Module Development

AsyncAnticheat uses a modular architecture where detection logic runs in separate services called modules. This allows:

• Language flexibility - Write modules in any language (Rust, Python, Go, etc.)
• Independent scaling - Scale detection separately from the API
• Easy experimentation - Test new detection methods without affecting production
• Specialized analysis - Different modules for different cheat types

How Modules Work

┌─────────────┐     ┌─────────────┐     ┌─────────────┐
│   Plugin    │────▶│     API     │────▶│   Module    │
│  (Capture)  │     │  (Storage)  │     │ (Detection) │
└─────────────┘     └─────────────┘     └─────────────┘
                           │                   │
                           │◀──────────────────┘
                           │    (Findings)
                           ▼
                    ┌─────────────┐
                    │  Dashboard  │
                    └─────────────┘

1. Plugin captures packets and sends to API
2. API stores batch and forwards to registered modules
3. Module analyzes packets and detects violations
4. Module sends findings back to API via callback
5. Dashboard displays findings for review

Module Interface

Modules must implement a simple HTTP interface.

Ingest Batch

POST /ingest
Content-Type: application/x-ndjson
Content-Encoding: gzip
X-Server-Id: <server_id>
X-Session-Id: <session_id>
X-Batch-Id: <batch_id>

The request body is the (optionally transformed) gzipped NDJSON batch.

Response

Return 200 OK to acknowledge receipt. Findings are submitted asynchronously via the callback endpoint.

Health Check

GET /health

Return 200 OK with a small JSON payload when healthy (example):

{ "ok": true, "name": "movement_module", "version": "0.1.0" }

Findings Callback (to the API)

After detection, modules submit findings back to the API:

POST /callbacks/findings
Authorization: Bearer <MODULE_CALLBACK_TOKEN>
Content-Type: application/json

Official Modules

AsyncAnticheat ships category-based detection modules:

Combat Module

• Aim anomalies
• KillAura patterns
• Auto-clicker statistics
• Reach validation
• NoSwing detection

Movement Module

• Flight physics
• Speed / timer / step
• NoFall / GroundSpoof
• Velocity / NoSlow

Player Module

• BadPackets validation
• Scaffold / FastBreak / FastPlace
• Impossible interactions
• Inventory click speed

Creating Custom Modules

See the Creating Modules guide for a step-by-step tutorial.

Basic requirements:

1. HTTP server with /ingest and /health endpoints
2. Accept gzipped NDJSON batches
3. Submit findings to API callback
4. Register with API via the modules endpoint