Saros Mod Checker

A client without the mod gets 10 seconds to answer the handshake and then the door. A client carrying something on your blacklist gets it immediately. Matching runs on filename substring and on SHA-256 hash, so renaming xray.jar to optimization.jar does not help anyone.

Verification flow

1. A player connects and the server checks that the client has the mod
2. Server requests the client's loaded mod list and active resource packs
3. If the client doesn't respond within 10 seconds → disconnected
4. Server checks each filename (substring match) and SHA-256 hash against the blacklist
5. Any match → immediate kick with a specific reason message

Configuration

Blacklist managed via config/sarosmodchecker-blacklist.json:

{
  "blacklistedNames": [
    "xray",
    "cheat-client"
  ],
  "blacklistedHashes": [
    "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855"
  ]
}

• blacklistedNames: case-insensitive substring match against the filename. Any mod or resource pack whose filename contains one of these strings is flagged.
• blacklistedHashes: exact SHA-256 match, which blocks one specific build no matter what it is named.

Mod list export

On every server start the mod writes [ServerRoot]/modlist.md, a markdown table of all loaded server-side mods with name, ID, version and SHA-256 hash.

Commands

/checkclientmods <player> (OP Level 2)

Retrieves and displays the full mod and resource pack list for an online player, including SHA-256 hashes. Use it to check a suspicious player by hand or to track down a hash mismatch.