Zenith AntiCheat Lite

What is Zenith Lite?
Zenith Lite is the free core edition of Zenith AntiCheat. It runs Zenith's own packet pipeline and player model with the checks that protect competitive crystal and anchor PvP, and the packet stream itself. It is built to catch the cheats that ruin crystal PvP, without flagging your legit players.

Checks

• CrystalAura (IdPrediction, MultiPlace, InstantInteract, SwapAfterAction, AttackAfterUse)
  Catches crystal "ID predict", several placements in one client tick, using a block placed earlier in the same tick, hotbar swaps after an action within a tick, and "place then break" zero-tick crystal auras.
• AnchorAura (AnchorChain)
  Catches respawn anchors placed, charged and detonated faster than any vanilla client can, repeatedly. Every click is replayed through the server's own anchor rules, so off-hand glowstone play is never misread.
• AutoTotem (Reaction, InstantSession, TotemAfterAction; HealthReaction is opt-in)
  Catches offhand totem refills faster than human reaction after a pop, measured in client ticks.
• Timer (Timer, Blink, MultiMove)
  Catches a fast client clock (ping-anchored, so lag and jitter don't trip it), withheld movement, and extra position packets per tick.
• Inventory (Move, Sprint, ActionWhileOpen)
  Catches moving, sprinting, attacking, placing or mining while a container screen is open.

Built to avoid false flags

• Each rule catches either something a vanilla client cannot do, or a timing beyond human reaction that must repeat before it flags.
• Checks are measured in client ticks, not milliseconds, so ping and lag spikes can't shorten or stretch what they judge.
• Rules that depend on how the client orders its actions only judge client versions they were verified against.
• Anything a player can anticipate (like damage from their own crystal) is off by default.
• Bedrock players (Geyser/Floodgate) are recognised and never judged by Java-client checks.

Performance

• Everything runs on the connection's own Netty thread, never the main thread.
• The steady state allocates nothing per packet. Each packet is decoded once, and single fields are read straight from the buffer.
• Each check is called only for the packets it cares about.
• Alerts and the flag log run on their own thread.

Requirements

• Paper 26.2 (or a Paper fork like Purpur), Java 25
• PacketEvents 2.13.0 or newer, installed as a plugin

Does not run on Spigot, CraftBukkit or Folia.

Installation

1. Put packetevents-spigot and ZenithLite-1.1.0.jar in your plugins folder.
2. Start the server.
3. Edit plugins/ZenithLite/config.yml. Every option is explained in the file.

Commands & Permissions

• /zenithlite status (/zl): tracked players, alert recipients and running checks
• /zenithlite alerts: toggle staff alerts for yourself
• zenith.alerts (default: op): receive alerts and use the commands

Hover over an alert to see what the check measured, plus the player's ping and jitter. Set alerts.flag-log: true to keep every flag in flags.log.

Want the full suite?
Zenith Premium adds sub-tick combat analysis (reach, hitbox, aim and ghost-client detection), full movement, velocity, elytra and vehicle simulation, mace checks, native Anti-ESP and Anti-XRay, punishments, a control panel, Discord alerts and MySQL telemetry.