SquidLab

Introduction

SquidLab is a pure anti-cheat for Spigot and Paper, from 1.8.8 up to 26.2 — one jar handles every version. It catches cheaters without eating your server resources and without interrupting legit players.

No ProtocolLib required. ViaVersion, Floodgate and Geyser are optional soft-dependencies.

Installation

Drop SquidLab.jar into your server's plugins/ folder and restart.
Edit plugins/SquidLab/config.yml — every option is documented inline. Apply changes live with /squidlab reload.
Watch the alerts for a few days, tune the thresholds, then enable autobans.

The web dashboard needs no setup at all — the database connection is built into the plugin and connects automatically. Just create a login with /squidlab createdash <user> <pass>.

Configuration

Highlights of config.yml:

protection — global grace: MIN-TPS, MAX-PING, join/teleport/velocity grace, setback minimum VL.
alerts — cooldown, console output, and where messages go (ROUTE: LOCAL / BUNGEE / BOTH).
violations — decay interval and amount (violation levels drop over time).
punishment — enable autobans and set your ban command.
geyser — Bedrock exemptions.
dashboard — server display name and heartbeat interval (no credentials — they are built in).
checks.<CheckId> — per check ENABLED, PUNISH-VL, SETBACK and thresholds.

Checks

50 behaviour-based checks across three categories. Toggle any of them live with /squidlab disablecheck <check> or from the dashboard.

Category	Checks
Combat	Reach, KillAura A/B/C, AutoClicker A/B, Hitbox, Criticals, Velocity, WallHit, ShieldAttack
Movement	Flight A/B/C, Speed A/B, Jesus, Timer, Blink, NoFall, GroundSpoof, Step, HighJump, LongJump, WallClimb, FastClimb, NoClip, ElytraFly, BoatFly, Strafe, Sprint, NoSlow, NoWeb
Player	BadPackets A–D, Scaffold A/B, Tower, FastBreak, FastPlace, FastUse, FastBow, Regen, AutoFish, ChestStealer, Inventory, PingSpoof, Improbable

Commands & Permissions

/squidlab help
/squidlab reload                 squidlab.reload
/squidlab client <player>        squidlab.client
/squidlab freeze <player>        squidlab.freeze
/squidlab disablecheck <check>   squidlab.disablecheck
/squidlab violations <player>    squidlab.violations
/squidlab cps <player>           squidlab.cps
/squidlab connection <player>    squidlab.connection
/squidlab profile <player>       squidlab.profile
/squidlab createdash <u> <p>      squidlab.createdash
/alerts                          squidlab.alerts
/logs <player> [page]            squidlab.logs
/punishlogs <player> [page]      squidlab.punishlogs

squidlab.admin grants everything; squidlab.bypass exempts a player from all checks.

Autoban

SquidLab has no ban system of its own — it runs your command when a player reaches a check's PUNISH-VL.

punishment:
  ENABLED: true
  COMMAND: "ban %player% Unfair Advantage [SquidLab: %check%]"

Placeholders: %player%, %uuid%, %check%, %vl%. Each check can override with its own PUNISH-COMMAND.

BungeeCord

Ban systems usually live on the proxy. Drop SquidLabBungee.jar into the proxy's plugins/ and set punishment.BUNGEE: auto — punish commands then run in the proxy console.

Alert routing

On a network the moderators are rarely online on the exact game server where a cheater is caught. Decide where violation messages are sent with alerts.ROUTE:

Value	Where alerts go
`LOCAL`	Staff on this server only (default).
`BUNGEE`	Every staff member on the whole proxy, tagged with the source server. Needs the bridge.
`BOTH`	Local + network.

Violations, punishments and network alerts all travel through the same SquidLabBungee.jar bridge.

Web dashboard

SquidLab ships with a full web dashboard: suspect list, live alert feed, a suspected-players-over-time chart, a live TPS gauge, server versions, watch lists, ban waves and remote check toggles.

No connection setup — the database is built into the plugin and connects (and reconnects) automatically. The anti-cheat never depends on it.
Each server appears automatically, identified by its ip:port. A super-admin sees every server; per-server admins see only their own.
Create a login in-game: /squidlab createdash <user> <pass>. The first account per server becomes the admin.
Violation levels are stored per player and survive relogging (even without the dashboard); the suspect list is never cleared automatically — only manually from the UI.

Developer API

Add SquidLab.jar as a provided dependency. The de.venta.squidlab.api package is stable and survives obfuscation.

@EventHandler
public void onViolation(PlayerViolationEvent e) {   // cancellable
    if (myMinigame.isIngame(e.getPlayer())) e.setCancelled(true);
}

@EventHandler
public void onPunish(PlayerPunishEvent e) {          // cancellable + editable
    e.setCommand("tempban " + e.getPlayer().getName() + " 7d Cheating");
}

SquidLabApi.getViolationLevel(player, "KillAuraA");
SquidLabApi.exempt(player, 3000);   // before jump pads / custom launches
SquidLabApi.isBedrockPlayer(player);

FAQ

Does it false flag?

Every check is buffered and surrounded by grace handling. Bedrock players are fully exempt. Run alert-only first and tune to your server before enabling autobans.

Does it need ProtocolLib?

No. SquidLab injects its own lightweight netty handler.

Does it lag my server?

Packet work happens on netty threads; block lookups happen once per movement tick for all checks together.

What if the dashboard database is down?

Nothing breaks. The plugin retries the connection in the background and the anti-cheat keeps running normally; violations are still stored locally and stay relog-proof.

Can I disable single checks?

Yes — in config.yml, live with /squidlab disablecheck, or from the dashboard.