CrossplayShield: anti-exploit for Geyser cross-play servers

CrossplayShield: anti-exploit for Geyser cross-play servers

PACKET LIMITERS KICK YOUR BEDROCK PLAYERS

Geyser turns some Bedrock actions into bursts of Java packets: moving a stack is several clicks, and sleeping in a bed can send hundreds of packets per second (Geyser issue #6775). Packet limiters tuned for Java clients see an attack and kick the Bedrock player.

CrossplayShield limits packets per type, gives Bedrock players (detected by Floodgate) a wider margin, and only adds what Paper does not already do. It works out of the box.

MEASURED, NOT GUESSED

Peak rates over one second, measured with test bots on Paper 26.3, Folia 26.3 and Paper 1.21.11:

• Inventory clicks: Bedrock player emptying an inventory into a chest 54/s, Java player with an inventory sorting mod 108/s. Limit: 162 (Java), 486 (Bedrock)
• Block breaking: 6/s. Limit: 60 (Java), 180 (Bedrock)
• Block placing: 5/s. Limit: 40 (Java), 120 (Bedrock) Walking, sleeping, chests, building and mining: no packet blocked, no kick, on all three servers.

WHAT IT DOES

• Packet limits per type (inventory clicks, creative inventory, books, signs, anvil renames, plugin messages, bundles, block breaking and placing). Packets up to the limit go through; only the extra ones are dropped. A player is kicked only after 5 seconds at more than twice the limit.
• Creative item cleanup: enchantments above vanilla brought back to their maximum, names and lore cut, attribute modifiers removed, containers nested in containers emptied, oversized items replaced.
• Chunk limits: items on the ground, written books and heavy shulker boxes stored in the containers of a chunk. Nothing already there is removed.
• Command filter: /plugin:command forms (refused and hidden from autocompletion), your own regular expressions, maximum length.
• /cs audit: your Paper settings (packet limiter, spam limiter, item validation, duplication settings), ViaVersion's packet limiter (which can kick sleeping Bedrock players) and Floodgate, with the line to change for each problem.
• Alerts in game (toggled per staff member) and on Discord (webhook, with spam protection).
• Dry-run mode, temporary exemption, per-player packet rates.
• Developer API: a cancellable event before each block.
• Lightweight: about 2 microseconds per packet with 10 Bedrock players in our benchmark (Paper 26.3).
• Every protection can be set to block or log only; packet limits, creative items and commands can also kick. English and French, editable texts.

REQUIREMENTS

• Paper or Folia 1.21.4 to 26.x, Java 21+
• PacketEvents 2.14+
• Optional: Floodgate, to give Bedrock players their wider margin

WHAT YOU GET

The plugin jar and free updates: new versions are uploaded to this product and you can download them again from your purchase email at any time.

SUPPORT

• Documentation: https://github.com/TheMax98000/CrossplayShield
• Bug reports and false positives: https://github.com/TheMax98000/CrossplayShield/issues

Try it first: the free edition has the packet limits and the audit.