Documentation

Everything Is Public

Source, docs, changelogs — and the list of defects we haven't fixed yet. The reference docs are generated from the code, so they cannot drift from what actually ships.

Getting Started

Installing

  1. Run a Minecraft 1.21.1 dedicated server on Java 21, with NeoForge 21.1.235+, Fabric Loader 0.19.3+ and Fabric API, or Forge 52.1.16+.
  2. Drop the matching NexusCore jar into the server's mods/ folder. NexusCore is server-side only — players connect with unmodified vanilla clients.
  3. Start the server. NexusCore creates nexuscore/ in the game directory with config.json, permissions.json and audit.log, all human-readable JSON.
  4. Grant your staff what they need with /nexus permission group, and check any decision with /nexus permission check <player> <node> — it explains its answer rather than returning a bare yes or no.
  5. If a server will not start, boot with -Dnexuscore.safemode=true to load core modules only and recover it.
📥

v1.1.0 is available. Download the jar for your loader from GitHub Releases or the NexusCore page. Each release publishes SHA-256 checksums — verify with sha256sum -c checksums.txt.

Questions

Common Questions

Do players need to install anything?

No. NexusCore is server-side only. The in-game admin panel is rendered as an ordinary vanilla chest menu, so it works on completely unmodified clients.

Does it need Bukkit, Spigot or Paper?

No. NexusCore is a native mod built directly against Minecraft on NeoForge, Fabric and Forge from a single shared codebase. There is no server-platform layer involved.

What happens to vanilla commands like /ban?

NexusCore takes over /ban, /kick, /banlist, /pardon, /list, /tp, /teleport and /gamemode by default, rebuilding them from vanilla's own argument types so selectors and coordinates still work. Set overrideVanillaCommands=false to leave vanilla in charge — NexusCore's versions then live on n-prefixed names.

/ban-ip and /pardon-ip are not taken over, so IP bans are neither audited nor listed by NexusCore.

What does "tamper-evident audit log" actually mean?

Every administrative action is appended to audit.log with a correlation id, and each record is SHA-256 hash-chained to the one before it. Editing or removing a record breaks the chain, and /nexus audit verify re-hashes the whole chain and reports the break. IP addresses, passwords and tokens are redacted as records are written. Note that the log does not yet rotate — see the published defect list.

Is it safe to run on a populated server?

Be careful. v1.1.0 has only ever been exercised with one player online at a time, and there are four confirmed vanish faults that appear only on another player's client. Everything requiring a second player is unverified. The known issues are published in full so you can judge for yourself.

Which versions are supported?

v1.1.0 is current. v1.0.0 has two confirmed critical defects and is unsupported — if you are on it, upgrade. The security policy on GitHub is authoritative.