rotation and game mode are enabled by
default, while canonical world key, per-player server name, dimension, health,
and metadata such as food level, experience level, and flying state are
disabled by default.

Player UUIDs, names, and coordinates identify real accounts and real in-game
activity. Restrict access to the receiving service and decide a retention
policy before enabling tracking.

Authentication

The shared secret is sent in the X-Secret-Key request header. By default it
is not duplicated in the JSON body; a body copy exists only as an opt-in for
legacy receivers. Plain HTTP to a non-loopback host is rejected unless
api.allow-insecure-http is enabled deliberately.

Upgrading

Stop the server, replace the JAR in plugins, start the server, then run
/lilo status and /lilo test.

File verification

lilo-plugin-2.4.1.jar

SHA-256: 62bdd09f4324c1c436fbd38bc5028b6b8b7ef2294962d20ae7004bb033d33b4c

Documentation

• README
• 한국어 문서
• Changelog

Licensed under the MIT License, Copyright (c) 2026 Playcity. Bundled
third-party components retain their upstream licenses.