Checks overview

Every detection family in checks.yml follows the same shape. Learn it once and the per-family pages are just a list of which keys that family actually has.

The lifecycle of a flag

1. The check observes a player and decides whether the evidence clears its bar.
2. Clearing the bar records a flag and increments that player's violation level (VL) for that check.
3. Alerts fire according to fail.alert.
4. Commands in fail.commands run for every recorded flag.
5. When VL reaches fail.max, the punish block runs.

VL is per player, per check. It does not carry across checks.

Precision

crystalaura:
  precision: FINE

precision sets how much evidence a check requires before it records a flag. It does not change what the check looks at.

Shipped defaults: crystalaura is FINE, anchormacro and autototem are STANDARD.

Thresholds and punishment

crystalaura:
  fail:
    max: 20
    alert:
      enable: true
      viewer: STAFF   # STAFF or ALL
      every: 1        # alert every nth flag
    commands:
      - "say %player% is annoying using %check% for %vl% times"
  punish:
    enable: true
    effect: BETTER_LUCK_NEXT_TIME
    alert:
      enable: true
      viewer: STAFF
    commands:
      - "ban %player% You can't use %check% in this server!"

Placeholders for both command lists: %player%, %check%, %vl%, %maxVl%.

Watching before enforcing

To keep the detections and lose the enforcement, set punish.enable: false. Flags, VL, alerts, the dashboard and /ecstacy violations all keep working. This is the right setting for the first week on a new server.

Mitigation

Mitigation actively cancels the cheat's own packets instead of only recording the flag. It is a single on/off switch, off by default on every family, and when it steps in is decided by Ecstacy rather than being customer-tunable.

crystalaura:
  mitigation: false

Each family cancels what makes sense for it: Crystal Aura the placement and the attack, Anchor Macro the glowstone charge after the anchor is placed. Auto Totem carries the switch too, but it is a beta check and mitigation is not yet active there. Per-family detail is on each check's page.

The heuristic layer

crystalaura and anchormacro have an optional heuristic layer that is independent of the cloud scoring:

crystalaura:
  heuristic:
    enabled: false
    mode: VANILLA_IMPOSSIBLE
    shadow: true

Enable it if blatant cheaters are getting through, and leave shadow: true until you have watched the violations it produces.

Master switch

Every family has enabled, which the GUI toggle writes:

autototem:
  enabled: true

Reading a violation

When a flag reaches you, four things are worth separating before you act on it:

A single flag is not a decision. fail.max exists precisely because one observation is noise and twenty is a pattern. That is the whole reason the threshold is not 1.

Choosing settings for your server

The shipped configuration targets a server where cheaters are a minority and staff are present. Three situations where a different starting point is more honest:

A busy practice or PvP server. Leave every precision alone and raise crystalaura.fail.alert.every to 4 or 5. The default of 1 will bury your staff channel long before anyone reaches VL 20. Detection is unaffected.

An anarchy server. Move crystalaura and anchormacro to STRICT, one at a time. Assume the flag volume goes up substantially and that you want punish.enable: false for the first week while you look at what it produces.

A small SMP with no dedicated staff. Set alerts.mode: "WEB_ONLY" in settings.yml so nothing lands in chat, leave punish.commands empty, and review the dashboard when you feel like it. Nothing gets acted on automatically, which is usually what a small server actually wants.

In all three, the first change should be punish.enable: false, not a precision change. You cannot tune a threshold you have not watched.

What the checks do not do

• They do not exempt operators. ecstacy.exempt.* defaults to false for everyone, including holders of ecstacy.admin. That is how you verify the anticheat on yourself.
• They do not share VL. Twenty flags spread across three families punishes nobody; each check counts on its own.
• They do not act while punish.enable: false. Flags, alerts, VL, the dashboard and /ecstacy violations all keep working. Only the threshold action is skipped.
• They do not need a reload after a GUI toggle. /ecstacy checks writes to disk and syncs immediately; /ecstacy reload is for hand-edited files.

The families

• Crystal Aura
• Anchor Macro
• Auto Totem

The complete key-by-key file is in the checks.yml reference.