ExploitFixer installation

ExploitFixer is a Bukkit-family JAR with one hard external dependency. Installation order matters: HamsterAPI must be present before ExploitFixer enables, because the plugin aborts its own startup when the packet layer is missing. PacketEvents and ProtocolLib are optional and can be added later.

Requirements

Requirement	Verified detail
Server	Bukkit, Spigot or Paper; plugin.yml also declares folia-supported: true
Plugin metadata	api-version: "1.13"
Java	Compiled to Java 8 bytecode; run the JVM your server version requires
Required dependency	HamsterAPI 0.3.5 or newer, installed as a separate plugin
Optional hooks	PacketEvents 2.13.0 or ProtocolLib 5.3.0
Build target	Spigot API 1.20.1; this is a compile target, not a tested version range

HamsterAPI is declared as a soft dependency in plugin.yml but checked at runtime in onEnable. It is not shaded into the ExploitFixer JAR, so both files must be deployed.

Install order

1. Put the HamsterAPI JAR in plugins/ and restart the server once so it enables.
2. Put the ExploitFixer JAR in plugins/.
3. Restart the server rather than hot-loading either JAR; the dependency check runs during enable.
4. Watch the console during enable.
5. Edit plugins/ExploitFixer/config.yml and the module files only after the first successful start.

Expected layout after the first start:

plugins/
├── HamsterAPI.jar
├── ExploitFixer.jar
└── ExploitFixer/
    ├── config.yml
    └── modules/
        ├── packet-limiter.yml
        ├── packet-watchdog.yml
        ├── raw-packet-guard.yml
        └── ...

ConfigUtil copies the shipped resource for each config file that does not exist yet, so the module YAML files appear under modules/ as the modules load.

What the console tells you

If HamsterAPI is absent or disabled, onEnable logs and returns before config or listeners are created:

HamsterAPI is missing or disabled. ExploitFixer cannot start.
Install HamsterAPI: <release URL>

An installed version below 0.3.5 produces a severe warning:

HamsterAPI 0.3.5 or newer is required.

At the audited HEAD that branch does not return; the plugin continues enabling after the warning. Check the HamsterAPI version in plugins/ rather than assuming startup was blocked by the warning alone. A successful enable also logs Hooked into HamsterAPI.

Optional packet hooks

PacketEvents and ProtocolLib adapters are compiled against 2.13.0 and 5.3.0 respectively and are detected reflectively after the dependency check. Neither is bundled or required. The global switches default to enabled:

PacketHooks:
  packet-events: true
  protocol-lib: true

Set a key to false if the corresponding plugin is installed but you do not want that adapter. HamsterAPI remains the primary packet engine either way.

Network placement

The shipped config warns operators to install the plugin on all Spigot, Paper or Folia servers in the network. A proxy-only or single-server install leaves the other backends without the packet checks. This is a deployment recommendation in the config, not an automatic discovery mechanism.

Verify the install

• Run /ef. The base command has no permission gate and prints help and version information.
• Run /ef stats with exploitfixer.admin to confirm the counters respond.
• Confirm the Hooked into HamsterAPI line appears in the console after enable.
• Check that plugins/ExploitFixer/modules/ contains the module YAML files you intend to tune.

If /ef works but modules do not react, confirm HamsterAPI enabled first; ExploitFixer does not fall back to a bundled packet implementation.

Known limits

No tested Minecraft version range is declared. api-version: "1.13" is metadata, the build uses the 1.20.1 Spigot API, and the Folia flag is a declaration rather than a verification. Test your server build and plugin set before treating the install as production-ready. The /ef test subcommand is also unrestricted; see commands and permissions before exposing the command to players.

Verified against ExploitFixer d065b6b (version 4.1.2, 24 October 2026) on 30 October 2026. Dependency checks, paths and defaults come from source; no live server install was performed.