PointZero

Your server decides which mods, resource packs and shader packs players may use. PointZero makes sure they stick to it.

The check runs while the player connects, before the world loads. Nobody gets in with a file you did not allow, not even for a second.
Players who are turned away see exactly which files are the problem and how to fix it.

Why PointZero

• Checked before joining: the check happens in the configuration phase.
• File hashes: every loaded mod is checked by its SHA-256 hash.
• Proof of possession: the server asks for random parts of the reported files. A client that only copies a list of allowed hashes cannot answer.
• You choose what is checked: mods, resource packs, shader packs and Java agents can each be turned on or off.
• Whitelist or blacklist: allow only your files, or allow everything except the mods and packs you block.
• Clear for players: a rejection screen lists every reason with an error code, so players can fix it themselves or send you the details.
• Light: mods are hashed once when the game starts, in the background. On servers without PointZero, nothing is sent and nothing runs.

How it works

1. Put the mods (jars) your players may use into config/pointzero/allowed-mods/ (on Paper: plugins/PointZero/allowed-mods/). Resource packs and shader packs go into their own folders. With a blacklist, you list only what is forbidden instead.
2. A player connects. The server says what it checks.
3. The client reports only that part: its mod hashes, its active resource packs and shader pack (hashed now, only if asked), and its Java agents.
4. The server checks every reported hash against its lists, then asks for random pieces of a few files as proof that the client really has them.
5. Only then does the player enter the world.

While a player is on a server that checks resource packs or shader packs, those menus are locked. If the packs change anyway, they are checked again.

For players

• Install PointZero together with the server's mods, for the same loader as the server.
• Nothing else to set up. Singleplayer and servers without PointZero are not affected.
• If you are turned away, the PointZero screen shows what to remove or update.

For server owners

All settings are in config/pointzero/server.properties (on Paper: plugins/PointZero/server.properties), with comments.

• Check switches: check-mods, check-resource-packs, check-shader-packs, check-java-agents, each true or false.
• Blacklist: mods=blacklist (also resource-packs and shader-packs) lets everything in except what you block: jars in blocked-mods/ (every version of that mod), packs in blocked-resourcepacks/ and blocked-shaderpacks/, and lines in blocked.txt with mod ids, names such as name:xray, or SHA-256 values.
• Audit mode: log findings without disconnecting anyone while you build your lists.
• Join queue: while the allow list is rebuilt (startup or /pointzero reload), joining players wait in a queue and see their place. They get in automatically once it is ready. Operators can skip the queue (queue-skip-operators).
• Exemptions: operators and listed players can join without verification.
• Discord: webhooks for rejections, joins, and server start and stop. No pings, no webhook URLs in the log.
• Commands (/pointzero or /pz, permission level 3, on Paper pointzero.admin):
  • status: what is checked, list sizes, the queue
  • reload: reload settings and lists
  • list: show the allowed or blocked entries
  • inspect <player>: the player's last report and results
  • stats: totals and most common error codes
  • cleanup: delete old player history

Tip: start with mode=audit. Everyone gets in and the log shows what is missing from your lists. Switch to mode=enforce when the lists are complete.

Error codes

Limits

PointZero checks what the client reports.
Someone who writes their own fake client can always lie, and no client-side check can fully prevent that.
PointZero makes it a lot of work: they need the exact allowed files, have to answer the proof requests, and need a modified PointZero.
Renaming or modifying jars does not help at all.
A blacklist only stops what you list: a cheat mod with a new mod id and a new name gets in. The whitelist is the stronger choice.

Requirements

On the server and on every client, for the same loader:

• Fabric: Fabric Loader and Fabric API
• NeoForge or Forge: nothing else

Paper servers (1.21.10 to 26.3): put pointzero-paper into plugins/. Players install the PointZero mod for their loader and the server's Minecraft version. Players without PointZero see the install hint a little later than on modded servers: after about 5 seconds on a vanilla client, after timeout-seconds (15 by default) on a modded one.

Server and players need the same PointZero version.

Usage statistics

PointZero sends anonymous usage statistics every 10 minutes: environment, Minecraft and PointZero version, loader and a random ID. No player names, no mod lists. All data is deleted after 10 minutes. Turn it off with enabled=false in telemetry.properties.