Client Inspector for Fabric

Client Inspector is a server-side Fabric mod for Minecraft 1.21.11 that fingerprints every joining client and alerts, kicks or bans by rules you control. Nothing is required on the client: vanilla players join as usual, modded players are inspected on the way in. Players who also put the same jar in their client report their full mod list while joining, and a server can make that mandatory.

Not related to the Forge mod "Client Inspector" by Aquerr: this is a separate Fabric project that happens to share the name.

It answers the one question Grim and the other behaviour anticheats do not: what client is this player actually running?

What it looks at

Every client leaks three things to the server without any companion mod:

1. Brand – the string sent during the configuration phase (vanilla, fabric, lunarclient:...,fabric).
2. Plugin channels – Fabric API tells the server every channel the client’s mods can receive. The namespace is usually the mod id, so Lunar, Feather, LabyMod, Xaero’s, Simple Voice Chat and friends identify themselves here.
3. Translation keys and key bindings – the sign probe (MC-265322). A few seconds after join the server shows the client an invisible sign whose lines are translatable or keybind components, opens and closes the sign editor in the same tick, and reads the reply. A client that has a mod’s language file sends back the translation; a client that registered the key binding sends back the bound key; vanilla sends back the raw id.

Everything observed is kept per player and shown with /clientinspector profile <name>, even after they left.

What it catches

• Meteor Client out of the box, plus the Meteor+ and Meteorist addons (probe).
• ThunderHack Recode and Reborn (probe).
• Freecam, SeedcrackerX, Advanced XRay, X to Xray – shipped as alert-only DISALLOWED rules; promote them to KICK if you ban them.
• Spoofed brands: LiquidBounce’s and ThunderHack’s Lunar spoof modes send hard-coded version strings no real client sends; a vanilla brand next to Fabric channels is a lie.
• Translation filters (ExploitPreventer, OpSec in manual whitelist mode) via canary keys that must resolve on a client whose channels prove the mod is installed.
• Legit clients (Lunar, Feather, LabyMod, Badlion, Essential, Replay Mod, Xaero’s, Simple Voice Chat) are recognised and only logged.

What it does not catch

Read this before relying on it.

• Every Fabric hack client registers no plugin channels and keeps the brand fabric. Brand plus channels alone cannot tell them from an honest Fabric player; the probe is the detection.
• Wurst (7.44+) and LiquidBounce keep their strings outside the vanilla language system. Aoba, Shoreline, schizoid, Baritone, BleachHack and most Meteor addons ship no language file. The probe cannot see any of them.
• OpSec in its default AUTO mode whitelists every mod that registers channels, which is exactly the evidence the canaries rely on, so its users still hide Meteor. Nothing passive beats a hider configured that way; the client part does, for players who install it.
• Anyone can recompile a client to lie. Client Inspector stops the unsuspecting, not the determined. Keep Grim for behaviour.

Client part (optional)

The same jar also works on the client. A player who puts it in their client’s mods/ folder, next to Fabric API, reports their mod list while joining: every mod Fabric Loader loaded, with its version and the SHA-256 of its jar. The list comes from Fabric Loader itself, so OpSec and the other translation filters cannot hide anything from it. Meteor behind OpSec AUTO, invisible to the probe, shows up as meteor-client and is kicked by the reported-hack rule before the world loads.

• The server asks only clients that have the jar (they register its channel); everyone else is not asked and not held up.
• The client hashes its jars once at startup in the background, writes one log line and has no settings or screens. On servers without Client Inspector it sends nothing, and singleplayer and LAN worlds are never inspected.
• The server cross-checks the report against the probe. A report that leaves out a mod the probe just proved, or leaves out Fabric API, is marked MISMATCH and the companion-mismatch rule kicks.

Modes (companion.mode, or /clientinspector companion <mode>): off; optional (default: clients with the jar report, everyone may join); required (clients without the jar are refused before they reach the world, with a message that says where to download it; operators, bypass holders and Geyser players are exempt).

What it cannot do:

• In optional mode it only covers players who chose to install it, and a cheater simply does not. required is the only mode that affects players who refuse to install it.
• required also refuses vanilla, Lunar, Forge and every other client that cannot load a Fabric mod: right for a private Fabric server whose players you know, wrong for a public one.
• The report is put together by the client, and a modified copy of the client part can send any list it likes. The cross-check catches a forged list only when the probe can see the hidden mod. Treat it as a strong deterrent among people you know, not as proof.

Install

1. Fabric Loader 0.18.4+ and Fabric API for 1.21.11 in the server’s mods/ folder.
2. Drop the Client Inspector jar next to them. LuckPerms is optional but recommended.
3. Start the server once; config/clientinspector/config.json and config/clientinspector/rules.json are created.
4. Give staff clientinspector.alerts (op level 2 by default) and yourself clientinspector.admin.

Set monitor_only to true for the first days: kicks and bans are then reported as not enforced so you can read the alerts before letting it act.

For the client part, players put the same jar in their client’s mods/ folder next to Fabric API. Upgrading from 0.1.x: replace the jar and restart; rules.json gets the new default rules once and keeps your own edits.

Commands (clientinspector.admin)

• /clientinspector – rule count, probe state, tracked connections; /ci is a short alias for every subcommand
• /clientinspector online – one line per player: brand, channel count, probe result, matches, and whether the client part reported
• /clientinspector profile <name> – everything observed for a player, online or not, including the reported mod list
• /clientinspector probe <player> [selftest] – re-run the probe; selftest adds a vanilla key that proves the probe works on your server
• /clientinspector rules – the loaded rules with category, confidence and actions
• /clientinspector alerts on|off – mute in-game alerts for yourself
• /clientinspector companion [off|optional|required] – show or set the client part mode
• /clientinspector reload – re-read both config files

Permissions: clientinspector.admin, clientinspector.alerts, clientinspector.bypass (never kicked or banned). Operators are exempt from kicks and bans automatically.

Rules

config/clientinspector/rules.json is a JSON array. Conditions: brand (regex), channels_any, channels_all, channels_none, no_channels, translation_keys, keybind_keys, probe_state, and for the client part reported_mods_any (ids or globs) and companion_state. Actions: LOG, ALERT, WEBHOOK (Discord embed), COMMAND, BAN, KICK. Placeholders %player%, %uuid%, %rule%, %client%, %brand%, %reported%, %confidence%, %category% work in messages and commands. The defaults kick only on high-confidence HACK and SPOOF matches; everything else alerts.

Where the fingerprints come from

Every default rule is backed by the client’s own source or language file, read at the commits listed in the repository changelog. Channel and translation-key names are observable facts; no code or configuration from other anticheats is included.

Source and issues: https://github.com/RpYTMc/ClientInspector