Minecraft-Discord Protect

A server-side Discord MFA and account registration bridge for NeoForge, featuring proxy compatibility, personal IP banning, and staff maintenance mode.

About mcdsp

mcdsp is a server-side security mod for NeoForge (DEDICATED SERVER ONLY) designed to secure user accounts. By utilizing Minecraft's modern network Configuration Phase, the mod prevents unauthorized connections by requiring users to approve login attempts directly through Discord Private Messages (DMs).

Key Features

• Multi-Factor Authentication (MFA): Integrates into the Minecraft configuration flow. Upon connecting, registered players receive a Discord DM with "Allow Entry" and "Deny Entry" buttons.
• Personal IP Management: If a suspicious login occurs, players can block that specific IP address from accessing their account using the "Ban IP" button, without affecting global network access.
• Closed Whitelist / Managed Registration: Toggle between public registration and "trusted-only" Discord registration.
• MFA Spam Cooldowns: Built-in rate limits prevent automated "MFA Prompt Bombing" (spamming connection requests to force a user response).
• Administrative Suite: In-game maintenance mode and global IP banning tools manageable via Slash Commands.

Command Documentation

Player Commands (Discord Slash Commands)

• /register <nickname> — Links your Minecraft account to your Discord ID.
• /unregister <nickname> — Unlinks your Minecraft account.
• /register-list — Lists all Minecraft accounts registered to your Discord ID.
• /banned-ips — Displays IP addresses you have personally banned from your accounts.
• /unban-ip <ip> — Unbans a previously blocked IP from your accounts.
• /kick-account <nickname> [ban_ip: true/false] — Forces a connection drop for your Minecraft account if someone is on it, with an option to block their IP.

Staff Commands (Discord Slash Commands)

(Restricted to Discord IDs listed in the Config under moderator_discord_ids)

• /mcdsp toggle — Toggles registration between "open to everyone" and "trusted Discord users only".
• /mcdsp limit <value> — Sets the maximum number of accounts a Discord user can link.
• /mcdsp timeout <seconds> — Adjusts the expiration timer for Discord verification prompts.
• /mcdsp cooldown <seconds> — Configures rate-limiting delays between login attempts from the same IP/User.
• /mcdsp maintenance <true/false> — Toggles server maintenance mode (only staff can join).
• /mcdsp ipban <ip> — Drops connections globally from this IP address.
• /mcdsp ipunban <ip> — Removes a global IP ban.
• /mcdsp iplist — Lists all globally banned IP addresses.

Installation & Setup

1. Place the mod jar file in your server's mods folder. It is server-side only; players do not need to install it.
2. Run the server once to generate config/mcdsp-common.toml.
3. Create a Discord Bot via the Discord Developer Portal. Ensure you enable the Gateway Intents for Guild Messages and Message Content.
4. Retrieve your bot token and paste it into the configuration file (or set the environment variable MCDSP_TOKEN).
5. Populate the moderator_discord_ids list with your staff's Discord IDs.

Guarantees & Limitations (Disclaimer)

What the Mod Guarantees:

• Account Ownership Verification: Unregistered players are systematically blocked from joining. Registered players must approve their login via Discord before they can enter the game.
• Session Hijack Defense: Even if an attacker steals a player's active Minecraft session token (online or offline mode), they cannot join the server without access to the victim's Discord DMs.
• Proxy-Friendly Security: Because verification tasks run during the standard Minecraft Configuration Phase (after the handshake), the mod natively supports proxy setups (Velocity, BungeeCord, HAProxy) out of the box, as long as IP forwarding is correctly enabled in your server and proxy settings.
• Account-Specific IP Quarantine: Players can safely block attacker IPs without interrupting the connections of other legitimate players using the same VPNs.

What the Mod Does NOT Guarantee (Limitations):

• Client-Side Security: This mod runs entirely on the server. It does not detect or prevent client-side modifications, cheats (e.g., Fly, X-Ray, KillAura), or exploit packages. You still need a standard Anti-Cheat.
• Protection against Discord Compromise: If a player's Discord token is stolen (via Discord malware/grabbers) or if they are tricked via social engineering into clicking "Allow Entry", the mod cannot prevent the intrusion.
• High Performance under Extreme Load: The storage utilizes flat JSON files. Under exceptionally heavy player registration waves or large databases (thousands of accounts), disk writes may bottleneck. It is recommended for small to medium-sized servers.
• Discord API Availability: If Discord services are down or the Bot gets rate-limited by Discord, players will not be able to complete MFA prompts and will time out.