SunshineCommandGuard

SunshineCommandGuard
Command Visibility & Security for Paper & Folia Servers
Hide commands from tab-complete, block unauthorized execution, and keep your server's plugin stack private — all with per-group rules and tools that explain exactly why a command is visible, hidden, allowed, or blocked.
Minecraft servers often expose far more command information than players actually need. Plugin commands, administrative tools, aliases, and namespaced commands can appear through tab-complete or commands such as /plugins and /version.
SunshineCommandGuard gives server owners direct control over that visibility without requiring you to redesign your existing permission setup.
Features

• Tab-complete filtering — control which commands players can discover through command suggestions (PlayerCommandSendEvent).
• Execution blocking — commands outside a player's allowed rules are rejected as unknown commands with a customizable message.
• Server privacy protection — protect commands such as /plugins, /pl, /ver, /version, /about, and /? help aliases.
• Anti-enumeration shield — hides namespaced command labels, blocks direct namespaced execution, and blocks client-side completion scanner probes.
• Per-group profiles — define different command policies for different LuckPerms groups (sunshine.cmdguard.group.<name>), including priority and inheritance behavior.
• LuckPerms synchronization — online group and permission changes are reflected automatically without requiring players to reconnect.
• Flexible matching — literal commands, regex: patterns, negative !entries (deny always wins), and plugin:<Name> expansion.
• Namespace-aware security — plugins, bukkit:plugins, and minecraft:plugins remain distinct security-sensitive command tokens. Temporary grants do not accidentally expose namespaced variants.
• Hidden aliases — keep commands runnable while removing them from tab-complete.
• Argument-level rules (Enforced on Execution in 2.0) — create per-command argument allow/deny rules. For example, allow /gamemode survival while rejecting /gamemode creative in both tab-complete and execution (including namespaced forms and /execute ... run).
• Live Web Command Editor (2.0) — run /cmdguard editor to upload your server's registered commands and current config.yml to sunshine-mc.net/en/cmdguard/, toggle commands per group in your browser, and apply changes live with /cmdguard apply <code> (includes a 3-day free trial per server + free manual YAML export forever; unlimited live apply is unlocked with a Pro key). Your pro-key and Discord webhook URL are never uploaded.
• Interactive setup & auto-generation — run /cmdguard setup for a guided in-chat wizard, or /cmdguard generate to scan your installed plugins into a reviewable starter config.
• One-command migration (2.0) — run /cmdguard import commandwhitelist to convert an existing CommandWhitelist configuration into config.imported.yml.
• Live verification & self-diagnosis — /cmdguard test <player> <command> [args] explains the resolved group, matching rule, and argument verdict; /cmdguard diagnose [player] checks for common setup mistakes and prints live visible command counts.
• Temporary grants & per-world groups — grant temporary command access with /cmdguard grant <player> <command> <30s|10m|2h|1d> and scope groups to specific worlds.
• Block monitoring & Discord alerts (2.0) — log blocked attempts, notify online staff, and optionally post rate-limited security alerts to a Discord webhook (monitoring.discord).
• PlaceholderAPI & Folia support (2.0) — built-in placeholders (%cmdguard_group%, %cmdguard_visible%, %cmdguard_filter%) and native Folia entity scheduling in the same JAR.
• Safe-by-default configuration — CommandGuard ships disabled so you can verify your rules before enabling filtering on a live server.
• Update notifications — CommandGuard can check GitHub Releases and notify the console and administrators when a newer version is available. Updates are never downloaded or installed automatically.
• bStats metrics — included and relocated to avoid conflicts with other plugins.

Screenshots
All screenshots below were taken on a live production server.
Allowed — a whitelisted command completes normally.

Hidden — the command does not appear in the player's normal tab-complete suggestions while remaining runnable when your rules allow it.

Blocked — a command outside the player's allowed rules is rejected as an unknown command.

Server privacy — /plugins returns your configured response instead of exposing the real plugin list.

Requirements

• Paper, Folia, or a compatible Paper fork (1.21.x through 26.x)
• Java 21 or newer
• LuckPerms is optional (without LuckPerms, players fall back to the configured default group)
• PlaceholderAPI is optional

Players with the bypass permission or OP status skip filtering, so always test your setup with a non-OP account.
Installation

1. Download SunshineCommandGuard-2.0.1.jar.
2. Place it inside your server's plugins/ folder.
3. Start the server once to generate the default configuration.
4. Configure your rules using one of the following:
   • Run /cmdguard editor to configure commands visually in the Live Web Studio and apply with /cmdguard apply <code>
   • Run /cmdguard setup in-game for the interactive setup wizard
   • Run /cmdguard import commandwhitelist if migrating from CommandWhitelist
   • Or edit plugins/SunshineCommandGuard/config.yml directly
5. Test your rules before enabling them:
   
   Code (Text):

   /cmdguard test <player> <command>
6. Then enable the plugin in config.yml:
   
   Code (Text):

   enabled: true
7. And reload:
   
   Code (Text):

   /cmdguard reload

Important
A badly configured command filter can leave players with few or no visible commands. For this reason, SunshineCommandGuard ships with:
Always verify your default group with a non-OP test account before enabling filtering.
Configuration Example
Update Notifications
By default, CommandGuard can check the official GitHub Releases page for newer versions:
When a newer release is available, the console and authorized administrators receive a notification.
SunshineCommandGuard never automatically downloads, replaces, or installs plugin updates. Disabling updates.enabled disables the external update check entirely.
More Information

• Live Web Command Studio & Config Builder: https://sunshine-mc.net/en/cmdguard/
• Full configuration reference, FAQ, source code, and releases: GitHub — SunshineCommandGuard
• Velocity Proxy Network Module: Available in SunshineCommandGuard Pro

License
GPL-3.0
Derivative works must remain open source under the terms of the license.
Issues and pull requests are welcome.