appleluis.ltddeveloper products
Setup guide // Anti-cheat // FiveM + Minecraft

Nightward setup guide

Nightward is a server-authoritative anti-cheat for FiveM and Minecraft, one license and one dashboard for both games. It scores and escalates instead of instant-banning, and the load-bearing detection runs on the server, where a cheat author cannot read it. This guide covers the Ward Core backend, the FiveM agent, the Minecraft plugin, how scoring and escalation work, and license activation.

Ward Core

Run the backend

Ward Core is the shared backend: scoring, the escalation ladder, the operator dashboard and the license gate. It is a zero-dependency Node application.

# from the ward-core/ folder
WARD_INGEST_SECRET=... WARD_ADMIN_TOKEN=... node src/server.js

# run the test suite
node --test

Open the dashboard in a browser and paste the WARD_ADMIN_TOKEN value to sign in. WARD_INGEST_SECRET is the shared secret every agent signs its telemetry with.

FiveM

Install the agent

Drop nightward-fivem/ into resources/nightward, set the two keys in config.lua, then ensure it last in server.cfg.

  • WardCoreUrl the URL of your Ward Core instance
  • IngestSecret shared secret the agent signs telemetry with, matching WARD_INGEST_SECRET on Ward Core
-- server.cfg, add last
ensure nightward

Minecraft

Install the Paper plugin

Build with Maven (JDK 21), then put the jar in each Paper backend's plugins/ folder.

# from the nightward-mc/ folder, requires JDK 21
mvn package

Configuration lives at plugins/Nightward/config.yml on each backend after the first run.

How it works

Scoring and escalation

Each agent batches flags and POSTs them to Ward Core. The body is JSON; the agent signs the exact bytes with HMAC-SHA256 and sends the hex digest in an X-Ward-Sig header. Ward Core verifies the raw body, rejects stale or replayed batches, recomputes the score from its own rules, runs the escalation ladder, and returns the action to take. Client signals only ever raise a score, the server always has the final say.

  • Ladder: observe, watch, restrict, kick, ban.
  • Detect-only installs cap at watch and never alter gameplay; enforce mode acts on the ladder's decision.
  • Scores are tracked per player, per detection vector, and decay over time, so one borderline flag drifts back to clean instead of compounding toward a ban.

Verified: 26 of 26 backend tests pass, the live HTTP path is smoke-tested, all Lua files parse clean under Lua 5.4.7, the Java plugin compiles and packages against paper-api 1.21.4, and the HMAC signature matches byte-for-byte across Node, Lua and Java.

License

Activate and move a key

Both agents validate their license through the license API. The first call from a server binds an activation; to move to a new server, free the old slot first.

POST /api/license/validate
{ "key": "...", "product": "nightward-network", "fingerprint": "my-server-ip-or-cfx" }

# moving servers: free the old slot, then validate from the new one
POST /api/license/deactivate
{ "key": "...", "fingerprint": "old-server-fingerprint" }

Product SKUs: nightward-solo, nightward-network, nightward-unlimited.

Back to NightwardEmail support