How to Read Minecraft Anticheat Alerts Without Guessing

Read violation level as a counter, not a verdict

A violation level (VL) counts how many times a check's condition fired for a player; it does not explain why. A high VL on a lenient check can mean less than a low VL on a strict one, and thresholds differ per check and per configuration.

Staff should therefore never quote a VL alone as proof. The useful reading pairs the VL with the check name, the measured values that crossed the threshold, and the timing around the event.

Four fields every alert review needs

Before escalating, collect the check name, alert values, game context, and timing. If key details are missing, gather more information before deciding on punishment.

• Check and threshold: exact check name, the VL at flag time, and the configured tier it maps to.
• Measured values: the debug variables the check reported, such as distances, intervals, angles, or sequence state.
• Check whether the alert came from a FairPlay check or an external anticheat hook, and note which plugin emitted it.
• Timing context: player latency and transaction state, nearby teleports or velocity, and inventory or block interaction around the flag.

Redacted sample fields for staff notes

When staff write up a case, keep only the fields another reviewer needs and redact everything else. Player names, UUIDs, IP addresses, chat content, and full log lines do not belong in a shared review note.