KellyMaster — Advanced Anti-ForceOP & Operator Verification System

What is KellyMaster?

KellyMaster is the most complete operator protection system for Minecraft servers.

When a player receives OP, they are instantly frozen and must verify their identity with a one-time code sent to their Email, Discord DM, or Telegram. Until they enter the correct code, they cannot move, chat, interact, open inventory, execute commands, or even see other players in the TAB list.

If someone who is NOT in your operator whitelist gains OP through exploits, backdoor plugins, or any method, KellyMaster instantly removes their OP and applies the configured sanction (ban, kick, or deop). All authorized operators receive real-time alerts.

No verification code = No OP access. Period.


Why KellyMaster?

• Servers get compromised daily through ForceOP exploits, backdoor plugins, and permission escalation
• A single unauthorized operator can destroy months of work in seconds
• Traditional security plugins only block commands — KellyMaster verifies identity
• Even if an attacker gets OP, they are completely useless without the verification code
• Works on offline-mode, online-mode, and proxy networks with UUID-based anti-spoofing

Features

Multi-Layer ForceOP Protection

KellyMaster uses multiple independent detection layers that catch unauthorized operators through different mechanisms. Even if one layer is bypassed, the others provide backup protection with near-zero detection delay.

• Intercepts /op commands before they execute — blocks unauthorized attempts outright
• Detects OP granted via plugins, APIs, ops.json edits, or any other method
• Namespace-aware blocking — catches /op essentials op and more
• UUID + name dual authentication prevents identity spoofing
• Monitors dangerous permissions via LuckPerms integration

Multi-Channel Verification

Each operator chooses their preferred verification method:

• Email (SMTP) — Works with Gmail, Outlook, Yahoo, or any SMTP provider. Professional HTML templates.
• Discord DM — Sends verification codes as rich embeds directly to the operator's Discord.
• Telegram — Sends codes via Telegram bot. Auto-detects Chat ID with /start command.

Different operators on the same server can use different methods.

Complete Freeze System

During verification, operators are fully isolated:

• Cannot move (head rotation allowed)
• Cannot chat or execute any command except /kellymaster <code>
• Cannot interact with blocks, entities, armor stands, or NPCs
• Cannot open inventory — force-closed if somehow opened
• Cannot drop items, break blocks, or place blocks
• Cannot take or deal damage (PvP and PvE blocked)
• Cannot see other players in the TAB list — isolated until verified
• Countdown timer with actionbar display and title warnings at 30s, 15s, 10s, 5s
• Auto-kick on timeout or too many failed attempts

Discord Webhook Alerts

Real-time security alerts sent to your Discord channel:

• Unauthorized OP detected — player name, IP, geolocation, ISP, action taken
• Blocked command attempted — who tried what, with full location data
• Rich embed format with color-coded severity

LuckPerms Integration

• Monitors permission changes in real-time via LuckPerms event bus
• Detects dangerous permissions: *, essentials.*, luckperms.*, minecraft.command.op
• Recursive group scanning with cycle detection
• Automatically removes dangerous permissions, bans the player, and alerts all operators

Command Blocking

• /op, /deop, /stop, /reload, /restart — blocked for all players
• Fully customizable — add any command to the blocked list
• Namespace-aware — strips any prefix before matching

Plugin Self-Defense

• Blocks PlugMan, ServerUtils, PluginsManager and other tools from unloading KellyMaster
• Blocks /reload and /rl from both players and console
• Runtime integrity monitoring detects tampering
• Automatic emergency deop if the plugin is disabled externally

Compatibility

• Paper: 1.17.1 — 1.21.x+
• Folia: All versions
• Spigot: 1.17.1+
• Java: 17+
• Optional: LuckPerms (for permission monitoring)

Performance

• Zero TPS impact — all network operations run on background threads
• Less than 0.05% of a single tick used by the monitoring system
• ~15MB RAM without Discord, ~60MB with Discord bot active
• Works on servers with as little as 2GB RAM

Commands

• /kellymaster <code> — Enter verification code (Permission: kellymaster.verify, OP only)
• /kellymaster reload — Reload configuration (Console only)

Configuration

Three files are generated on first startup:

config.yml — Verification timeout, code length, deop on disconnect, blocked commands, webhook settings, SMTP email configuration, notification language (EN/ES/RU/ZH/PT).

whitelist.yml — Discord and Telegram bot tokens, verification method per operator (Gmail/Discord/Telegram), authorized operators with contact info, ban message template.

messages.yml — All in-game messages fully customizable with & color codes and &#RRGGBB hex colors. Titles, subtitles, actionbar, kick messages, chat messages with placeholders.


How It Works


Installation

1. Download KellyMaster.jar
2. Place it in your server's plugins/ folder
3. Start or restart the server
4. Edit the configuration files in plugins/KellyMaster/
5. Restart the server to apply changes

Support

• Website: ko-fi.com/srcodexstudio
• Updates: Weekly security patches