Raven Anticheat

Commands
Permissions
raven.bypass is meant for admins/testers building on the server, not general staff — anyone with it is fully invisible to every check.
The GUI
/ac gui opens a 3-page menu:

• Main Menu — jump to Checks or Punishments, plus a one-click Auto-Punish master switch
• Checks page — left-click a check to enable/disable it, right-click to cycle its sensitivity between Lenient / Normal / Strict (this scales the check's violation threshold live — no restart needed)
• Punishments page — toggle the punishment system on/off, and edit each of the 4 escalation stages: left-click cycles the action (Warn → Kick → Temp-ban → Ban), right-click adjusts temp-ban duration in 5-minute steps (shift-right to decrease)

The Checks
Fly — flags sustained hovering that isn't explained by any legitimate cause. Exempts: creative/spectator, /fly, elytra (plus a 1s grace window right after closing your wings), vehicles, swimming, Levitation, Slow Falling, and a short grace period after any teleport/knockback/damage.
Speed — computes an expected speed ceiling from sprinting, Speed potion tiers, and ice, then only flags real excess over that with a generous tolerance multiplier.
Scaffold — scores four independent signals (fast placement rate, unnaturally consistent rotation, not sneaking + not looking down, high movement speed) and only flags when at least 3 of the 4 line up together. A legitimate fast bridger who does even one of those things normally (glances down, sneaks at an edge, has natural timing jitter) stays clean.
NoFall — tracks real fall distance and expects fall damage on any drop over 3 blocks. Exempts elytra/gliding at any point in the fall, Slow Falling, Feather Falling boots at any level, and landing in water, lava, slime, cobweb, hay bales, vines, ladders, scaffolding, powder snow, sweet berry bush, and big dripleaf — covers essentially every legitimate MLG.
Reach — pure distance check with generous latency slack on top of vanilla's ~3-block survival reach.
Hitbox — ray-traces the attacker's exact look vector against the target's real (padded) bounding box, catching hits that shouldn't register even when reach and angle look fine on their own.
Aim — three independent, differently-triggered modes:

• Snap-aim — a near-instant large rotation jump right at the moment of an attack
• Constant-tracking — near-zero aim error sustained on a moving target for almost a full second (staring at something stationary never counts)
• Blatant — raw single-tick rotation speed that's not achievable with a mouse, regardless of context

Velocity — reads the actual outgoing knockback packet the server sends (not an estimate) and checks whether the player's real movement matches it. Also tracks a damage_resistance pattern: several consecutive hits where knockback is reduced to almost nothing, distinct from ordinary lag-driven partial reduction.
BadPackets — catches non-finite/NaN packet values, out-of-range pitch, and sustained (not single-burst) packet-rate anomalies indicating timer hacks. Explicitly designed to ignore normal post-lag-spike packet bursts.
Automatic Punishment System
Every confirmed violation (already past each check's own filtering above) adds to a persistent offense counter per player, stored in punishments.yml — survives relogs and server restarts. The default ladder:
The whole system is gated behind one master switch ( punishments.enabled, default false). While it's off, offenses are still silently counted and viewable via /ac offenses <player>, so you can watch how the system would behave before ever punishing anyone. Bans go through Bukkit's own ban list, so they show up in /banlist and interoperate with anything else reading it.
Recommended Setup

1. Install and leave punishments.enabled: false
2. Play normally / have staff play normally for a few sessions with raven.notify on, watching for any flags on legitimate play
3. Adjust sensitivity per-check from the GUI if anything trips that shouldn't
4. Once satisfied, flip Auto-Punish on from the main menu

Config Reference
Known Limitations

• Ban storage uses Bukkit's built-in name-based ban list, not a UUID-based ban system
• Packet field indices in the ProtocolLib listener target 1.20.4-era mappings — a major Minecraft/ProtocolLib version bump may require re-checking those indices
• No web-based dashboard or cross-server sync (single-server, standalone by design)