Trueward

Run your Minecraft network

with clarity.

Anti-cheat, replay evidence, staff investigations, and network operations, unified in one record.

24/7 Network protection
Explore the platform
One unified Staff console
Player Investigation Active
  • Notchless a7e4…c2f1 Reviewing
  • RubbyPro 9b11…8f32 Flagged
  • AcuaIHi 0d6c…4a95 Cleared
Trueward Guard Alert
Suspicious movement 0.42 b/t
24h signal volume +28%
Replay Evidence Captured
inv_7291 · survival‑1 00:02:14 → 00:02:38

Seven modules, one record.

The record is what matters; the modules each put a different thing into it. Nothing you install replaces what you already run.

  1. Trueward Guard

    Phase 2

    Detection and deception on one event bus. Reads Xray clients incumbent engines never see.

  2. Trueward Replay

    Phase 2

    Evidence capture and review. Deep‑links into ReplayCore today; native capture when partners ask.

  3. Trueward Staff Console

    Phase 2

    Discord slash commands and modals for case review. The web console for deep investigation only.

  4. Trueward Cases

    Shipping

    Append‑only audit of signals, replays, staff actions, and the policy version applied.

  5. Trueward Network

    Shipping

    Connector health, monthly restore drills, and TPS attribution to specific plugins and chunks.

  6. Trueward Policy

    Phase 2

    Versioned rules, dry‑run against last week’s cases before anything ships live.

  7. Trueward Connect

    Shipping

    Grim, Vulcan, Matrix, Polar, Thorium, Intave, and ReplayCore. Your detection stays yours.

One event every integration speaks.

Every signal, from any source, lands as the same envelope. The bridge plugin signs it; the control plane routes it; Cases holds the raw payload beside the normalized record.

  • at‑least‑once delivery with idempotency keys, so a retried event never doubles a punishment.
  • local buffer on the bridge: a cloud outage queues events, it never drops them.
  • signed releases and a published SBOM for the bridge plugin, every version.
bridge → trueward.ingest POST /v1/events 
{
  "tenant_id": "crafthaven",
  "source": "grim",
  "source_event_id": "grim-flt-0xf4a2",
  "occurred_at": "2026-11-02T14:02:11.284Z",
  "subject": {
    "player_uuid": "a7e4…c2f1",
    "server_id": "survival-1"
  },
  "classification": "signal.anticheat.flight",
  "payload": {
    "check": "flight.vertical",
    "delta_blocks_per_tick": 0.42,
    "confidence": 0.82
  }
}

What networks ask first.

Six questions a mid‑sized owner asks before a pilot. Written answers, not pitches.

  1. Do we have to replace Grim, Vulcan, or Matrix?

    No. Trueward Connect ingests their alerts as signals and detection stays theirs.

  2. Where does the data live?

    EU and US regions at GA, picked at tenant creation. Raw payloads sit under stricter access than normalized records.

  3. What is the bridge plugin’s attack surface?

    Signed releases, a published SBOM, no outbound traffic beyond your configured endpoint, full source read before shipping. Nothing on the server tick.

  4. Will it ban players automatically?

    Only when a policy you wrote says so, and only after its dry‑run matches your staff’s recent calls. The default is approval‑gated.

  5. Does it work with Geyser and Floodgate players?

    Yes. Floodgate UUIDs are canonicalized beside Java accounts; a connector that silently drops Bedrock traffic is flagged, not swallowed.

  6. Is this ready for a thousand concurrent players?

    Design partners we onboard run 150 to 900 CCU. Scale targets live in engineering notes, not marketing copy.