MikeyAC.
Most anticheats guess whether a movement was possible. MikeyAC asks the client to prove two things instead: that it is a genuine build on the connection it is playing on, and what physically pressed each click.
Attestation: the client proves it is the real mod
On join, the mod and the server agree a session key from the mod's own per-server build secret. The server then asks it questions at random moments, and one of the answers it has to include is a rolling hash of every movement packet it has sent. A fake client built to answer those questions still has to be on the same connection the player is playing on — answering from beside the game does not produce that hash.
- Each customer gets their own build secret, so a secret extracted from one jar costs one server a rotation and nobody else anything.
- While rolling the mod out, monitor mode only alerts. Required mode kicks players who cannot attest.
- A lost chain agreement — a corrected join, a version-translating proxy — is restarted rather than held against the player.
Input attestation: what pressed it
For every attack, use, drop and hotbar change, the mod reports what caused it: a mouse button, a key, the scroll wheel, the game itself, or nothing at all. The server pairs those reports with the action packets it actually received, in order. A macro mod that calls the game's attack or slot change directly produces no input event, so it reports itself on the first swap.
That is how it caught a real injected cheat on the first hotbar swap, where a timing rule needed 222 of them across a minute. For an attack the mod also reports the distance it measured from its own eye to the target, and the server compares that with its own lag-compensated measurement: a report that disagrees is a report that was forged.
What it runs on
- Server: Paper 26.x on Java 25, with packetevents. One jar in plugins/.
- Players: Fabric, Minecraft 26.x or 1.21.11+. One jar in mods/, from a link you give them.
- A 1.21.x player can join a 26.x server through ViaVersion and still attest.
- Your console lists your servers, every player they have seen with a suspicion level that decays on its own, and every event behind it.
What it does not do
Nothing here bans anyone on its own. Kicks and setbacks are off until you turn them on, and everything the client reports is a staff alert. A mod jar's secret can be read by anyone determined enough, so the honest claim is that this makes a working fake client expensive and a macro beside an honest client obvious — not that it is unbreakable.