Home›Java›Mods›NexusCore Mod (NCM)

ModsJava

NexusCore Mod (NCM)

NexusCore Mod (NCM), developed by MWT Studios, is an all-in-one NeoForge, Forge, & Fabric server administration framework for Minecraft Java Edition…

⬇ Download on Modrinth

Open in MCModsHub Get it on Google Play →

NexusCore Administration Framework

Server administration for Minecraft Java Edition 1.21.1 — permissions, moderation, teleportation, player tools and a tamper-evident audit log, in one mod.

Free, and staying free. No paid tier, no premium build, nothing held back.

No plugin loader. No other administration mod. No database. No client mod.

Install the JAR on your dedicated server. Players join with a completely unmodified vanilla client — including the admin panel, which renders as an ordinary chest menu.

Compatibility


Minecraft	1.21.1
Java	21 or newer
NeoForge	21.1.235 or newer
Fabric	Loader 0.19.3+ with Fabric API
Forge	52.1.16 or newer
Side	Server-side only

One codebase builds all three loaders, and every release is verified on all three before it ships.

What it does

🔑 Permissions

Groups with multiple inheritance, wildcards and explicit denies. The check command explains its answer — which group granted or denied a node, and why — instead of returning a bare yes or no.

⚔️ Moderation

/kick /ban /tempban /unban /mute /unmute /warn /warnings /banlist. Punishments are never deleted. Lifting one stamps who lifted it and when, so history stays intact.

Ban screens are full-screen and styled, with a live countdown and a configurable appeal line.

🧭 Teleportation

Homes, warps, spawn, /back (including back to where you died), /tpa, and staff /tp. Destination safety is checked for real — an unsafe teleport is refused with a reason rather than dropping you somewhere approximately correct.

🧰 Player utilities

/heal /feed /fly /god /speed /vanish /playerinfo /seen /list /near.

📜 Tamper-evident audit log

Append-only and SHA-256 hash-chained, so tampering is detectable rather than merely discouraged. IPs, passwords and tokens are redacted as they are written, not afterwards.

🖥️ In-game admin panel

A dashboard, paginated player list, per-player actions, moderation and permission overviews, and server diagnostics — rendered as a vanilla chest menu. Permission is re-checked on every single click, not just when the menu opens.

🔁 Vanilla command takeover

NexusCore owns the vanilla commands it replaces (/ban /kick /banlist /pardon /list /tp /teleport /gamemode), so the command your staff already type gains a duration, a reason, history and an audit record. Set overrideVanillaCommands=false to opt out entirely.

🛡️ Safe mode

Start with -Dnexuscore.safemode=true to boot core modules only and recover a server you otherwise cannot start. Vanilla's moderation commands stay available throughout — safe mode will never leave you unable to kick a griefer.

Honest status

This project publishes its unfixed defects rather than hiding them.

Verified at v1.1.0: 214 automated tests, 0 failures. Eight runtime runs — normal and safe mode on each of NeoForge, Fabric and Forge — with zero NexusCore errors and the audit chain intact after every run. A real player exercised most of the feature set on a real dedicated server.

Fixed in v1.1.0 — the security defects closed in this version: /execute as <player> can no longer borrow another player's NexusCore permissions (a substituted command source is refused and the audit names the real issuer), the sign and lectern confused-deputy paths the same fix closed, two permission values that failed open, and permissions.json never being re-read.

Known issues at v1.1.0 — please read before deploying. This is every High and Medium defect in the project's own list, not a selection:

High — /seen <unknown name> can stall the server. IdentityService.resolve() falls back to a blocking Mojang HTTP lookup on the server thread, so a slow or unreachable Mojang API stalls the whole server for as long as the request takes. Reachable by any ordinary player. First item scheduled for 1.1.1.
Medium — Vanish misbehaves for onlookers. Four related faults that appear only on another player's client: chat renders as a validation error, un-vanishing does not restore the entity for clients that saw it vanish, vanish is not re-applied to players who join later, and the vanished set survives death while the invisibility flag does not.
Medium — A second ban or mute does not deactivate the first. /unban lifts one and reports success while the player stays banned; active counts double-count, and the strictest record is not the one returned.
Medium — audit.log never rotates. It is read fully into heap and SHA-256'd on the server thread at startup, at shutdown, and on every verify and tail — unbounded growth plus a synchronous full read.
Medium — A transient read error can quarantine an intact permissions.json. JsonStore.read() quarantines on any IOException, so a one-off read failure moves a healthy file aside and the next boot starts from defaults.
Medium — config.json silently loses operator keys. Loading rewrites the file from the typed object, deleting any key the schema does not know, while reporting no problems found.
Medium — players.json is rewritten in full on every login and logout. Never pruned, and each write copies a full .bak and fsyncs twice.
Medium — Fabric death messages lose their cause. Every styled death reads <Player> died — on Fabric only.
Medium — /pardon and /banlist strand vanilla ban state. Pre-takeover vanilla bans become un-liftable, and /ban-ip and /pardon-ip are separate commands NexusCore never takes over, so IP bans are neither audited nor listed.
Only one player has ever been online at a time during testing. Everything that needs a second player is unverified — including the four vanish faults above, which appear only on another player's client.

The remaining 13 are Low severity and are published in IMPLEMENTATION_STATUS.md rather than withheld.

Not built, and not promised: economy, chat channels, jail and reports, scheduler, backups, the benchmark harness, and a custom-screen client GUI.

The authoritative record is IMPLEMENTATION_STATUS.md, which distinguishes implemented from tested deliberately. Read it before trusting any feature list, including this one.

Documentation

Command reference — all 50 commands, generated from the code so the docs cannot drift
Permissions guide
Admin panel guide
Changelog · Release notes
Security policy — report vulnerabilities privately, never in a public issue

Explore more

All Mods for Java All Minecraft Java mods Java mods for 1.21