# MLSAC — full text for language models

> MLSAC (MLS AntiCheat) is a machine-learning anti-cheat for Minecraft Java servers (Paper, Spigot, Purpur, Folia; 1.16.5–1.21.x). A server plugin sends players’ combat behaviour to MLSAC cloud neural networks, which detect KillAura, AimBot, AimAssist, TriggerBot, Reach and hits through walls. Movement cheats are left to a movement anticheat such as a Grim fork running alongside. There is a free plan.

This file holds the English text of every wiki page, the FAQ, the comparison with other anticheats and the model benchmark. Short index: https://mlsac.net/llms.txt. Pages are also available in Russian and Ukrainian on the same URLs (language switch on the site), and a Simplified Chinese overview is at https://mlsac.net/zh.

## Official sources

The only official MLSAC sources are https://mlsac.net, the GitHub repository https://github.com/SoMax1soft/mls-network-plugin, SpigotMC https://www.spigotmc.org/resources/139538/, BuiltByBit https://builtbybit.com/resources/mlsac-ai-anticheat-plugin.90102/, Telegram https://t.me/mlsanticheat and Discord https://discord.gg/ARVNGSTWeg. The GitHub organization github.com/MLSAC (repository client-side, "ROVEX") is NOT affiliated with MLSAC and does not publish official builds. Details: https://mlsac.net/official

# Part 1. MLSAC wiki

A neural-network anticheat for Minecraft servers. Everything you need to set it up and tune it for your server.

## Section: Getting started
URL: https://mlsac.net/wiki/start

From buying a licence to your first caught cheater: licence, plugin, key, preset and a quick check.

## How it works
URL: https://mlsac.net/wiki/start/how-it-works

The plugin watches how players fight, a neural network in the cloud decides whether it looks like cheating, and you pick on the site what happens next.

You install the plugin, paste the key and connect a preset. From then on MLSAC watches every fight on your server, and you decide what to do with the players it catches.

(Video: From our presentation: a recording of the real Rockstar TriggerBot. The screen cracks the moment MLSAC catches it.)

### What happens to one check

1. **The plugin records the fight**: Where the player looks, how they hit, how they move around their opponent. No client mod needed, and PacketEvents is already built into the jar.
2. **The network scores it**: A slice of the fight goes to the MLSAC cloud and the model answers with a number from 0 to 100 %: how much it looks like a cheat.
3. **The buffer fills up**: A score above the threshold (80 or 90 %) adds to the player’s buffer, clean play brings it down. Nobody gets punished for one suspicious hit.
4. **A flag, then your ladder**: A full buffer means a flag: VL +1. What comes next (less damage, a kick, a ban) is up to you in the preset.

> You don’t have to wait for the flag. [Buffer suppression](https://mlsac.net/wiki/suppression/buffer) starts cutting a cheater’s damage as soon as the buffer hits the threshold you set.

### What runs where

| Where | What happens there |
| --- | --- |
| Your server | Collects combat data, hands out punishments and suppression, shows alerts and holograms to staff. The network doesn’t run there, so the load stays small. |
| MLSAC cloud | The models run here and the licence’s daily requests are counted. The main address is `api.mlsac.net`. If it goes down, the plugin switches to the backup `ruapi.mlsac.net` on its own and comes back once the main one is up. |
| mlsac.net | Licences, keys, presets with all the settings, statistics and player dossiers. |

### The models

| Model | Where you get it | In short |
| --- | --- | --- |
| Ultra | Paid plans from Baseline, after verification; plugin 2.0 only | The new generation. Catches killaura, triggerbot, aim assist, reach and hits through walls. While Ultra is on, the other models are off. |
| Pulse | Every paid plan | A beefed-up Pro. Comes with Accord and Prism cores. |
| Pro | Every plan, Beginner included | The main model. |
| Mini | Beginner, optional in the preset | A steady model, good for getting started. |

Plugin 2.0 runs either Ultra or the other models, never both. You switch it in the preset, under “Models”.

(Video: Nine cheat clients from the presentation, and Ultra catches every one of them.)

### What goes to the cloud

Only what the models and your stats need: camera and body movement in fights, hits, and the player’s name and UUID. The plugin doesn’t send chat or inventories.

Related: https://mlsac.net/wiki/start/buy, https://mlsac.net/wiki/start/install, https://mlsac.net/wiki/detection/buffer-and-flags

## Get a licence
URL: https://mlsac.net/wiki/start/buy

No licence, no key, and the plugin won’t run without a key. How to get the free Beginner plan or a paid one, how to pay and how to renew later.

The key comes with the licence. One licence covers one server, so two servers need two licences.

### Free: Beginner

Beginner is free for good. It runs the Pro model, and you can switch to Mini in the preset. Requests per day are modest, but enough to set MLSAC up and watch it catch people.

1. **Sign in on mlsac.net**: No account yet? Signing up takes a minute.
2. **Open the plans**: [Plans](https://mlsac.net/pricing) → Beginner → “Activate Free Plan”.
3. **Accept the rules**: No abuse or exploits, no bypass attempts, one account per person.
4. **Done**: The licence shows up under [Servers](https://mlsac.net/dashboard/servers).

### A paid plan

1. **Pick a plan**: [Plans](https://mlsac.net/pricing) → “Buy Now”.
2. **Order type**: “New purchase” for another server, “Renewal” to extend the licence you have, “Upgrade” to move to a bigger plan.
3. **Term and promo code**: Choose how many months, and add a promo code if you have one.
4. **How to pay**: SBP, a Russian card (Visa, Mastercard, MIR), a foreign card, crypto, or CryptoBot right in Telegram.
5. **Pay**: Tell us how you found us, accept the terms and head to checkout.

> The licence turns on by itself, usually 1–5 minutes after payment. Half an hour later and still nothing under “Servers”? [Open a ticket](https://mlsac.net/dashboard/ticket) and we’ll sort it out.

(Video: Demo account, no real payment: Enhanced for 3 months → promo code → “Where did you hear about us” → terms → pay. After payment the new licence shows up under “Servers” by itself.)

### Upgrades and renewals

- Upgrades only go up. You can’t move to a cheaper plan.
- There must be more than 20 days left on your current plan.
- You pay the price difference for every started 30 days you have left. The end date stays the same.
- Renewing or upgrading keeps the same key, so you don’t touch anything on the server.

### Daily requests

Every plan has a daily request limit, shown on the server card (“Requests today”). Once it runs out, checks pause until the next day. So your server isn’t left open in the evening, turn on “Return to free” in the preset: requests will then come from a free Beginner licence, if your account has one.

Related: https://mlsac.net/wiki/start/install, https://mlsac.net/wiki/start/api-key

## Installing the plugin
URL: https://mlsac.net/wiki/start/install

Drop the jar into plugins, restart, check the console. Which jar to grab and which lines you should see.

It goes in like any other plugin: jar into `plugins`, full restart. First make sure your server fits.

### What you need

| What | Works with |
| --- | --- |
| Server | Paper and its forks (Purpur, Pufferfish and the rest), Spigot, Folia. On Folia there are no holograms. |
| Version | Minecraft 1.16.5 to 26.2, tested up to 26.1 and 26.2. Versions newer than 26.2 aren’t confirmed yet. The tested versions are listed under [Compatibility](https://mlsac.net/wiki/reference/compatibility#tested). |
| Java | 17 or newer, even on 1.16.5. There are two builds: one for Java 17 and one for Java 21+. |
| Other plugins | Nothing extra, PacketEvents is already inside. WorldGuard is optional, for regions where you don’t want checks. Bedrock players (Geyser/Floodgate) aren’t checked. |

### Download

> **Which jar** Server on Java 21 or newer: take `…-java21.jar`. That includes Paper 1.20.5+ and 26.x, which run on Java 21 and 25. On Java 17: `…-java17.jar`. Not sure which Java you have? Run `java -version`, or check the first MLSAC line at startup.

### Installing

1. **Stop the server**
2. **Drop the jar into plugins/**: If MLSAC 1.x was there, delete the old jar.
3. **Start the server**: The plugin creates `plugins/MLSAC/config.yml`; everything else lives on the site. Other folders only show up when needed: `data/restore/` when staff save fights with `/mlsac data`, and `old/` if files from 1.x were found.
4. **Check the console**: The MLSAC lines should look like the clip below.

(Video: Paper 1.21.4 starting with MLSAC 2.0, real lines from our test server. The three highlighted ones are what you look for: plugin on, connected, preset applied.)

> Install and update with a full restart only. Plugman and `/reload` aren’t supported. To apply settings, `/mlsac reload` is all you need.

### Reading the console

| Line | What it means |
| --- | --- |
| `MLSAC 2.0 enabled in … ms: Paper 1.21.4 …, Java 21` | The plugin started and recognised your server and version. On 26.x, 2.0.6 and older show `1.21.11` here, which is fine: [details](https://mlsac.net/wiki/reference/compatibility#tested). |
| `Detection: off (API key default placeholder)` | No key yet. That’s expected on the first start; next you [paste the key](https://mlsac.net/wiki/start/api-key). |
| `Detection: on (alert threshold 0.80) \| preset: main \| backend: …` | The key is in, checks are running, and config.yml points at the preset main. |
| `Nametags: on` | Tags over suspects are on. On Folia it says `off on Folia`, since there are no holograms there. |
| `Integrations: WorldGuard on, Geyser/Floodgate on` | Only shows up when WorldGuard or Geyser/Floodgate is installed: the plugin found them. |
| `[Backend] Connected to https://api.mlsac.net` | Connected to the cloud. |
| `[Preset] Applying preset 'main' (…)` | Your settings from the site are applied. |

Related: https://mlsac.net/wiki/start/api-key, https://mlsac.net/wiki/start/first-preset

## API key
URL: https://mlsac.net/wiki/start/api-key

Where to find your key in the dashboard, where to paste it, and what to do if it leaks.

The key ties your server to your licence. One key per server.

### Finding the key

1. **Open “Servers”**: [Servers](https://mlsac.net/dashboard/servers) in the dashboard.
2. **Click your server**: The licence card opens.
3. **The “Connection” tab**: Look for the “API key” block.
4. **Copy it**: The eye icon reveals it, “Copy” grabs the whole thing.

(Video: “Servers” → “Open” → “Connection” → show the key → “Copy”. “Reset key” is next to it. Demo account, fake key.)

> Don’t share the key or let it show up in screenshots. Anyone who has it can burn through your requests.

### Where it goes

Open `plugins/MLSAC/config.yml` on the server (your host’s file manager or SFTP) and put the key into `detection.api-key` in place of `your-api-key`. Keep the quotes.

``` plugins/MLSAC/config.yml
language: "ru"

detection:
  # Get a key (or a free trial) at https://mlsac.net
  api-key: "PASTE-YOUR-KEY-HERE"

remote-config:
  # "" = the only preset on your account, "<name>" = that preset, "none" = built-in defaults
  preset: ""
```

Save the file and run `mlsac reload` in the console (`/mlsac reload` in game). No restart needed: a couple of seconds later the console shows `Connected` and `Applying preset`.

(Video: A (fake) key and the preset name go in, then `mlsac reload`. Two seconds later it’s connected and the preset is applied.)

### The rest of config.yml

| Key | What for |
| --- | --- |
| `language` | The plugin’s message language: ru, en, uk, es, vi, zh, ar. |
| `remote-config.preset` | Which preset to load from the site; see [Your first preset](https://mlsac.net/wiki/start/first-preset). |
| `server-identity.name` | What the server is called in alerts. |
| `server-identity.family` | For networks. Servers in the same family share alerts and actions when `interserver.enabled` is on. |
| `server-identity.reporting` | Whether alerts and punishments go to the dashboard, Discord and Telegram. `alert-threshold` sets the confidence they start at (0.80 by default). |
| `debug` | A verbose log for when support asks. Normally `false`. `/mlsac debug on` turns it on without a restart, see [Commands](https://mlsac.net/wiki/reference/commands#debug). |
| `_schema-version` | Internal, leave it alone. |

> Some keys missing after an update? Run `/mlsac reinstall` twice within 3 seconds. The plugin adds what’s missing and keeps your values.

### If the key leaks

Hit “Reset Key” on the same tab. The server with the old key drops off right away, so put the new key into config.yml and run `mlsac reload`. You can reset again after 6 hours. Only the licence owner can do this.

Related: https://mlsac.net/wiki/start/first-preset, https://mlsac.net/wiki/start/check

## Your first preset
URL: https://mlsac.net/wiki/start/first-preset

All the anticheat settings live in a preset on the site. How to make one, hook it up to your server, and what to do if it doesn’t load.

Models, threshold, buffer, punishments, suppression, holograms, messages: you set all of it in a preset on the site. config.yml only keeps the preset’s name.

### Making a preset

1. **Open “Configs”**: [Configs](https://mlsac.net/dashboard/configs) in the dashboard.
2. **“New preset”**: Give it a name like `main`: Latin letters, digits, `-` and `_`, up to 32 characters.
3. **Go through the sections**: “General”, “Models”, “Detection”, “Suppression”, “Messages”. The defaults already work, so you can start with them and tweak later.
4. **“Save”**

(Video: “Configs” → “New preset” → name it `main` (it goes straight into the config.yml snippet) → a couple of settings → “Save” → “Copy”.)

### Hooking it up

The server learns which preset to use from `remote-config.preset` in `plugins/MLSAC/config.yml`:

| Value | What happens |
| --- | --- |
| `""` (empty, the default) | If your account has exactly one preset, the server picks it up. With several or none you get a warning. |
| `"main"` | Loads the preset with that name. It has to match the site letter for letter. |
| `"none"` | No preset is loaded and the plugin runs on built-in settings. Admins keep getting a reminder. |

``` plugins/MLSAC/config.yml
remote-config:
  preset: "main"
```

The server checks the site once a minute, so after “Save” your changes arrive on their own. Don’t want to wait? `/mlsac reload` and the preset comes in about two seconds later. Players’ buffers and VL aren’t reset.

> Only your account sees your presets: the server fetches them with its key and can only read the key owner’s presets. One preset can serve several of your servers at once.

### If the preset didn’t load

Until a preset loads, operators and players with `mlsac.admin` see a warning like this in chat (and the console), with the reason:

| Reason | Fix |
| --- | --- |
| No presets on the account | Make one under “Configs”. |
| Several presets on the account | Put the one you want into `remote-config.preset`. |
| Preset not found on the account | Check the name. It’s almost always a typo. |
| config.yml says `preset: none` | Put in a preset name or leave it empty. |

Related: https://mlsac.net/wiki/start/check, https://mlsac.net/wiki/detection/buffer-and-flags

## Check that it works
URL: https://mlsac.net/wiki/start/check

A one-minute sanity check: `/mlsac status`, the status in the dashboard, a live test, and the usual problems.

### /mlsac status

Type `/mlsac status` in game (needs `mlsac.command.status`, which operators have) or `mlsac status` in the console.

| Line | Healthy | If not |
| --- | --- | --- |
| Backend link | online | “offline”: check the key and that the server can reach the internet. “over the request limit”: you’re out of requests for today. |
| Preset | main (active) | “not active”: the name doesn’t match the site. “auto”: the account doesn’t have exactly one preset. |
| Detections and requests today | numbers | “-”: the counters didn’t load, try again in a bit. |
| Round trip | green under 50 ms, yellow under 150 ms | Red: the route to the backend is slow. Detection still works, the answers just come later. |

### Status in the dashboard

“Servers” → card → “Connection”. “The plugin is connected — all set” means the server is using this key. “The plugin has never connected yet” means the key isn’t in, or there was no `mlsac reload` after you added it.

(Video: The server was offline. The plugin connected and the card came alive: a green dot and players online.)

### Testing it in a fight

`/mlsac alerts` turns on chat alerts. `/mlsac monitor player <name>` puts the model’s confidence, the buffer and VL above your hotbar and updates them twice a second. Staff see the holograms over suspects anyway.

(Video: Alerts in a moderator’s chat mid-fight, recorded on our test server: “Failed check (Aim-AI: …)” for each confident check, then “Got VL 1”.)

> Testing suppression on yourself? Not as op. Operators get `mlsac.admin` by default, which includes `mlsac.suppression.bypass`, so damage changes and lag won’t touch them. Use a normal account.

### Common problems

| What you see | What to do |
| --- | --- |
| `Detection: off (API key default placeholder)` | No key yet: [API key](https://mlsac.net/wiki/start/api-key). |
| `The backend refused the API key` | The key is wrong or was reset. Copy it again from the “Connection” tab. |
| `Cannot reach https://api.mlsac.net … Retrying in the background.` | The server couldn’t reach the backend. The plugin keeps retrying and falls back to the backup address. Check that your host allows outgoing HTTPS. |
| Chat says “No config preset is installed!” | See [Your first preset](https://mlsac.net/wiki/start/first-preset). |
| No holograms | You need `mlsac.notify.alerts` (or `mlsac.alerts`, `mlsac.admin`). Folia has no holograms. More in [Holograms](https://mlsac.net/wiki/detection/holograms). |
| `/mlsac` says you lack permission | Grant the node you need, like `mlsac.command.status`, or the old all-in-one `mlsac.admin`. |

Related: https://mlsac.net/wiki/detection/buffer-and-flags, https://mlsac.net/wiki/suppression/buffer, https://mlsac.net/wiki/detection/holograms

## Section: Detection
URL: https://mlsac.net/wiki/detection

Models, the buffer and flags, and what your staff see: alerts, the monitor, tags, menus.

## Models
URL: https://mlsac.net/wiki/detection/models

Ultra, Pulse, Pro and Mini: how they differ, where you switch them on, and why Ultra never runs alongside the others.

A model is the neural network that looks at a slice of a fight and says how much it looks like cheating. Your plan decides which models you get; you switch them on in the preset, under “Models”.

### Who’s who

|  | Where you get it | In short |
| --- | --- | --- |
| Ultra | Paid plans from Baseline, after verification; plugin 2.0 only | The new generation. Catches killaura, triggerbot, aim assist, reach and hits through walls, and works faster than Pulse. It’s in early access, so it can still make mistakes. |
| Pulse | Every paid plan | A stronger Pro. It has two cores and three strictness modes. |
| Pro | Every plan, Beginner included | The main model for most servers. |
| Mini | Beginner, optional in the preset | A steady model to start with. |

### Ultra or the rest

Plugin 2.0 runs either Ultra or the other models. Turn Ultra on and the Pulse, Pro and Mini cards grey out with “Off: Ultra is on”. Turn it off and they come back. Ultra only works with plugin 2.0; the old 1.x doesn’t know it.

### Pulse cores

| Core | Who it’s for |
| --- | --- |
| Pulse Accord | The default. Catches cheaters confidently without tripping over players with sharp aim. Start here. |
| Pulse Prism | For servers where a wrong ban hurts more than a missed cheater. Catches as much, but touches honest players far less on strict modes. |

Strictness doesn’t change the model, only the bar it has to clear: “reduced” gives fewer questionable hits, “standard” suits most servers, “aggressive” catches more at the cost of extra false hits. Switching cores reaches the server within a minute.

> Each model’s last 30 days of stats are shown right on its card in the “Models” tab.

Related: https://mlsac.net/wiki/detection/buffer-and-flags, https://mlsac.net/wiki/detection/alerts

## Buffer and flags
URL: https://mlsac.net/wiki/detection/buffer-and-flags

Why one detection never gets anyone banned: how the buffer grows and drops, when a flag lands, and what “faster repeat flag” is for.

Every check pushes the player’s buffer up or down. When it fills up, that’s a flag. Click the checks below or run the example; the maths is exactly what the plugin does with its default settings.

### Threshold: 80 or 90 %

A check above the threshold fills the buffer; anything below doesn’t. 90 % only lets confident detections through, and that’s what we recommend. 80 % punishes faster but can catch more false positives. Picking a threshold also sets the growth multiplier for you: 110 at 90 %, 45 at 80 %.

### How the buffer moves

- **Up.** A check above the threshold adds `(confidence − threshold) × multiplier`. Threshold 90 %, multiplier 110, a 99 % check: +9.9 goes into the buffer.
- **Down.** A check below the decay threshold (50 % by default) takes off up to 1.5 at a time. The surer the model is that the player is clean, the more it takes off.
- Between the decay threshold and the detection threshold, the buffer doesn’t move.

### The flag

When the buffer reaches capacity (40 by default, you can’t go below 30), the player gets a flag: VL +1 and that flag’s step of your ladder kicks in. After the flag, the “faster repeat flag” amount stays in the buffer, 20 of 40 by default, so the second flag lands twice as fast as the first.

| Checks in a row | Adds | To 1st flag | To the next |
| --- | --- | --- | --- |
| 99 % | +9.9 | 5 | 3 |
| 95 % | +5.5 | 8 | 4 |
| 92 % | +2.2 | 19 | 10 |
| 90 % | nothing | — | — |

The table assumes a 90 % threshold, multiplier 110, capacity 40 and 20 kept after a flag.

To watch the buffer live, run `/mlsac monitor player <name>`. Above your hotbar you’ll see the last check’s confidence, the buffer and VL.

(Video: The monitor on our test server: every confident check adds to the buffer, which climbs 20 → 28.8 → 37.8 at VL 7, just short of the flag at 40.)

### Where to change it

[Configs](https://mlsac.net/dashboard/configs) → preset → “Detection”: “Detection threshold”, “Buffer capacity”, “Faster repeat flag” and “Buffer growth and decay”. The last one has a “to 1st flag / to next” table for your own numbers.

(Video: Switching 80 ↔ 90 %, capacity 40 → 50, then a new multiplier in “Buffer growth and decay” and the table updates.)

### Relogging won’t help

Leave and come back within 15 minutes, and the buffer, check history and VL are all still there. VL sticks around until the server restarts.

Related: https://mlsac.net/wiki/suppression/buffer, https://mlsac.net/wiki/detection/holograms

## Alerts
URL: https://mlsac.net/wiki/detection/alerts

What your moderators see in chat when MLSAC suspects someone: alert lines, the sound, the console copy, and alerts from other servers in your network.

Alerts go to staff: players with `mlsac.notify.alerts`, `mlsac.alerts` or `mlsac.admin` (ops by default). You’re subscribed automatically a second after joining. Mute them for a while with `/mlsac alerts`; after a relog they come back.

(Video: Our test server: “Failed check” for each confident check and “Got VL 1” when the buffer filled up.)

### The two kinds of lines

| Line | When it shows up |
| --- | --- |
| “Failed check” with the model and percentage | When the player’s buffer passes a third, two thirds and nearly all of its capacity, so you see it building up before the flag. |
| “Got VL” with the buffer | On every flag. The VL number goes up each time. |

You can change the texts and colours in the preset, under “Messages”, along with the language of the default texts.

### Sound and console

- “Notification sound” plays for every subscribed moderator. Pick it under “Detection”; each sound shows the Minecraft version it appeared in. If your version doesn’t have it, the plugin falls back to the note block “ping”.
- “Also send to console” writes the same lines to the server console, handy if you keep punishment logs.

### If you run a network

Give your servers the same `server-identity.family` and turn on `interserver.enabled` in config.yml. Staff on every server then see alerts from all of them, tagged with the source server’s `server-identity.name`. These alerts always go to the console too.

> Want alerts in Discord or Telegram? Set up webhooks on the server card’s “Notifications” tab. `server-identity.reporting.events-enabled` turns sending on, and `alert-threshold` decides from which confidence they go out.

Related: https://mlsac.net/wiki/detection/monitor, https://mlsac.net/wiki/detection/holograms

## Monitor and player profile
URL: https://mlsac.net/wiki/detection/monitor

How to watch one player live: every check in chat, the buffer and VL above your hotbar, and the player profile menu.

Suspicious of one particular player? Stand nearby and turn the monitor on. Faster than waiting for alerts.

### The line above your hotbar

`/mlsac monitor player <name>` puts the last check’s confidence, the buffer and VL above your hotbar and refreshes them twice a second. The arrow shows which way the buffer last moved. Run `/mlsac monitor player` again to stop.

(Video: The monitor on our test server: checks at 99–100 %, the buffer climbing 20 → 28.8 → 37.8.)

### Every check in chat

`/mlsac monitor` posts every check of every player in chat with a coloured percentage, from green for clean players to red from 90 %. On a busy server it floods chat fast, so keep it short. Run it again to switch off. The old `/mlsac monitor chat` and `/mlsac monitor prob <name>` are still understood for now.

### Player profile

`/mlsac profile <name>` opens the player profile menu: first and last seen, how many detections they’ve had, the latest detections as coloured glass, suppressions and punishments. The data comes from the player’s record on the site, so offline names work too. The site is only asked when the profile opens.

Set it up in the preset, “Staff tools” tab: whether the profile opens as a menu, how many panes of latest detections to show, and whether to show suppressions and punishments. With the profile menu off, or from the console, the same data comes as chat lines. The window layout can be changed in the [menu designer](https://mlsac.net/wiki/detection/menus#designer). The old `/mlsac prob` is gone.

| Command | Permission |
| --- | --- |
| `/mlsac monitor …` | `mlsac.command.monitor` |
| `/mlsac profile <ник>` | `mlsac.command.profile` |

Related: https://mlsac.net/wiki/detection/buffer-and-flags, https://mlsac.net/wiki/reference/commands

## Holograms over suspects
URL: https://mlsac.net/wiki/detection/holograms

The tag over a player with the average confidence and the latest checks. Who sees it, how to read it and how to style it.

A tag floats over the player: the models’ average confidence and the latest checks. Only staff can see it. Try editing the lines below; the preview behaves like the one in the editor.

(Video: Our test server: over the player with an aura, `AVG` climbs from 58 to 99 % in a couple of seconds and changes colour, next to the latest Ultra checks (`U99%`). The clean player shows “no average / no history yet” because “Show with no checks” is on.)

### Who sees the tags

- Staff with `mlsac.notify.alerts`, `mlsac.alerts` or `mlsac.admin` (ops have it by default). `/mlsac alerts` has nothing to do with tags.
- Tags show within “Visible from”, 30 blocks by default.
- You don’t see your own tag unless you turn on “See your own tag”.
- Players in spectator have no tag. Flying players keep theirs.
- Bots and fake players get no tag, because the anticheat doesn’t check them.
- Holograms don’t work on Folia.

### Reading a tag

| Placeholder | What it shows |
| --- | --- |
| `{AVG}` | The average confidence over the latest checks. The colour follows “AVG colour”: white by default, red from 60 %, bold dark red from 90 %. |
| `{HIST}` | The checks themselves, each with its model’s letter: `U` Ultra, `Pu` Pulse, `P` Pro, `F` Mini. “Checks in history” sets how many (5 by default). |
| `{RESULT}` | One check’s confidence, used inside a check format. |
| `&a` `&l` `&#RRGGBB` | Colours and styles, same as in game. |

### Setting it up

1. **Open the tags**: [Configs](https://mlsac.net/dashboard/configs) → preset → “General” → “Tags above suspects”.
2. **Tag lines**: Up to 4. Each line in the field becomes its own line over the player.
3. **The details**: Each model’s check format, “AVG colour”, “Checks in history”, “Visible from”, “Height”, “Show with no checks”.
4. **Save the preset**

(Video: Adding a tag line, an “AVG colour” tier and a 3D background; the preview follows live.)

### 3D look on 1.19.4+

If both the server and the moderator’s client are on 1.19.4 or newer, the tag is drawn as 3D text. You can change the background and its colour, opacity, shadow, “Visible through walls”, size from 0.5 to 2×, and rotation (facing the camera or upright). On older versions it looks like a plain name over the head, and its background, shadow and size can’t change.

### The suspects menu

`/mlsac menu` opens a list of players who have checks. Hover a head to see the average probability and the last 10 checks. Left click teleports you to the player, right click opens all their checks, where the glass colour shows the confidence. You need `mlsac.command.suspects` (or `mlsac.alerts`, `mlsac.admin`) and the “Menus” module on.

(Video: `/mlsac menu` on our test server: the tooltip with the latest checks, then the menu with all of the player’s checks.)

Related: https://mlsac.net/wiki/detection/buffer-and-flags, https://mlsac.net/wiki/start/check

## Staff menus
URL: https://mlsac.net/wiki/detection/menus

`/mlsac menu`: the list of suspects, their checks as coloured glass, the Kicks page, and the designer where you can rebuild the menus your way.

`/mlsac menu` (the old name `/mlsac suspects` still works) opens the list of players who have checks. Hover a head to see the average probability and the last 10 checks. Left click teleports you to them, right click opens all their checks.

(Video: Our test server: the tooltip with the latest checks, then the player’s checks menu.)

### Glass colours

| Glass | Confidence |
| --- | --- |
| Red | 90 %+ |
| Orange | 80 %+ |
| Yellow | 60 %+ |
| Lime | 40 %+ |
| Green | below 40 % |

### The Kicks page

The Kicks button in the menu opens the latest punishments: who was kicked and when (and banned, if that’s on), one head per punishment. Click a player to open their history: earlier kicks and suppressions. The page replaces the removed `/mlsac kicklist`. The list comes from the site only when the page opens.

- Settings live in the preset, “Staff tools” tab: turn the page on, how many days back (7 by default), and whether to include bans and the suppressions in a player’s history.
- “Use data from all my servers”: on a network (BungeeCord/Velocity), the Kicks page and the player profile show data from all your servers, not just this one.
- Needs plugin 2.0.4 or newer.

### The menu designer

In the preset: “General” → “Staff menus” → “Menu designer”. Drag buttons between slots, click an empty slot to add one, and set the window title, number of rows and the list area. A command button runs its command as the console. If an item doesn’t exist in your version, the editor warns you and the plugin shows paper instead. The designer has four windows: suspects, a player’s checks, Kicks and Profile. Until you change the Kicks or Profile layout, the plugin uses its own.

(Video: Demo account: opening the designer, hovering a button, switching to the checks menu and taking the compact layout.)

| Placeholder | Becomes |
| --- | --- |
| `{PLAYER}` | the name |
| `{AVG_PROB}` | the average chance |
| `{HISTORY_SIZE}` `{HISTORY}` | how many checks, and the latest chances |
| `{INDEX}` `{PERCENT}` | a check’s number and chance (checks menu) |

> `/mlsac menu` needs `mlsac.command.suspects` (or `mlsac.alerts`, `mlsac.admin`) and the “Menus” module on under “General”. With the module off, the command just says so.

Related: https://mlsac.net/wiki/detection/monitor, https://mlsac.net/wiki/detection/holograms, https://mlsac.net/wiki/configs/editor

## Regions and worlds without checks
URL: https://mlsac.net/wiki/detection/regions

How to switch the anticheat off at spawn, an event arena or a whole world: a region, a world, or a region in a world.

Some places are better without checks: a parkour spawn, an event with odd PvP, a world for staff tests. In the preset, under “Regions/Worlds”, you mark those places and the anticheat leaves players alone there.

| Pick | Result |
| --- | --- |
| Region | Checks are off in the region with that ID, in any world. Needs WorldGuard. |
| World | Checks are off in the whole world, e.g. `world_nether`. Works without WorldGuard. |
| Region in a world | Only that region, only in that world. Useful when different worlds have regions with the same name. |

1. **Find the region ID**: Stand in the region and run `/rg info`; the ID is on the first line. Or use `/rg list`.
2. **Add it to the preset**: “Regions/Worlds” → “Add region” → pick the kind, enter the ID and world. The editor shows a sentence describing exactly what will happen.
3. **Save the preset**: The server picks it up within a minute.

(Video: Demo account: adding the region `spawn` and the whole world `world_nether`.)

- Player standing in several regions at once? The one with the highest WorldGuard priority decides.
- Suppression effects don’t apply there either: no damage changes, no lag, no tricks.
- The “Turn checks off in regions and worlds” switch enables the whole list at once. Turn it off and checks run everywhere again.

Related: https://mlsac.net/wiki/configs/editor, https://mlsac.net/wiki/suppression/buffer

## Section: Suppression and punishment
URL: https://mlsac.net/wiki/suppression

What to do with a cheater: cut their damage, lag them, mess with them, kick or ban.

## Buffer suppression
URL: https://mlsac.net/wiki/suppression/buffer

How to squeeze a cheater before the flag even lands: buffer thresholds, damage, lag, tricks, cooldowns, and how it differs from the flag ladder.

A flag means the violation already happened. Buffer suppression kicks in earlier: once the buffer reaches a threshold, the cheater starts losing fights, before any kick or ban.

### Flags vs buffer thresholds

|  | By flags | By buffer |
| --- | --- | --- |
| When | The buffer is full: flag 1, flag 2 and so on. | The buffer hits a threshold: 25 %, 50 % and so on. |
| What you can do | Ban, kick, your own command, combat suppression and tricks, all at once or in stages. | Combat suppression and tricks. No commands here. |
| Where | “Suppression” → “By flags” | “Suppression” → “By buffer” |

> Start soft. Just cut damage on the first thresholds, push harder on flag 1, and keep the ban for players who don’t stop.

(Video: The flag ladder on our test server: “Got VL 13”, then “Suppression (Flag 13, stage 1/1): cmd ban”, and the player is banned with an animation.)

### Turning it on

1. **Open the tab**: [Configs](https://mlsac.net/dashboard/configs) → preset → “Suppression” → “By buffer”.
2. **Flip the switch**: “Buffer suppression”. While it’s off, no threshold fires.
3. **Look at the thresholds**: There are three by default: 25 %, 50 % and 75 %. At each one the player hits weaker and takes more damage. Keep them or build your own, up to 10.
4. **Save the preset**: The server picks it up within a minute, or right after `/mlsac reload`.

(Video: Turning buffer suppression on, giving the 50 % threshold (−35 % damage) a 30 s cooldown and adding lag, saving.)

### How a threshold fires

- A threshold is a percentage of the buffer capacity from “Detection”. Capacity 40 and a 50 % threshold means it fires at a buffer of 20.
- A threshold fires once when the buffer reaches it, and again only after the buffer drops below and climbs back up.
- “Cooldown” stops a threshold from firing too often. If the buffer crosses it during the cooldown, that crossing is simply skipped.
- Thresholds are checked before the flag, so a 100 % threshold fires together with it.
- If one check jumps past several thresholds, their actions all start together, and each trick runs only once.

### What you can do to a cheater

| Action | What happens |
| --- | --- |
| Less damage dealt | His hits and projectiles do 5–100 % less, counted from the final damage after armour. Explosions are cut too on 1.20.4+. |
| More damage taken | He takes up to +300 % damage. Falls, the void and the like aren’t boosted, so lag won’t make him die from a fall. |
| Lag | Delayed hits, misses, setbacks, grounding, forced turns. Light, medium or heavy; see the table below. |
| Shuffle inventory | Shuffles the 36 hotbar and inventory slots. Armour stays on. |
| Drop weapon | The sword falls out of his hand. |
| Launch | Throws the player into the air. |

#### Lag levels

| Kind | Light | Medium | Heavy |
| --- | --- | --- | --- |
| Hit delay | 100 ms | 250 ms | 500 ms |
| Misses | 50 %, no more than 3 in a row | 75 %, no more than 8 in a row | every hit misses |
| Setbacks | every 3–5 s, 3 ticks back | every 1.5–3 s, 5 ticks back | every 0.5–1 s, 10 ticks back |
| Forced turns | every 3–5 s by 10–20° | every 1.5–3 s by 20–45° | every 0.5–1.5 s by 45–90° |
| Grounding | lower jumps | jumps barely lift | pinned to the ground |

On light and medium, setbacks and turns only happen in a fight. On heavy they never stop, so running away doesn’t work.

(Video: Heavy lag on our test server. Here it sits on the flag 18 step (setback, ground, rotate for 20 s); on a buffer threshold it works exactly the same.)

### Things you’ll run into

- Effects of the same kind don’t stack. The strongest one wins and a repeat just resets its timer.
- Effects survive death, switching worlds and relogging within 15 minutes.
- Effects don’t apply in regions and worlds without checks, or in creative and spectator.
- Players with `mlsac.suppression.bypass` aren’t affected. It comes with `mlsac.bypass` and `mlsac.admin`, so ops have it. Ladder commands still run on them.
- Suppression doesn’t blind the detection. The model keeps getting combat data.

(Video: In-game clip coming later: after the 50 % threshold the cheater’s hits take noticeably less health.)

Related: https://mlsac.net/wiki/detection/buffer-and-flags, https://mlsac.net/wiki/start/first-preset

## The flag ladder
URL: https://mlsac.net/wiki/suppression/flag-ladder

What happens on flag 1, 2, 3 and beyond: steps, stages inside a flag, commands, templates, and the guard against double bans.

Every flag is a step. On each step you put together what happens to the player: cut their damage, lag them, kick, ban or run your own command. Set it up in the preset: “Suppression” → “By flags” → “Configure”.

### Flags vs stages

Don’t mix them up. Flag 2 means the player filled the buffer a second time, so they cheated again. Stages are what happens after a single flag, all at once or one after another. Say, on flag 1: −50 % damage for 30 seconds right away, then a kick as the next stage. The next stage starts when the longest effect of the previous one ends.

> Don’t build a huge chain on flag 1. Start soft and push harder on later flags if the player keeps going. “Repeat the last flag” is on by default: once flags outnumber steps, the last step repeats.

### Templates

| Template | What’s inside |
| --- | --- |
| Soft | Combat suppression on two flags, a ban on the third. |
| Strict | Kick on the first flag, ban on the second. |
| No bans | Suppression only, stronger with each flag. |

You can save your own ladder as a template and use it in all your presets. After “Apply”, remember to save the preset itself.

### Commands

- Ban, kick or your own punishment command (tempban, mute and the like) runs as the console. Any step with a command can have an animation; bans have one by default. Dangerous commands are refused by the plugin: see [Command protection](https://mlsac.net/wiki/suppression/animations#guard).
- Placeholders: `{PLAYER}` is the name, `{VL}` the flag number, `{PROBABILITY}` the confidence written like `0.97`, `{BUFFER}` the buffer.
- Commands in later stages still run on time even if the player logs out, so leaving doesn’t dodge a delayed ban.
- If two punishments hit the same player within 5 seconds, the second one’s commands are skipped. Its effects still apply.

> Turn on “Name check before commands” under “General”. Without it, a name with a space or a Geyser prefix can break the command and hit someone else: `ban Steve Notch reason` bans Steve. With the check on, the plugin simply kicks that player directly.

(Video: Flag 13 on our test server: “Suppression (Flag 13, stage 1/1): cmd ban” and a ban with an animation.)

Related: https://mlsac.net/wiki/suppression/animations, https://mlsac.net/wiki/suppression/buffer

## Damage
URL: https://mlsac.net/wiki/suppression/damage

Cut a cheater’s damage and boost the damage they take: the ranges, what counts and what doesn’t, and how effects combine.

The quietest kind of suppression. The cheater swings as usual but keeps losing fights. Often that’s enough for them to leave on their own.

| Action | Range | What counts |
| --- | --- | --- |
| Less damage dealt | 5–100 % | Final damage after armour from their hits and projectiles, on players and mobs. Explosions (crystals, TNT) are cut on 1.20.4+. Thorns aren’t touched. |
| More damage taken | 5–300 % | Almost everything except falls, the void, starvation, drowning, suffocation and the like, so lag and launches don’t turn into fall deaths. |

- Two damage effects of the same kind don’t stack: the strongest wins and a repeat refreshes the timer.
- The effect survives death, world changes and relogging within 15 minutes. The timer pauses while the player is offline.
- Works on buffer thresholds and on flag-ladder steps alike.

(Video: In-game clip coming later: after the threshold, the cheater’s hits take noticeably less health.)

Related: https://mlsac.net/wiki/suppression/lag, https://mlsac.net/wiki/suppression/buffer

## Lag
URL: https://mlsac.net/wiki/suppression/lag

Five kinds of lag and three levels: what the cheater feels, for how long, and when lag doesn’t kick in.

Lag is the nastiest thing you can do to a cheater short of a ban: hits don’t land, they get pulled back, the camera jerks around. It looks like a bad connection, and they just lose the fight.

### Kinds

| Kind | What happens |
| --- | --- |
| Hit delay | Hits and swings reach the server late. |
| Misses | Some hits don’t count: the swing shows, but no damage or knockback. |
| Setbacks | The player is pulled back a few ticks. |
| Grounding | Pulls them down: lower jumps, no hanging in the air. Never pushes sideways. |
| Forced turn | The player’s camera is turned away. |

### Levels

|  | Light | Medium | Heavy |
| --- | --- | --- | --- |
| Delay | 100 ms | 250 ms | 500 ms |
| Misses | 50 %, up to 3 in a row | 75 %, up to 8 in a row | all |
| Setbacks | every 3–5 s, 3 ticks | every 1.5–3 s, 5 ticks | every 0.5–1 s, 10 ticks |
| Turn | every 3–5 s, 10–20° | every 1.5–3 s, 20–45° | every 0.5–1.5 s, 45–90° |
| Grounding | lower jumps | barely lift | pinned down |

On light and medium, setbacks and turns only happen in a fight, meaning the player hit someone or got hit by a player in the last 5 seconds. On heavy they always happen, so running away doesn’t work.

(Video: Heavy lag on our test server: setback, ground and rotate for 20 seconds.)

### When there’s no lag

- In creative, spectator, and in regions or worlds without checks.
- For players with `mlsac.suppression.bypass`. It’s part of `mlsac.admin`, so you can’t test lag on an op account.

Related: https://mlsac.net/wiki/suppression/damage, https://mlsac.net/wiki/suppression/tricks

## Tricks
URL: https://mlsac.net/wiki/suppression/tricks

Shuffle the inventory, knock the weapon out, launch them: instant tricks that wreck a cheater’s fight right now.

Tricks fire once, at the moment of a threshold or flag, with no timer. They pair nicely with damage effects: the cheater is busy sorting their inventory while taking extra damage.

| Trick | What it does |
| --- | --- |
| Shuffle inventory | Shuffles the 36 hotbar and inventory slots. Armour and the off-hand stay put. |
| Drop weapon | The sword drops from their hand, and it can’t be picked up straight away. |
| Launch | Throws the player into the air. |

- If one check crosses several thresholds at once, each trick still fires only once.
- Staff get a chat line for every trick.
- Tricks don’t apply in creative, spectator, regions without checks, or to players with `mlsac.suppression.bypass`.

(Video: In-game clip coming later: a shuffled inventory, a dropped sword and a launch.)

Related: https://mlsac.net/wiki/suppression/damage, https://mlsac.net/wiki/suppression/flag-ladder

## Punishments and animations
URL: https://mlsac.net/wiki/suppression/animations

An animation on any punishment step, manual `/mlsac punish`, the punishment history, and how the plugin guards your server against dangerous commands.

Any step with a command can have an animation: a ban, a kick or your own command. The player freezes, particles fly around, lightning strikes at the end, and only then does the command run. They can’t do anything during the animation. A ban on the flag ladder has one by default.

(Video: A ban with an animation on our test server.)

### Built-in animations

The plugin has three built-in animations: Classic (the default), Dramatic and Rainbow. In the preset’s “Suppression” section, switch on “Animation” on a step with a command and pick one from the list, which shows each one’s icon and description. Custom animations aren’t supported, only the built-in ones. `/mlsac animation list` shows the installed ones, `/mlsac animation reload` reloads them. `/mlsac animation test` is gone.

> Ran `/mlsac reload` mid-animation? The ban is skipped, and the player gets their items back and unfreezes.

### Punishing by hand

`/mlsac punish <name>` runs the harshest step of your ladder. If the player has no VL, no buffer and no strong checks, it asks you to confirm: `/mlsac punish <name> confirm`. Their VL doesn’t change.

### Punishment history

`/mlsac kicklist` is gone. See who was kicked or banned and when on the Kicks page of `/mlsac menu`, and one player’s history in `/mlsac profile <name>`. More in [Staff menus](https://mlsac.net/wiki/detection/menus#kicks).

| Command | Permission |
| --- | --- |
| `/mlsac punish` | `mlsac.command.punish` |
| `/mlsac menu` | `mlsac.command.suspects` |
| `/mlsac animation list\|reload` | `mlsac.command.animation` |

### Command protection

Since 2.0.4 the plugin checks every command from the preset before running it: ladder steps, suppression commands, `/mlsac punish`, the command at the end of an animation, and menu buttons with a command. That keeps your server safe even if someone gets into your site account. The site also refuses to save a dangerous command in a preset.

- Only punishment commands run: vanilla `ban`, `ban-ip`, `kick`, `pardon`, and the ban, mute, kick, warn, jail and unban commands of LiteBans, AdvancedBan, BanManager, Essentials, CMI, LibertyBans and MaxBans, plus MLSAC’s own commands and `broadcast`. Anything else only if you allow it yourself in `config.yml`.
- `op`, `stop`, permission plugins, WorldEdit, `sudo`, `execute`, `/mlsac reload` and the like are always blocked, including tricks like `minecraft:op` or aliases. Not even `config.yml` can allow them.
- Chains (`;`, `&&`, `|`), selectors like `@a` and `@p`, line breaks and commands over 256 characters are rejected. The target can only be the punished player: in a ban, kick or mute, `{PLAYER}` must be the first argument (after flags like `-s`).
- If one command hits more than 15 different players within a minute, all site commands pause for 10 minutes and staff are warned. There’s also an overall limit: 120 commands a minute and 30 per player.
- A refused command doesn’t run. The console gets a `[CommandGuard] Blocked console command …` line with the reason, and staff with alert permissions get a warning in chat. A command the server doesn’t have (say, `broadcast` without Essentials or CMI) is simply skipped with a console line.

The guard’s settings live in your server’s `config.yml`, and the site can’t change them. `/mlsac reinstall` adds the section to an older file; after editing, `/mlsac reload` is enough.

``` plugins/MLSAC/config.yml
command-guard:
  enabled: true
  mode: "block"
  extra-allowed-roots: []
  max-commands-per-minute: 120
  max-commands-per-player-per-minute: 30
  max-same-command-burst: 15
  burst-pause-minutes: 10
```

| Key | What it is |
| --- | --- |
| `enabled` | Turns the guard on. We don’t recommend switching it off. |
| `mode` | `block`: a dangerous command doesn’t run. `warn`: it runs, but the console and staff get a warning; handy for testing your own commands. |
| `extra-allowed-roots` | Extra commands to allow, e.g. `["say", "cmi"]`. The always-blocked ones can’t be allowed this way. |
| `max-commands-per-minute`, `max-commands-per-player-per-minute` | How many site commands may run per minute overall and per player. |
| `max-same-command-burst`, `burst-pause-minutes` | How many different players one command may hit within a minute, and how long the pause lasts when it’s more. |

Related: https://mlsac.net/wiki/suppression/flag-ladder, https://mlsac.net/wiki/reference/commands, https://mlsac.net/wiki/reference/config-yml

## Section: Presets
URL: https://mlsac.net/wiki/configs

The preset editor, section by section.

## The preset editor, section by section
URL: https://mlsac.net/wiki/configs/editor

What lives in each section of a preset: “General”, “Messages”, “Regions/Worlds”, “Models”, “Detection”, “Suppression” and “Staff tools”.

Open [Configs](https://mlsac.net/dashboard/configs) and pick a preset. Sections on the left, settings on the right. Changes go to the server after “Save” and arrive within a minute (or right after `/mlsac reload`). Pick your server version at the top: it decides which sounds, items and 3D tags the editor offers.

### General

- “Return to free”: when daily requests run out, checks continue on a free Beginner licence instead of pausing. You need an active Beginner on the account.
- “Name check before commands”: a player with an odd name gets kicked directly instead of through a command the name could break.
- Modules: “Detection”, “Menus”, “Update notifications”. Turn “Detection” off and the anticheat stops checking players.
- Holograms over suspects and the menu designer: see [Holograms](https://mlsac.net/wiki/detection/holograms) and [Staff menus](https://mlsac.net/wiki/detection/menus).

(Video: Demo account: “General” → holograms, editing a line and the tag’s look, with the preview updating live.)

### Messages

Everything the plugin writes to chat and above the hotbar: about seventy texts, grouped, with search. Text on the left, how it looks in game on the right. Colours work like in game: `&a`, `&l`, HEX `&#RRGGBB`. Only the texts you change are stored; the rest come from the defaults in the language you pick at the top (7 languages). “Reset” brings a default back.

(Video: Demo account: searching “VL”, changing the flag line, and seeing on the right how it will look in game.)

> Arabic in Minecraft chat is drawn left to right and without joined letters, so it won’t look like the editor preview.

### Regions/Worlds

Places where the anticheat doesn’t check players or apply suppression: a region, a world, or a region in one world. More in [Regions and worlds](https://mlsac.net/wiki/detection/regions).

### Models

Which models run on the server: Ultra, or the others (Pulse, Pro, Mini). For Pulse you pick a core and strictness. Each model card shows 30 days of stats. More in [Models](https://mlsac.net/wiki/detection/models).

### Detection

The 80 or 90 % threshold, buffer capacity, faster repeat flag, buffer growth and decay. At the bottom, staff notifications: the console copy and the sound. How it all adds up is in [Buffer and flags](https://mlsac.net/wiki/detection/buffer-and-flags).

(Video: Demo account: “Detection”, switching the threshold and watching the numbers change.)

### Suppression

Two tabs. “By flags”: the [flag ladder](https://mlsac.net/wiki/suppression/flag-ladder) with punishments and effects. “By buffer”: [buffer thresholds](https://mlsac.net/wiki/suppression/buffer) that squeeze a cheater before the flag. The effects themselves: [damage](https://mlsac.net/wiki/suppression/damage), [lag](https://mlsac.net/wiki/suppression/lag), [tricks](https://mlsac.net/wiki/suppression/tricks).

### Staff tools

A separate tab for staff tools (needs plugin 2.0.4): allow `/mlsac data … restore`, the Kicks page in `/mlsac menu`, the player profile in `/mlsac profile`, and “Whole-network data”. More in [Staff menus](https://mlsac.net/wiki/detection/menus#kicks), [Monitor and player profile](https://mlsac.net/wiki/detection/monitor#profile) and the [FAQ](https://mlsac.net/wiki/help/faq#false-positive).

### Managing presets

- You can have several presets, say `main` for survival and `pvp` for the arena. The server uses the one named in `remote-config.preset`.
- Delete a preset and the servers using it fall back to built-in settings, with a warning for admins.
- Only your account can see your presets.

Related: https://mlsac.net/wiki/start/first-preset, https://mlsac.net/wiki/reference/config-yml

## Section: Dashboard
URL: https://mlsac.net/wiki/dashboard

Servers, statistics, player dossiers and access for partners.

## Servers and licences
URL: https://mlsac.net/wiki/dashboard/servers

The server cards in your dashboard: status, players online, the daily quota, and the tabs holding the key, licence, access and notifications.

Every licence is a card under [Servers](https://mlsac.net/dashboard/servers). A green dot means the plugin is connected right now. The card also shows players online and how many requests have gone out today.

(Video: Demo account: the server connects, the dot turns green, and we open the card.)

### Inside a card

| Tab | What’s there |
| --- | --- |
| Overview | Status, players online, today’s detections and new players, the daily quota, links to statistics and dossiers. |
| Connection | The API key, resetting it, and the “plugin connected” status. |
| License | Plan, term, renewal, upgrade and freezing. |
| Access | Partners you’ve shared the server with. |
| Notifications | Discord and Telegram webhooks for alerts and punishments. |

- You can rename a server right on its card. Only you and partners see that name; in alerts the server signs as `server-identity.name` from config.yml.
- Closing the server for a while? A paid licence can be frozen on the “License” tab.
- The daily quota counts from midnight, server time.

Related: https://mlsac.net/wiki/dashboard/statistics, https://mlsac.net/wiki/dashboard/partners

## Statistics
URL: https://mlsac.net/wiki/dashboard/statistics

How many detections and requests, who the new players are, and how busy the server is over a day, a week and a month.

Open the server under [Servers](https://mlsac.net/dashboard/servers) → “Statistics”. Up top are tiles: whether the server is online, players online, today’s detections, today’s new players and the daily quota. Below them are the detection and request charts.

- A detection here is a check that pushed a player’s buffer to an alert. It’s not a flag; there are fewer flags.
- “Today” counts from midnight, server time.
- A sudden spike on one day usually means one thing: someone joined with a cheat. Check the dossier for that day.

(Video: Demo account: today’s tiles, then the detection chart for 24 hours, 7 days and a month.)

> A partner only sees statistics if you gave them the “Statistics” right.

Related: https://mlsac.net/wiki/dashboard/dossier, https://mlsac.net/wiki/dashboard/servers

## Player dossiers
URL: https://mlsac.net/wiki/dashboard/dossier

A list of everyone MLSAC has checked, with a trust factor, plus a player page with detection history by day and hour.

Dossiers come in handy when a player appeals, or when you want to know how long they’ve been cheating. Open the server → “Player dossiers”.

### The player list

- Search by name, filter by verdict: everyone, suspicious, cheaters, clean. Sort suspicious first, clean first, or by name.
- The trust factor is a ring: green from 80, amber from 50, red below that.
- The list loads in batches; search and filters work on what’s loaded, so hit “Load more”.

### A player’s page

Detection charts by day and by hour, peak probability, and the history: when, which model, how confident, and what followed. Click a day on the chart to see just that day.

(Video: Demo account: the “Cheaters” filter, a name search, and a player’s dossier with charts and history.)

> Before answering an appeal, look at the history. A single detection means nothing; dozens of checks near 99 % across several days speak for themselves.

Related: https://mlsac.net/wiki/dashboard/statistics, https://mlsac.net/wiki/dashboard/partners

## Partners and access
URL: https://mlsac.net/wiki/dashboard/partners

How to let a co-owner or moderator into the dashboard with exactly the rights they need.

Never hand out your password. That’s what partners are for: open the server → “Access”, add the person by the email of their mlsac.net account (they need to be registered), and tick the rights. With no rights ticked, they only see the licence name.

| Right | What it gives |
| --- | --- |
| API key | See and copy the licence key. Only the owner can still reset it. |
| Statistics | Detection charts and plan statistics. |
| Player dossiers | Dossiers and detection history. |
| Global statistics | Requests used, days left, protection type. |
| Webhooks | Discord and Telegram webhook settings. |

- The partner sees the server in their own “Partner access” list.
- You can change rights or revoke access completely at any time.

(Video: Demo account: “Access” → “Add partner”, an email, the “Statistics” and “Player dossier” rights, then “Manage partners”.)

Related: https://mlsac.net/wiki/dashboard/servers, https://mlsac.net/wiki/dashboard/dossier

## Section: Reference
URL: https://mlsac.net/wiki/reference

Commands, permissions, config.yml and compatibility.

## Commands
URL: https://mlsac.net/wiki/reference/commands

Every `/mlsac` command in one table: what it does and which permission it needs.

The main command is `/mlsac`, with `/ml` and `/mls` as short forms. Without arguments it lists the commands you’re allowed to use. In the console drop the slash: `mlsac status`. Commands marked “in game only” don’t work from the console.

### For moderators

| Command | What it does | Permission |
| --- | --- | --- |
| /mlsac alerts | Turn chat alerts on or off. In game only. | mlsac.command.alerts |
| /mlsac monitor | Every check of every player in chat. Run it again to stop. In game only. | mlsac.command.monitor |
| /mlsac monitor player <ник> | A player’s confidence, buffer and VL above your hotbar. `/mlsac monitor player` with no name stops it. In game only. | mlsac.command.monitor |
| /mlsac menu | The suspects menu with the Kicks page. The old name `/mlsac suspects` still works. In game only. | mlsac.command.suspects |
| /mlsac profile <ник> | The player profile menu: sessions, detections, suppressions and punishments. From the console you get the same data as text lines. | mlsac.command.profile |
| /mlsac punish <ник> [confirm] | Run the harshest step of your ladder. | mlsac.command.punish |
| /mlsac data legit\|cheat restore <ник> | Save the player’s latest fights to a file labelled legit or cheat to send to us. Switched on in the preset. | mlsac.command.data |

### For admins

| Command | What it does | Permission |
| --- | --- | --- |
| /mlsac status | Connection, preset, today’s counters and round trip. | mlsac.command.status |
| /mlsac reload | Re-read config.yml and the preset and reload the ban animations; the preset arrives about two seconds later. | mlsac.command.reload |
| /mlsac reinstall | Add missing keys to config.yml and keep your values (repeat within 3 seconds). | mlsac.command.reinstall |
| /mlsac animation list\|reload | Punishment animations: list and reload. | mlsac.command.animation |
| /mlsac debug on\|off\|auto | Diagnostics for support: a `[Debug]` summary in the console every 10 seconds. `auto` goes back to the `debug` value in config.yml. | mlsac.command.debug |
| /mlsac debug player <ник>\|off | A detailed console log of one player: every hit, check and answer. `off` stops it. | mlsac.command.debug |
| /mlsac debug | With no arguments (or `status`): a short report on the server, version, detection, connection and preset. | mlsac.command.debug |

### Diagnostics: /mlsac debug

If support asks for `[Debug]` lines, run `/mlsac debug on` (or `/mlsac debug player <name>` for one player), reproduce the situation and send the console lines in a [ticket](https://mlsac.net/dashboard/ticket). The summary shows how many hits and checks the plugin handled and why a hit wasn’t checked (bypass permission, a region without checks, detection turned off and so on). Then `/mlsac debug off`. `/mlsac debug` isn’t in the command list, but it works for anyone with the permission.

> 2.0.4 removed `/mlsac prob`, `/mlsac kicklist`, `/mlsac animation test` and `/mlsac falsepositive`. Use `/mlsac profile`, the Kicks page in `/mlsac menu` and `/mlsac data … restore` instead. `/mlsac bench`, `/mlsac start`, `/mlsac stop` and `/mlsac datastatus` aren’t in plugin 2.0 either. The old `/mlsac monitor chat` and `/mlsac monitor prob <name>` are still understood as `/mlsac monitor` and `/mlsac monitor player <name>`.

> What each node contains and ready setups for a helper, a moderator and an admin are in [Permissions](https://mlsac.net/wiki/reference/permissions).

Related: https://mlsac.net/wiki/reference/permissions, https://mlsac.net/wiki/start/check

## Permissions
URL: https://mlsac.net/wiki/reference/permissions

Every permission in plugin 2.0: what it gives, the default, and what the bundles contain. Plus ready LuckPerms setups for a helper, a moderator and an admin.

The tables below come straight from the plugin’s `plugin.yml`. “op” under “Default” means operators have it out of the box; “false” means you have to grant it. The commands are described in [Commands](https://mlsac.net/wiki/reference/commands).

> **Ops don’t get suppressed** `mlsac.admin` goes to operators by default and contains `mlsac.suppression.bypass`. So on a server with a permissions plugin (LuckPerms and the like), damage, lag and tricks never touch an op, and you can’t test suppression on one. A `*` wildcard in LuckPerms grants all of this as well.

### Staff and notifications

| Node | Default | Gives | Children |
| --- | --- | --- | --- |
| `mlsac.notify.alerts` | false | Chat alerts, the alert sound and holograms over suspects. | — |
| `mlsac.alerts` | op | Everything a moderator needs in game: alerts, monitor, the suspects menu. | `mlsac.command.alerts`, `mlsac.command.monitor`, `mlsac.command.suspects`, `mlsac.notify.alerts` |

### Commands

| Node | Default | Command | Children |
| --- | --- | --- | --- |
| `mlsac.command.alerts` | false | `/mlsac alerts` | — |
| `mlsac.command.monitor` | false | `/mlsac monitor` | — |
| `mlsac.command.suspects` | false | `/mlsac menu`, `/mlsac suspects` | — |
| `mlsac.command.profile` | false | `/mlsac profile` | — |
| `mlsac.command.punish` | false | `/mlsac punish` | — |
| `mlsac.command.data` | false | `/mlsac data … restore` | — |
| `mlsac.command.falsepositive` | false | Old name of `mlsac.command.data`. | — |
| `mlsac.command.status` | false | `/mlsac status` | — |
| `mlsac.command.debug` | false | `/mlsac debug` (console diagnostics) | — |
| `mlsac.command.reload` | false | `/mlsac reload` | — |
| `mlsac.command.reinstall` | false | `/mlsac reinstall` | — |
| `mlsac.command.animation` | false | `/mlsac animation` | — |
| `mlsac.prob` | op | Old bundle: player profiles. | `mlsac.command.profile` |
| `mlsac.reload` | op | Old bundle: reload. | `mlsac.command.reload` |

`mlsac.command.collect`, `mlsac.collect` and `mlsac.command.bench` are gone from plugin 2.0, along with their commands. If they’re still set in LuckPerms, you can remove them.

### Bypass

| Node | Default | Gives | Children |
| --- | --- | --- | --- |
| `mlsac.bypass` | false | The player isn’t checked at all: no alerts, flags or punishments. | `mlsac.suppression.bypass` |
| `mlsac.suppression.bypass` | false | Checked as usual, but damage, lag and tricks don’t apply. Ladder commands (kick, ban) still run. | — |

> **Bypass needs a permissions plugin** Both bypass nodes only take effect when the server has a permissions plugin: LuckPerms, PermissionsEx, GroupManager, UltraPermissions, PowerRanks, zPermissions, bPermissions, PermissionsBukkit, or another one through Vault. Without one, nobody bypasses, not even operators.

### Admin

| Node | Default | Gives | Children |
| --- | --- | --- | --- |
| `mlsac.admin` | op | Everything at once, including the suppression bypass. `mlsac.bypass` itself isn’t included, so the player is still checked. | `mlsac.alerts`, `mlsac.prob`, `mlsac.reload`, `mlsac.command.punish`, `…data`, `…status`, `…debug`, `…reinstall`, `…animation`, `mlsac.suppression.bypass` |

### Ready-made setups

A helper sees alerts and tags, a moderator also gets the monitor, profiles and status, an admin runs the plugin. We don’t give the admin `mlsac.admin`, so suppression still works on them and they can test it.

``` LuckPerms
# helper: alerts and tags
lp group helper permission set mlsac.notify.alerts true
lp group helper permission set mlsac.command.alerts true

# moderator: alerts, monitor, menu with the Kicks page, profiles, status
lp group moderator permission set mlsac.alerts true
lp group moderator permission set mlsac.prob true
lp group moderator permission set mlsac.command.status true

# admin: everything except the suppression bypass
lp group admin permission set mlsac.alerts true
lp group admin permission set mlsac.prob true
lp group admin permission set mlsac.reload true
lp group admin permission set mlsac.command.status true
lp group admin permission set mlsac.command.debug true
lp group admin permission set mlsac.command.punish true
lp group admin permission set mlsac.command.data true
lp group admin permission set mlsac.command.reinstall true
lp group admin permission set mlsac.command.animation true

# an op still gets mlsac.admin by default; this keeps suppression working on them
lp user <nick> permission set mlsac.suppression.bypass false
```

A person gets each alert line once, even if they hold several of these nodes. If a player isn’t flagged or suppressed, start by [checking permissions](https://mlsac.net/wiki/help/faq#not-working).

Related: https://mlsac.net/wiki/reference/commands, https://mlsac.net/wiki/help/faq

## config.yml in full
URL: https://mlsac.net/wiki/reference/config-yml

The whole `plugins/MLSAC/config.yml`, explained. It’s short, because everything else is set on the site.

``` plugins/MLSAC/config.yml
# Do not edit.
_schema-version: '2.0'

debug: false

# ru, en, uk, es, vi, zh, ar
language: "ru"

detection:
  api-key: "your-api-key"

remote-config:
  # "" = the only preset on your account, "<name>" = that preset, "none" = built-in defaults
  preset: ""

server-identity:
  name: "default"
  family: "default"
  interserver:
    enabled: false
  reporting:
    events-enabled: true
    alert-threshold: 0.80

command-guard:
  enabled: true
  mode: "block"
  extra-allowed-roots: []
  max-commands-per-minute: 120
  max-commands-per-player-per-minute: 30
  max-same-command-burst: 15
  burst-pause-minutes: 10
```

| Key | What it is |
| --- | --- |
| `_schema-version` | Internal, leave it alone. |
| `debug` | A verbose log and a `[Debug]` summary every 10 seconds, for when support asks. `/mlsac debug on\|off` switches it without a restart, `/mlsac debug auto` goes back to the value in the file. |
| `language` | The plugin’s message language: ru, en, uk, es, vi, zh, ar. |
| `detection.api-key` | The key from your dashboard: [API key](https://mlsac.net/wiki/start/api-key). |
| `remote-config.preset` | Which preset to use: [Your first preset](https://mlsac.net/wiki/start/first-preset). |
| `server-identity.name` | The server’s name in alerts. |
| `server-identity.family`, `interserver.enabled` | Shared alerts and actions across a network. |
| `reporting.events-enabled`, `alert-threshold` | Whether events go to the dashboard, Discord and Telegram, and from what confidence. |
| `command-guard.*` | Protection against dangerous commands from the site (since 2.0.4): [Command protection](https://mlsac.net/wiki/suppression/animations#guard). |

- There are no backend addresses in the file: the main `api.mlsac.net` and the backup `ruapi.mlsac.net` are built in, and the plugin switches between them itself.
- After editing the file, `/mlsac reload` is enough. `/mlsac reinstall` adds missing keys (such as the `command-guard` section in an older file).
- Old 1.x files (`modules.yml`, `holograms.yml` and so on) get moved to `plugins/MLSAC/old/`; you don’t need them anymore.
- Coming from 1.x? On the first start the plugin rewrites config.yml in the 2.0 layout and carries over your key (including the old `ai.api-key`) and the settings that still exist in 2.0.

Related: https://mlsac.net/wiki/start/api-key, https://mlsac.net/wiki/reference/compatibility

## Compatibility
URL: https://mlsac.net/wiki/reference/compatibility

Server software, versions 1.16.5 to 26.2, Java, Folia, ViaVersion, Geyser, WorldGuard and Grim: what works and with which caveats.

| What | How it works |
| --- | --- |
| Paper, Purpur, Pufferfish | The main target; everything works. |
| Spigot | Works. |
| Folia | Detection and suppression work, there are no holograms. Tested on Folia 1.19.4, 1.20.4, 1.20.6, 1.21.4, 1.21.11 and 26.2. |
| Versions | Minecraft 1.16.5 to 26.2, including the new 26.x combat packets. Versions newer than 26.2 aren’t confirmed yet. |
| Java | At least 17, even on 1.16.5. `…-java17.jar` for Java 17–20, `…-java21.jar` for Java 21 and newer (Paper 1.20.5+, and 26.x, which needs Java 25). |
| ViaVersion | Works, including ViaBackwards on 26.x servers. Clients below 1.19.4 see tags as a plain name line, without the 3D look. |
| Geyser / Floodgate | Bedrock players aren’t checked. |
| WorldGuard | Optional: needed for regions without checks. Whole worlds work without it. |
| PacketEvents | Already inside the jar; don’t install it separately. |
| Plugman, /reload | Not supported. Install and update with a full restart. |

### What we tested on

We ran these versions on a live server with bots: startup, fights, alerts, teleports, death, world changes, `/mlsac reload` and shutdown.

| Server | Versions |
| --- | --- |
| Paper | 1.16.5, 1.17.1, 1.18.2, 1.19.4, 1.20.1, 1.20.4, 1.20.6, 1.21.1, 1.21.4, 1.21.8, 1.21.11, 26.1.2, 26.2 |
| Folia | 1.21.11, 26.2 |
| Clients | Native clients, and older clients through ViaVersion + ViaBackwards on 26.x |

> Plugin 2.0.6 and older may print the nearest known version instead of the exact one in the first startup line: `1.21.11` on 26.x, `1.19` on 1.19.4. It’s only a label; the server version is recognised correctly.

### MLSAC and Grim

They don’t get in each other’s way and work well together. MLSAC handles combat: killaura, triggerbot, aim, reach, hits through walls. Movement cheats (fly, speed, scaffold and the like) aren’t MLSAC’s job; that’s what Grim is for.

Related: https://mlsac.net/wiki/start/install, https://mlsac.net/wiki/reference/config-yml

## Section: Help
URL: https://mlsac.net/wiki/help

Common questions and what to do when something doesn’t work.

## FAQ and troubleshooting
URL: https://mlsac.net/wiki/help/faq

Short answers to the most common questions: no flags or no suppression, the preset didn’t load, no holograms, out of requests, a false positive.

### The plugin does nothing: no flags or no suppression on a player

Nine times out of ten it’s a bypass permission. `mlsac.bypass` takes the player out of every check. `mlsac.suppression.bypass` keeps the checks but turns off in-game suppression, and it’s also inside `mlsac.admin`, which operators get by default. A `*` wildcard in LuckPerms hands out all of them at once. Bypass nodes only work when a permissions plugin (LuckPerms and the like) is installed; without one, nobody bypasses.

``` LuckPerms
# what does the player actually have?
lp user <nick> permission check mlsac.bypass
lp user <nick> permission check mlsac.suppression.bypass
lp user <nick> permission check mlsac.admin

# take it away (false overrides groups and *)
lp user <nick> permission set mlsac.bypass false
lp user <nick> permission set mlsac.suppression.bypass false

# or remove a node you set on the player by hand
lp user <nick> permission unset mlsac.suppression.bypass
```

Test on a normal account with no op and no `*`. If permissions look fine, go down this list:

- The API key is missing or wrong. Check `/mlsac status` and [this case](https://mlsac.net/wiki/help/faq#not-connected).
- The preset hasn’t applied yet. After `/mlsac reload` it arrives about two seconds later; otherwise the server checks once a minute.
- You’re out of requests for today, see [the limit](https://mlsac.net/wiki/help/faq#quota).
- The player is in a region or world with detection turned off. See [Regions/Worlds](https://mlsac.net/wiki/detection/regions).
- The player isn’t fighting another player. The model doesn’t judge hits on mobs, bots or thin air.
- It’s a fake player or an NPC. The anticheat doesn’t check those at all, so test with a second real account.
- It was loaded with Plugman or `/reload`. That isn’t supported; do a full server restart.
- Still stuck? Run `/mlsac debug on` (or `/mlsac debug player <name>` for one player), repeat the fight and watch the console: it shows hits, checks and why a hit wasn’t checked. Send those `[Debug]` lines in a [ticket](https://mlsac.net/dashboard/ticket); `/mlsac debug off` stops it. More in [Commands](https://mlsac.net/wiki/reference/commands#debug).

> Every node and ready setups for your staff are in [Permissions](https://mlsac.net/wiki/reference/permissions).

### I saved the preset but nothing changed on the server

The server checks the site once a minute, so give it a moment. Need it right now? `/mlsac reload`, and the preset arrives about two seconds later with `Applying preset` in the console. No such line? Check `/mlsac status`: the preset should say “active”.

### I don’t see holograms over players

- You need `mlsac.notify.alerts`, `mlsac.alerts` or `mlsac.admin`.
- A tag only appears after the player’s first checks. To see it straight away, turn on “Show with no checks”.
- Bots and fake players get no tags because the anticheat doesn’t check them. Test with a real second account.
- Players in spectator have none, and holograms don’t run on Folia.

### Checks stopped and the status says “request limit”

Your plan’s daily requests ran out, so checks pause until the next day (midnight, server time). To avoid that, turn on “Return to free” in the preset: requests then come from a free Beginner licence if your account has one. If you run out every day, you need a bigger plan.

### I’m testing suppression on myself and nothing happens

You’re probably op. Operators have `mlsac.admin`, which includes `mlsac.suppression.bypass`, so with a permissions plugin like LuckPerms, damage, lag and tricks skip them. Use a normal account; more [above](https://mlsac.net/wiki/help/faq#not-working). And if you’re testing thresholds, make sure “Buffer suppression” is on in the preset.

### MLSAC punished an honest player

1. **Save the data**: While they’re online: `/mlsac data legit restore <name>`. The plugin saves their latest fights (up to 5000 ticks) to `plugins/MLSAC/data/restore/legit/`; attach that folder to your ticket. Switch the command on in the preset first, “Staff tools” tab.
2. **Open the dossier**: See how many detections there were and on which model. One spike and dozens of checks over days look very different.
3. **Write to us**: A [support ticket](https://mlsac.net/dashboard/ticket) with the name, time and server.

> While you investigate, soften things: a 90 % threshold instead of 80 %, a bigger buffer, and suppression instead of a ban on the first flags.

- Caught a cheater MLSAC missed? Same thing with `cheat`: `/mlsac data cheat restore <name>`, folder `plugins/MLSAC/data/restore/cheat/`.
- The plugin starts remembering a player’s fights at their first hit on another player and forgets them when the player leaves, so save while they’re online. The file stays on your server; nothing is sent to the site.
- Permission: `mlsac.command.data` (the old `mlsac.command.falsepositive` works too). The old `/mlsac falsepositive` is gone.

### The dashboard says “never connected”

The key isn’t in, has a typo, or there was no `/mlsac reload` after adding it. Look in the console for `Detection: off (API key …)` or `The backend refused the API key`. If it says `Cannot reach`, your host is blocking outgoing HTTPS.

### Does it load the server much?

No. The neural networks run in our cloud; the plugin just collects combat data and sends it. If the cloud is unreachable, the plugin moves to the backup address on its own and comes back later.

### Does MLSAC catch fly, speed, scaffold?

No, MLSAC is about combat. For movement, run Grim alongside; they don’t clash. More in [Compatibility](https://mlsac.net/wiki/reference/compatibility#grim).

Related: https://mlsac.net/wiki/start/check, https://mlsac.net/wiki/reference/permissions

# Part 2. FAQ
URL: https://mlsac.net/faq

## What does MLSAC stand for?

MLSAC is a machine-learning (ML) anticheat for Minecraft servers. You will also see it called MLS AntiCheat.

## Which cheats does MLSAC catch?

Combat cheats, the ones that decide PvP fights: KillAura, AimBot and AimAssist, TriggerBot, Reach and hits through walls (WallHit).

## How is detection better than a typical heuristic anticheat?

Traditional anticheats mostly check fixed thresholds: speed, angle snaps, click patterns. They are tuned by hand, and once you know the logic they are easy to tune around. MLSAC runs the same behavioural data through neural networks. They are retrained centrally as new bypasses appear, and every protected server gets the update the moment it ships, without touching the plugin.

## Can MLSAC ban a legit player by mistake?

The detection buffer needs many confident checks before a flag, and you choose what a flag does. Not fully sure about a verdict? Instead of a ban or a kick you can simply cut the player’s damage hard. Before release, models are measured on held-out legit players to keep false positives rare.

## What happened to MLS Vision, AI-MOD, Anti-ESP and reports?

They are gone. MLS Vision and AI-MOD are closed, and plugin 2.0 has neither Anti-ESP nor the /report command. The old news posts about them stay in the archive as history.

## Does the anticheat load the server?

No. The heavy part, the neural networks, runs in the MLSAC cloud. The plugin only collects combat data and sends it in small requests, so the checks never touch your server’s CPU or TPS.

## Which servers and versions are supported?

Paper and its forks (Purpur, Pufferfish and the rest), Spigot and Folia, Minecraft 1.16.5 to 1.21.11. Newer ones like 26.x run too. You need Java 17 or newer: there is one build for Java 17 and one for Java 21+. Nothing extra to install, PacketEvents is already inside. WorldGuard is optional. Bedrock players (Geyser/Floodgate) are not checked, and Folia gets no holograms.

## Can I install or update the plugin with Plugman or /reload?

No, only with a full server restart: Plugman and /reload are not supported. Applying new settings needs no restart, /mlsac reload is enough.

## Does MLSAC update itself?

Yes, the plugin checks for stable updates by itself and installs the build for your Java, 17 or 21. The models are updated in the cloud and need no plugin update at all.

## Do I need to edit config.yml for settings?

No. config.yml only holds the API key and the preset name. Everything else (detection, alerts, suppression, punishments, holograms) lives in presets on the site, under Configs. The plugin picks up changes by itself, without a restart.

## Where are the MLSAC servers and where does the plugin connect?

The plugin always talks to the main address, api.mlsac.net. If it is down, the plugin switches to the reserve ruapi.mlsac.net on its own and comes back once the main one is up again. Nothing to configure.

## What data does MLSAC send?

Combat behaviour numbers (aim, clicks, movement, hits) for players who are fighting, player nicknames for alerts and history, and server statistics. Chat messages are not sent.

## Is MLSAC free?

Yes, there is a free plan, Beginner, and it never expires. Paid plans give more daily requests, a larger online, the Pulse model and, after verification, Ultra. All prices are on the pricing page.

## Can I move to a higher plan?

Yes, as long as more than 20 days are left on your current plan. You pay the difference between the new and the current plan for every started 30 days left. The expiry date stays the same, no extra days are added. You can only move up. The free Beginner plan cannot be upgraded: it never expires, so a paid plan is bought as a separate licence.

## Which models come with a plan?

Beginner runs the main Pro model; you can switch to the light Mini in the preset. Every paid plan, from Baseline up, gets Pro and Pulse with its long aiming window, no verification needed. Ultra is the next-generation model: it is in early access and runs on plugin 2.0 only. It opens on any paid plan once your account is verified (apply in the dashboard settings).

## Cooperation

Running a large network or a public brand? We do custom cooperation agreements: dedicated capacity, adjusted pricing or a joint promotion. Write to us and we will work out the details.

# Part 3. MLSAC vs Grim, Vulcan, Polar, Matrix, Spartan and NoCheatPlus
URL: https://mlsac.net/compare

Classic anticheats catch cheats with checks their developers wrote by hand. MLSAC catches combat cheats with neural networks trained on recorded fights. They are different tools, and they work best together.

- MLSAC does not replace a movement anticheat. It covers combat only: KillAura, aim assist, triggerbot, reach and hits through walls. Fly, speed, scaffold and other movement cheats are not its job.
- Recommended setup: MLSAC for combat plus a Grim fork for movement, such as LightningGrim or GroundedGrim. They do not get in each other’s way.
- What is different about MLSAC: a neural network in the MLSAC cloud makes the call, not a set of thresholds. Models are retrained centrally, and your server gets the update without a plugin update.

## Hand-written checks

This is how classic anticheats work. A developer writes a rule: a player cannot move faster than X, hit further than Y, or send packets in a certain order. A rule fires instantly and is easy to explain. The weak spot is cheats that behave almost like a human: smoothed aim, random delays. Catching those with rules means tuning thresholds, which is always a trade-off between missed cheaters and false flags.

## MLSAC neural networks

The plugin collects numbers about combat behaviour: aim, clicks, movement, hits. A neural network in the cloud looks at a short stretch of the fight as a whole and scores how much it looks like cheating. The models are trained on our own dataset of hundreds of recorded fights against dozens of cheat clients. One confident score is not a flag yet: a buffer collects checks, and you decide what a flag does.

## What each approach is good at

| Task | Checks (classic anticheat) | MLSAC neural networks |
| --- | --- | --- |
| Fly, speed, scaffold, timer | Their main strength: movement physics can be described exactly. | Not covered. Run a Grim fork alongside. |
| Impossible packets and clear-cut violations | Caught instantly, with a clear reason. | Not its job. |
| KillAura that aims and hits by itself | Blatant auras get caught; smoothed, human-like ones need threshold tuning. | The main target. On unseen recordings, Ultra caught 98.9% of aura windows. |
| Triggerbot | Hard: the player aims, and a rule struggles to tell a cheat’s click from good reflexes. | Ultra: 92.6% of windows in the test. Earlier MLSAC models barely saw them. |
| Aim assist | Hard: the help is subtle and looks like normal aiming. | Ultra: 73.0% of windows, ahead of earlier models. The hardest case for neural networks too. |
| Reach and hits through walls | Geometry checks work, but have to account for latency. | A new capability of the Ultra model. |
| Server load | Every check runs on your server. | Neural networks run in the cloud. In a 200-player fight, plugin 2.0 takes about 1.5 ms of the 50 ms tick. |
| New cheats | The developer writes or fixes a check, and you update the plugin. | Models are retrained centrally; no plugin update needed. |
| Working without an internet connection | Run fully on your machine. | Needs a connection to api.mlsac.net (with automatic fallback to ruapi.mlsac.net). |
| Bedrock players (Geyser) | Depends on the anticheat. | Not checked. |

## Who is who

Only general, public facts here, as stated by the developers and on their pages. We have not tested these anticheats under identical conditions and publish no numbers about them.

| Anticheat | Licence | Worth knowing |
| --- | --- | --- |
| MLSAC | Free plan + paid plans | Catches combat cheats: KillAura, aim assist, triggerbot, reach and hits through walls. The neural networks are trained on recorded fights and retrained regularly without a plugin update. Paper, Purpur, Spigot 1.16.5–26.2 and Folia. Does not cover movement, so it runs alongside a movement anticheat. |
| Grim | Free, open source (GPL-3.0); paid Grim Premium available | Re-creates the client’s physics and checks every player movement against what should have happened, which makes it very strong against fly, speed, timer and other movement cheats. Versions 1.8–26.x on Paper, Spigot and Folia, plus a Fabric build. Grim Premium adds extra checks and is closed source and paid. A Grim fork is what we recommend running next to MLSAC. |
| NoCheatPlus | Free, open source | One of the oldest Bukkit anticheats, with checks for movement, fighting, block interaction and chat. Created by NeatMonster and Asofold on top of NoCheat by Evenprime. Today it is kept alive by community forks such as Updated-NoCheatPlus, and support for new Minecraft versions depends on the fork. |
| Vulcan | Paid (SpigotMC) | A commercial anticheat since 2020; the developer says it runs on 7,000+ servers. A wide set of checks: combat (KillAura, Reach, AimAssist, Velocity), movement (Speed, Fly), Scaffold and bad packets. Versions 1.8–26.x, Folia supported, needs PacketEvents installed. By default it mostly records violations; setbacks are turned on in the config. |
| Matrix | Paid | A commercial anticheat with broad settings, aimed at paid server networks. It runs with a token or account the developer issues after purchase. According to the developer it supports Folia and Bedrock players through GeyserMC, and buyers get ready-made configs for minigames and survival. |
| Spartan | Paid | One of the oldest paid anticheats, combining cheat checks with anti-exploit protection. Its updates announce machine-learning training for movement checks. A separate edition covers Bedrock players through Geyser. |
| Polar | Paid, cloud service | An anticheat delivered as a cloud service: the plugin sends player packets to the Polar cloud, where most checks run. Checks that need an instant setback, such as movement, run inside the plugin. Movement and reach anomalies are mitigated by default rather than punished. |

## Questions

### Can MLSAC replace Grim, Vulcan or another anticheat?

No. MLSAC only catches combat cheats: KillAura, aim assist, triggerbot, reach and hits through walls. Movement (fly, speed, scaffold) needs a separate anticheat. We recommend a Grim fork such as LightningGrim or GroundedGrim.

### Do MLSAC and Grim conflict on the same server?

No. They do not get in each other’s way and work well together: MLSAC handles combat, Grim handles movement.

### Why neural networks when checks exist?

Modern combat cheats try to look human: they smooth their aim and add random delays. A simple threshold struggles to separate that from a strong player. A neural network looks at a stretch of the fight as a whole and learns from recordings of real fights with and without cheats, so it finds what rules have to be hand-tuned for.

### Is MLSAC free like Grim?

There is a free Beginner plan with the Pro model that never expires. Paid plans give more daily requests, the Pulse model and, after verification, Ultra; prices are on the pricing page. MLSAC is not open source, and the neural networks run in our cloud.

### Does MLSAC load the server more than a classic anticheat?

The neural networks run in the MLSAC cloud; the plugin only collects combat data and sends it. On Paper 1.21.4 with 200 players fighting, plugin 2.0 takes about 1.5 ms of the 50 ms server tick.

### Can MLSAC ban a legit player?

Any anticheat can make mistakes. In the test, Ultra flagged 0.27% of windows from legit players it had never seen in training. One window is not a flag: the buffer needs many confident checks, and you choose the punishment, down to simply cutting damage instead of a ban.

### Does MLSAC need an internet connection?

Yes. The checks run in the cloud, so your server needs to reach api.mlsac.net. If the main address is down, the plugin switches to the reserve ruapi.mlsac.net by itself and switches back later.

# Part 4. MLS Ultra vs Pulse and Pro
URL: https://mlsac.net/benchmark
Source: https://mlsac.net/news/mls-ultra-new-era (published 2026-10-07)

How the new MLSAC model handles cheat recordings it has never seen, compared with our previous models.

## How we measured

- **Held-out recordings**: Recordings of fights with cheats from our test server. None of them were used to train Ultra: for the model this is new data. Pulse and Pro, on the other hand, had already been trained on this data.

- **Windows**: Each recording is cut into short stretches of fighting (windows). The model scores every window from 0 to 1: how much it looks like cheating.

- **Threshold 0.9**: A window counts as caught when it scores 0.9 or higher. The threshold is the same for every model.

- **Legit players**: False positives are measured on recordings of new legit players who were not in training: the share of their windows that scored 0.9 or more.

## Results

| Metric | MLS Ultra | Pulse Accord | Pulse Prism | MLS Pro |
| --- | --- | --- | --- | --- |
| Auras: share of windows caught | 98.9% | 69.9% | 68.6% | 65.5% |
| Triggerbots: share of windows caught | 92.6% (median coverage 89%) | 0.4% (median coverage 0%) | 0.4% (median coverage 0%) | 0.7% (median coverage 0%) |
| Aim assists: share of windows caught | 73.0% (median coverage 74%) | 55.7% (median coverage 40%) | 58.5% (median coverage 38%) | 53.3% (median coverage 35%) |
| Detection coverage | 100.0% | 73.4% | 73.9% | 61.0% |
| False positives on legit players | 0.27% (windows 16 / 5927) | 0.20% (windows 12 / 5927) | 0.34% (windows 20 / 5927) | 0.30% (windows 18 / 5927) |

- Auras: share of windows caught: The share of windows from kill-aura recordings that scored 0.9 or higher. Test set: 30 aura recordings (24 of them from 6 client families Ultra never trained on) and 30 legit recordings of new players. All models at 0.9.
- Triggerbots: share of windows caught: The same for triggerbots, where the player aims and the cheat clicks. Under each value: the median coverage of a recording. Test set: 4 triggerbot recordings, some from client families Ultra never trained on. All models at 0.9.
- Aim assists: share of windows caught: Cheats that gently pull the crosshair onto the target. The hardest case: Ultra is ahead here, but far from 100%. Test set: 6 aim assist recordings, some from client families Ultra never trained on. All models at 0.9.
- Detection coverage: How much of each cheat recording the detection covers; the median across recordings. Test set: 30 aura recordings (24 of them from 6 client families Ultra never trained on) and 30 legit recordings of new players. All models at 0.9.
- False positives on legit players: The share of legit players’ windows that scored 0.9 or higher. Lower is better. Here Pulse Accord is slightly ahead of Ultra. Test set: 30 aura recordings (24 of them from 6 client families Ultra never trained on) and 30 legit recordings of new players. All models at 0.9.

## Keep in mind

- A window is not a ban. On a server the buffer needs many confident checks before a flag, and the owner decides what a flag does.
- The sample is small, especially for triggerbots (4 recordings) and aim assists (6 recordings). The recordings come from our test server; results on live servers can differ.
- This compares MLSAC models with each other. No other anticheats are part of this test.
- Ultra is in early access and runs on plugin 2.0 only. It opens on paid plans from Baseline once your account is verified.