Kratos

Kratos predicts each player's movement tick by tick on the server and flags the difference when legitimate physics can't explain it. Latency, low TPS, knockback, riptide, elytra, vehicles, cobwebs and slime are part of the prediction, so a player on high ping isn't punished for lag. Combat hits are measured against the victim's real interpolated position at the time of the hit.

Staff get clickable chat alerts, an in-game flag log, a checks editor, freezes, replays of what a player did, and a client fingerprint that catches cheat clients on join. Bedrock players who join through Geyser are judged by a separate engine built for their protocol, and never by the Java checks.

Features#

Movement simulation

Every player's movement is predicted tick by tick on the server. Lag, low TPS, knockback, elytra and riptide are part of the prediction, so high ping doesn't flag. Movement

Lag-compensated combat

Reach, hitboxes, aim, killaura, triggerbot and auto-clicker checks, with each hit measured against where the victim really was. Combat

Clickable alerts

Staff see every flag in chat. Hover for the check's detail, click to spectate the player. Alerts

Flag log

/kratosflags shows the last 200 flags as one head per player, filtered by Cheating or Suspicious. Flag log

Live checks editor

/kratoschecks switches any check on or off and changes its thresholds in game, saved to checks.yml. Checks catalog

Freeze

A player who piles up violations is held in place for 30 seconds, which stops cheats a check can detect but can't cancel. Freeze

Cheat clients blocked on join

Client brand, plugin channels, mod loaders and a sign probe identify cheat clients before they play. Client fingerprint

Join insight

When a player joins, staff see their client, version, flag count, country and whether they're on a VPN. Alerts

Replays

Rewind what any player did with a body only you can see, with nearby players, projectiles, block edits and chat played back. Replay

Bedrock engine

Geyser players are judged by a separate engine built for their protocol, never by the Java checks, including when Geyser runs on Velocity. Bedrock players

Web panel

A live flag feed, per-server analytics and a settings editor for every server on your license. Web panel

Anti-ESP

Players behind solid blocks are removed from the viewer's client, so ESP and tracers have nothing to draw. Needs the Nemesis Hide Entity add-on. Anti-ESP

Permissions#

Commands#

/sus is registered only while features.sus-command is true (the default) and Spartan's own /sus isn't running. On a server that also runs Spartan, Kratos sends its flags into Spartan's /sus instead.

Configuration#

Kratos splits its settings across several files in plugins/Kratos/. The panel and the in-game checks editor write to the same files.

The options most servers change:

Apply changes with /kratos reload. Replay settings reload with /kratosreplay reload.

Install#

1. Put Kratos-<version>.jar in your server's plugins folder. The Developer API folder in the download is for plugin developers only. Don't install that jar.
2. Start the server once. Kratos creates config.yml, checks.yml, ai.yml, fingerprint.yml, messages.yml and license.yml.
3. Put your license key in license.yml under license-key. Your key is under My Licenses on the BlazeZ portal.
4. Set language in config.yml if you want messages in another language, then delete messages.yml so it's written again in that language.
5. Restart the server.
6. Join as an op and run /kratos. You should see the command list, and alerts are on for you by default.

If Geyser runs on your Velocity proxy instead of on the backend, also follow Bedrock players.

Movement#

The simulation engine predicts where each player should be every tick and flags the difference. Small offsets add up as violations, and a large offset sets the player back to their last valid position straight away.

Setbacks come from Simulation.setback-violation-threshold (2) and Simulation.immediate-setback-threshold (0.18). The simulation check alerts at Simulation.violations-to-flag (100), higher than most checks because tiny offsets are common. Lag allowance widens by Simulation.lag-leniency-multiplier (3.0) whenever TPS drops under Simulation.lag-tps-threshold (19.3).

Separate checks cover phasing through blocks, NoSlow, timer abuse, knockback and explosion velocity, ground spoofing, NoFall, vehicle movement and Baritone pathing. Each has its own section in checks.yml, and Check list names every one.

On 26.2 and newer clients, the prediction also covers potent sulfur geysers, shelf mushroom bounces, and the air drag, friction and bounciness attributes.

NoFall#

NoFall flags a player who claims to be on the ground with nothing under them, and ignores the claim so fall damage still applies. In open air it flags on the first claim. Next to a block edge it waits NoFall.confirm-ticks (4) ticks and only flags if the claim repeats, so clipping a block corner while falling doesn't flag. The edge area is NoFall.edge-horizontal (0.6) blocks sideways and NoFall.edge-below (1.5) blocks down.

Spear lunge#

The spear's Lunge dash is applied by the client. Kratos counts the spear's attack charge in the client's own ticks and flags a stab taken before the weapon's attack delay has passed. The delay comes from the player's attack-speed attribute, so haste and weapon modifiers count, and a hotbar swap restarts the full delay. Legitimate lunges are part of the movement prediction, so they don't flag. Tune it under SpearLunge in checks.yml.

Combat#

Combat checks cover reach, hitboxes, aim, anti-knockback, killaura, triggerbot, shield breaking, auto-clicker patterns and hit timing. Each hit is lag-compensated against where the victim really was. Verdicts are graded as legitimate, suspicious or cheating, and only strong evidence escalates, with extra allowance for high ping and low TPS.

Reach is measured against the weapon in hand, including weapons with more than 3 blocks of reach such as the spear. A hit made within a couple of ticks of a hotbar swap is measured against whichever of the two weapons allows it, so swapping off a spear mid-fight doesn't flag.

Aim#

Aim tracking flags a crosshair that stays locked on a moving target while the player turns. It looks at the last ai.aim.tracking.samples (30) aim samples and alerts when ai.aim.tracking.locked-samples (14) of them sit within ai.aim.tracking.max-error-degrees (1.0) of the target, at any height on the body. A second alert within a minute, or ai.aim.tracking.instant-freeze-locks (16) locked samples at once, freezes the player. These settings are in ai.yml.

Bow aim#

Silent bow aim turns the player's view onto the target only for the tick the arrow is released. Kratos flags a shot where the view jumps onto the target for that one tick and straight back off it, and freezes after ai.aim.bow.revert-shots (3) such shots within ai.aim.bow.revert-window-seconds (20). Flick shots and turning away after a shot don't count.

Triggerbot#

Once a player has landed Triggerbot.combat-hits (3) hits within Triggerbot.combat-window-ms (8000), Kratos waits for a second with no swings, then shows a fake player in their crosshair that only they can see. Hitting it within Triggerbot.probe-window-ms (150) of it appearing, or before their client even received it, counts as a confirmation. Two confirmations within two minutes freeze the player. A new probe can appear every Triggerbot.probe-cooldown-ms (8000), and none is placed while a real player is near the crosshair. Triggerbot.entry logs how fast hits follow a target entering the crosshair when debug is on, and never flags while Triggerbot.entry.flag is false.

Mace smash timing#

A mace smash landed by a routine is made of ordinary packets, so Kratos judges timing instead. It measures how quickly a smash follows the victim raising a shield, how little that delay varies over a session, and how long the crosshair was on the victim before the swing. Hits where the target was already lined up well before the swing are discarded. It alerts staff but doesn't freeze or ban, because ai.smash.escalate is false by default.

Automation checks#

AutoTotem, AutoArmor, AutoPearl and AutoAnchor look for inventory and item actions no human can do. AutoArmor, for example, flags an armor swap while the camera is turning or movement keys are held, which is impossible with the inventory open, and a piece re-worn faster than a human could react after it broke. It never touches the player's inventory and never flags on equip speed alone.

AutoWeb flags cobwebs placed on an enemy by a routine: swapping to the web, placing it and swapping away in the same tick, or snapping the view onto the enemy's block and straight back. Two in AutoWeb.window-seconds (60) alert and AutoWeb.events-to-freeze (3) freeze.

AutoDrain flags a player who picks up or covers water or lava an enemy placed near them within AutoDrain.fast-ticks (3) ticks of their client receiving it. Two fast drains within AutoDrain.window-seconds (60) alert and AutoDrain.events-to-freeze (3) freeze.

Anti-ESP#

Anti-ESP hides each player from anyone who can't actually see them. Every few ticks Kratos traces lines of sight from the viewer's eyes, and from where the third-person camera would be, to the other player. If solid blocks cover every line, that player is removed from the viewer's client, so ESP and tracers have nothing to draw. As soon as a line of sight opens, the player is shown again. Glass, ice, leaves and barriers don't hide anyone.

Anti-ESP needs a Nemesis license that includes the Hide Entity add-on. Put that key in license.yml under hide-entity-license-key. If Nemesis is installed on the same server, Kratos reads its key automatically. Without a valid key, Anti-ESP stays off and the console says why. Hidden players stay in the tab list.

Players in spectator mode and Bedrock players always see everyone.

Alerts#

A flag shows up in chat for every staff member with alerts on. Hover an alert to see the check's detail, and click it to spectate the player.

Alerts are on at join for anyone with kratos.alerts.enable-on-join and kratos.alerts. A staff member who turns them off with /kratos alerts stays off across rejoins and restarts. Console alerts are off by default. Run /kratos alerts from console to see them there, or set alerts.print-to-console to true to keep them on.

When a player joins, alert-enabled staff get a line with a hover card showing the player's client brand, version, Kratos flag count, whether it's their first join, their country and whether they're on a VPN or proxy. Turn it off with JoinNotifier.enabled.

Flag log#

/kratosflags (or /sus) opens the last 200 flags as one head per flagged player. Filter by All, Cheating or Suspicious at the bottom of the menu.

Click a head to see that player's flags. Each entry shows the check, the verdict and the violation level. Click an entry to teleport to the player if they're online.

Staff with kratos.report see a Report False Flags button. Pick the flags that fired wrongly, add a note, and they go to the BlazeZ developers with the check's full detail. The flag log is kept in memory and clears on restart. For long-term history, turn on history.enabled or use the web panel.

Checks catalog#

/kratoschecks opens every check grouped by category. Click a category to see its checks, then click a check to edit its settings live.

Every check can be switched on or off and has violations-to-flag, decay, setback-violations, display name and description, plus whatever keys its own section in checks.yml holds. Numbers have a plus and minus stepper (shift for 10 at a time) and a type-an-exact-value option in chat. Changes are written to checks.yml.

Check list#

Checks sit in 14 categories: Combat, Aim, Movement, Elytra, Vehicle, Timer, Placement, Breaking, Inventory, Automation, Protocol, Exploit, Chat and AI. A check's name is what alerts show, the name of its section in checks.yml, and the <check> part of kratos.exempt.<check>. Experimental checks only run while experimental-checks is true.

Configs from older Kratos versions are updated on startup and keep their values.

Freeze#

When a check piles up enough violations inside its window, Kratos freezes the player in place for freeze.seconds (30). The player is dropped to solid ground first, sees a title, and a hologram floats over their head. Freezing stops cheats a check can detect but can't cancel on its own.

The global threshold is freeze.violation-threshold (30). A check with its own freeze-violations in checks.yml uses that instead, and 0 turns freezing off for that check. Without a per-check value, Kratos never freezes below the check's own violations-to-flag, so noisy checks don't freeze a player before staff ever saw an alert.

freeze.ban-on-repeat also counts freezes that would have happened while freeze.enabled is false. Checks in freeze.disabled-checks never count toward it.

Client fingerprint#

Fingerprint identifies cheat clients and mods when a player joins, from the client brand, registered plugin channels, mod loaders and a sign translation probe. All of it is set in fingerprint.yml. Bedrock players are skipped by default (skip-bedrock).

Each detection has an action. ALERT tells staff only. PUNISH also runs the enforcement tiers: enforcement.first-strike on the first offence (a kick by default) and enforcement.repeat-strike on the next (a ban by default). Strikes survive a kick and reset on restart.

The kick screen is a multi-line message built from enforcement.kick-message.

Use warn-only for mods that should never be punished, and whitelist to allow a mod for specific players. Players with kratos.fingerprint.bypass aren't punished, and staff are warned when they join with a flagged client. While a sign probe runs, the player can't open inventories (sign-probe.block-inventory).

Replay#

Kratos keeps a rolling recording of every player so staff can watch what happened. /kratosreplay opens a picker of everyone with footage. Picking a player opens a setup screen for the rewind window, playback speed, follow distance and what the replay shows.

Starting a replay spawns a body only you can see, controlled from a hotbar: rewind 10 seconds, slow down, pause, speed up, skip 10 seconds, open the subject's inventory as it was at that moment, teleport to them, and stop. Your own items come back when it ends, and you take no damage while watching.

Players within nearby-player-radius (48) of the subject appear too. Pearls, arrows, tridents and potions fly again, block edits show as ghost blocks, and attacks, deaths, chat, commands, pickups, drops and inventory clicks print as a timestamped log.

Nobody but the viewer sees a replay. When Spartan's replay module is running on the same server, Kratos doesn't record and points staff to Spartan's /replay.

Web panel#

Kratos links your server to the Kratos panel on its own, using your license key. Open it from the BlazeZ portal and every server running on your key is listed with live player counts, the flag feed, per-server analytics and a settings editor. Starting another server on the same key adds it within seconds.

Settings saved in the panel are pushed to the server and applied with a live reload. Keys that run console commands are refused, so the panel can change thresholds and toggles but can't make a server run a command.

The panel's Freeze page lists every check that can freeze, grouped by category, with a switch per check and per category. A check switched off still flags and alerts but never freezes, and anyone frozen by it is released. Changes land within a second and are stored in freeze.disabled-checks.

The panel's Replays page plays every uploaded replay in 3D, with POV, follow, orbit and free cameras, a timeline marked with flags, hitboxes and the reach line on each hit. The MP4 button saves a replay as a video file: pick the whole replay or from the playhead, a speed of 0.25x to 2x and 720p or 1080p. The video uses the current camera, hitbox and aim line settings and can show the player, flags and time on screen. It renders in your browser and needs Chrome, Edge or Safari.

cloud.enabled turns the panel link off, and cloud.server-name sets the name the server shows under.

AI analyst#

The AI analyst gives a second opinion on a flag before any automatic ban. It reads the check, violation level, check detail and client brand, then returns a verdict, a confidence score and a plain-English case file for staff. It's off by default.

Set it up in ai.yml under ai.analyst: enabled, api-key, model and base-url. It works with Anthropic and with any OpenAI-compatible provider through base-url. When confidence reaches auto-ban-confidence (90), it runs ban-command. Below that, it posts the verdict to staff (post-to-staff). If api-key holds your Kratos license key instead of an AI provider key, Kratos warns in console and keeps verdicts off until a real provider key is set.

Bedrock players#

Bedrock players are detected through Floodgate or Geyser. Any name starting with bedrock-username-prefix (.) is also treated as Bedrock, which covers servers where Geyser runs somewhere else. Bedrock players skip every Java check and are judged by a separate Bedrock engine (bedrock-checks-enabled, default true).

Floodgate or Geyser sometimes report a player as Bedrock only after login. Kratos looks again 1 and 5 seconds after join and takes such a player off the Java checks.

The Bedrock engine needs a live Geyser session. If Geyser runs on your Velocity proxy, install the same Kratos jar on the proxy too, where it loads as a Velocity plugin:

1. Copy the Kratos jar into the proxy's plugins folder.
2. Make sure Geyser-Velocity is installed on the proxy, and Floodgate on every backend Bedrock players can join.
3. Restart the proxy, then every backend running Kratos.
4. Check the proxy console for [bedrock] Bedrock protection active on the proxy. and the backend console for a relay connected line once a Bedrock player joins.

Flags from the proxy are handed to the backend the player is on, so alerts, freezes and the flag log work the same as for Java players. bedrock-relay-enabled turns the backend's relay listener off. Servers with Geyser installed locally don't need this.

The Bedrock boat check (BedrockVehicle in checks.yml, off by default) only runs where Geyser is installed on the backend. On a Geyser-on-proxy network it stays inactive.

Other options#

Ignored zones make whole worlds or WorldGuard regions check-free: no flags, alerts, setbacks or freezes. Checks keep running inside so they're ready when the player walks out. Set ignored-zones.enabled, worlds and regions. With keep-setbacks: true the zone stays enforced but silent.

Flag history stores every flag in a database when history.enabled is true. history.database.type is SQLITE, MYSQL or POSTGRESQL, and history.server-name tags rows so several servers can share one database.

Cheat review posts a daily, weekly and monthly summary of flags to the console, with totals per check and per player and the busiest hour. It needs history.enabled. Turn it on with cheat-review.enabled and pick the hour with run-hour (4).

Menu titles can be changed with gui.custom-screen-titles. Set enabled: true and edit the title of each menu: flag-log, checks, check-settings, report, replay-picker, replay-setup and replay-saved. {name} is the check or player shown in that menu.

Player messages ship in 26 languages: EN, ES, RU, DE, FR, PT, PL, TR, ZH, ID, IT, VI, NL, KO, CS, TH, HU, AR, JA, UK, SV, DA, RO, SK, HE and LT.

On Folia, lag is measured per region, and combat verdicts stop at suspicious instead of freezing or banning, because region lag is only partly observable. Staff still get every alert.

Placeholders#

Developer API#

The download has a KratosAPI jar in the Developer API folder. Add it as a compile-only dependency and never shade it. PlayerFlagEvent fires after Kratos has decided how to respond and can't be cancelled. PlayerPreFlagEvent fires before the violation is counted, and cancelling it makes Kratos act as if the check never triggered.

@EventHandler
public void onPreFlag(PlayerPreFlagEvent event) {
    if (isInMyMinigame(event.getPlayer())) {
        event.setCancelled(true);
    }
}

KratosAPI.get() gives you tracked players, check info and per-player check state, alert toggles, read-only config and the flag history. Keep PlayerPreFlagEvent listeners fast, because they run on the path that decides a flag.

Troubleshooting#

Players get kicked with a timeout moments after joining when Vulcan also runs. Set connection.other-anticheat-support to true in plugins/Vulcan/config.yml. Vulcan treats replies to Kratos's lag-compensation packets as invalid otherwise. Kratos prints this fix to the console on startup when the setting is off.

An op is never flagged. Check bypass.players and bypass.worlds, and whether bypass.exempt-permissions is true. With it on, every op matches every kratos.exempt.<check> node.

Bedrock players on a Velocity network aren't checked. Geyser runs on the proxy, so install Kratos there as described in Bedrock players.