Minecraft anticheat guide
Citizens NPCs and Fake Players Under Anticheat Checks
How Citizens NPCs and fake player entities can trigger alerts or skew player counts, and a staging checklist to separate NPC data from real player checks.
Short answer
Citizens NPCs are server-side entities that can move, look, and take hits like players. Depending on how each plugin reports them, an anticheat may alert on their movement, count them in player numbers, or treat their hits as player actions. Separate NPC behavior from player data, confirm whether your anticheat can ignore NPC entities, and test NPC routes and hits on staging.
Why NPCs can look like players
An NPC is a server entity. Its movement may be scripted, teleported, or pathfound, so it can move in patterns that real players rarely produce, such as sharp turns or constant speed over long distances. If an anticheat evaluates an NPC as a player, it may flag that movement even though no client is involved.
Some NPC and fake-player tools also send packets so an entity appears in the tab list or looks like a connected player. That adds another route into the anticheat, because the server may then count the NPC as an online player and track its packets.
Find where NPC behavior leaks into checks
The table lists the common routes from NPC behavior into anticheat data. The effects are possibilities to test, not results from a measured run on any particular plugin pair.
| Source | Possible effect | Check on staging |
|---|---|---|
| Pathfinding or scripted NPC movement | Speed or position alerts tied to the NPC | Watch the alert log while an NPC walks a fixed route |
| NPC that can be hit | Reach or hit-validation alerts on the attacker | Strike the NPC from known distances and compare the alerts |
| NPC shown as a player in the tab list | The NPC counts toward player-based numbers | Compare the online count with and without the NPC |
| Packet-only fake player from a test tool | Movement alerts or drift in player counts | Remove the fake player and confirm the alerts stop |
Run the NPC checklist
Work through the list once on staging and keep the log. Repeat it after any NPC plugin update, because an update can change how entities are reported.
Use named test NPCs
Create one test NPC for each behavior you need to check, and give it a name that says what it does, such as route-walker or hit-target. Keep these NPCs on staging only, and delete them when the test ends. Clear names let you tie each alert to a behavior instead of a vague entity ID, which makes the alert log far easier to review.
Plan NPC changes like other plugin updates
Add NPC plugin updates to the same staging cycle you use for anticheat updates. Before you upgrade either plugin, rerun the checklist on a staging copy and compare the alert counts with the last run. Keep a short note of which NPC routes were tested, so the next person knows what has already been covered.
Keep NPC numbers out of player statistics
If your staff reports or dashboards count online players, filter out NPCs before you calculate alert rates. A few NPCs in the tab list can make alerts per player look higher or lower than they are. The same filter helps when you compare one week with another.
Also review what each NPC can do. An NPC that runs a shop, a quest, or a command can change server state. That is a plugin and permissions question, and an anticheat does not answer it for you.
What we have not verified
We have not tested any NPC plugin, fake-player library, or anticheat together. Whether an NPC produces alerts, and whether an anticheat can exclude it, depends on the versions of both plugins. Treat this page as a test plan for your own server.
FAQ
Will an NPC that walks a fixed path always trigger movement alerts?
Not always. Some movement checks may ignore it and others may not. Run the same route on staging and record the result before you decide anything.
Is an NPC a security risk?
It can be, if a player can interact with it in ways that change server state, such as through a shop or quest script. Review what each NPC action can do. An anticheat does not replace that review.
Should we list NPC names in the anticheat configuration?
Only if your anticheat has an exclusion setting that accepts those names. If it does not, leave the configuration alone and filter the reports instead.
Can we run fake players on the production network for testing?
Keep them on a staging server. A fake player on production can add alerts, skew player counts, and be mistaken for a real player by staff reviewing the logs.