X-ray, nuker and scaffold detection

Why X-ray is different from every other cheat

Every other cheat on this site produces something the server can point at. A fly module reports a position gravity does not allow. A reach module lands a hit from too far away. A timer sends packets faster than a tick loop can produce them.

X-ray produces nothing. It modifies the client's rendering so stone becomes transparent and ores do not. Every packet the client sends afterwards is a completely ordinary packet: the player walks somewhere and breaks a block, exactly like any other player walking somewhere and breaking a block. There is no illegal message to catch, because the cheat never sends one.

That single fact determines everything about how X-ray should be handled, and it is the part most discussions skip.

What can be measured instead

If the act cannot be caught, the outcome can be counted. A player mining normally moves a great deal of rock for every ore they find — that is what mining is. A player who only ever breaks the ore does not. Over a large enough sample, the ratio between the two separates them.

The important word is "large enough". Ore distribution is random, veins cluster, and a genuinely lucky stretch is a normal thing to happen to a normal player. A ratio computed over a short session says nothing at all. It only starts to mean something once the sample is big enough that luck stops being a plausible explanation, and even then it is a probability rather than a proof.

Treating a statistical check as statistical

Because it is an inference and not an observation, the correct design is deliberately weak:

• The sample has to be large before a ratio is allowed to mean anything.
• The severity is small, so a flag contributes little to the player's running violation level.
• The thresholds are set so the check cannot reach an automatic kick on its own. Even a strong X-ray signal should require something else to be wrong before anybody is removed.

The right outcome of an X-ray flag is an operator looking at the evidence: this player, this ratio, over this many blocks. That is something a human can weigh against how the player behaves, where they dug, and what else the server knows. It is not something to hand to an automatic ban, because the automatic ban has no way to be wrong quietly.

Anyone selling you a Minecraft anticheat that promises to catch X-ray reliably is describing either a ban wave with a false-positive rate they have not told you about, or a client-side component running on the machine of the person they are trying to catch.

Nuker: caught outright

Nuker is the opposite case. It breaks blocks far faster than a hand can, and often blocks the player is not next to, and both of those are directly observable.

A player has one hand. Several distinct blocks finished inside a single tick is not a fast client, it is a client breaking a rule that the game does not bend. And a block outside arm's length cannot be hit at all, whatever tool is held — the same reach limit that governs combat.

One implementation detail matters more than it looks. Only the finish of a block break should be counted. A client announces that it began breaking a block as well, and in creative mode it sends that alongside the finish for the same block. Counting both doubles every break and turns ordinary creative building into a nuker flag.

Scaffold and tower: placing blocks you are not looking at

Scaffold lays a bridge underneath a player walking forwards, on the top face of blocks behind them. Tower does the same thing vertically, at the player's own feet, once per jump. They are different features in a cheat client and they share one shape on the wire: a client placing blocks it is not looking at.

That is the signal, and it is a real one, because no human bridges blind. But neither is judged on a single placement — laying one block behind you is ordinary building, and everybody does it. What separates a module from a builder is the run: block after block, all behind, all while moving forwards, at a cadence a person does not sustain.

All three need the world

Every check here needs to know what a block is, and the only thing that knows is the chunk stream the server sent to the client.

Retaining the world as it arrives would cost megabytes per session, which is not viable for a proxy holding thousands of sessions. The workable approach is a small window: the chunks within a short radius of the player, evicted as they move. It is a retention radius rather than a working set — a small window covers every block a player can stand on, break or walk into.

There is a subtlety worth knowing if you are building this: the window has to be wider than it sounds necessary. A server streams a chunk when the player is still many chunks away from it and never sends it again, so a retention radius narrower than the server's render distance rejects chunks on arrival and leaves the cache permanently empty. The check then never fires, and everything looks fine right up until you notice it has never flagged anybody.

The other rule is that chunk decoding must fail closed. A chunk whose sections do not consume precisely the bytes the packet declared is dropped whole rather than partially trusted, because a block table read at the wrong offset does not produce noise — it produces confident, wrong answers about what is where, and every check built on it then accuses innocent players.

Where these fit

X-ray, nuker and scaffold are the world-interaction third of an anticheat. The movement checks are covered in fly, speed and timer hacks, the combat checks in killaura and reach, and the design rules that govern all of them — violation levels, decay, setbacks, monitor mode, and why false positives are the expensive failure — in What is a Minecraft anticheat?.