minecraft-server-admin-02a1f9 — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited minecraft-server-admin-02a1f9 (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use when: the task is infrastructure or live operations for Minecraft servers (deployment choice, tuning, backups, proxying, security, incident response).Do not use when: the task is writing plugin code (minecraft-plugin-dev) or writing mods/loaders (minecraft-modding, minecraft-multiloader).Do not use when: the task is WorldEdit command workflows (minecraft-worldedit-ops) or EssentialsX workflow/policy design (minecraft-essentials-ops).Do not use when: the task is datapack/resource-pack authoring (minecraft-datapack, minecraft-resource-pack).references/deployment-checklists.md when the task is an incident, rollout window, proxy change, or recovery drill and you need a compact checklist before acting.Use this table first. Pick a deployment type before changing configs.
| Deployment profile | Recommended stack | Pick this when | Watch-outs |
|---|---|---|---|
| Small SMP on Paper | Paper only | Up to ~30 concurrent players, broad plugin compatibility, low ops overhead | Do not over-tune early; profile before changing many defaults |
| Larger public Paper server | Paper + Spark + stricter plugin/change control | Public server with frequent joins, moderate plugin set, uptime matters | Plugin sprawl is the top TPS risk |
| Velocity-backed network | Velocity + multiple Paper backends | Hub/minigame/factions split across servers, need shared entrypoint | Forwarding/auth mismatches can block joins |
| Purpur gameplay-heavy server | Purpur (optionally behind Velocity) | You want gameplay knobs exposed in config without custom plugin code | Extra toggles increase misconfiguration risk |
| Folia high-concurrency server | Folia + Folia-compatible plugins only | Very high concurrency with region-threading goals | Many plugins are not Folia-safe |
| Fabric/NeoForge mod server | Fabric or NeoForge server build | You require loader mods, custom content, modpack behavior | Bukkit/Paper plugins do not apply |
Collect a baseline before edits. Linux host example:
free -h
top -b -n 1 | head -n 25Windows PowerShell host example:
Get-CimInstance Win32_OperatingSystem | Select-Object FreePhysicalMemory,TotalVisibleMemorySize
Get-Process java | Sort-Object CPU -Descending | Select-Object -First 5 Id,CPU,WorkingSet,PathIn server console:
tps
mspt
spark healthreportRecord:
Use Spark instead of guesswork:
spark profiler --timeout 180
spark tps
spark tickmonitor --interval 10Then identify whether the issue is:
Do not tune everything at once. Apply one group at a time.
view-distance and simulation-distance firstFor Java 21 on Paper/Purpur:
java -Xms10G -Xmx10G \
-XX:+UseG1GC \
-XX:+ParallelRefProcEnabled \
-XX:MaxGCPauseMillis=200 \
-XX:+UnlockExperimentalVMOptions \
-XX:+DisableExplicitGC \
-XX:+AlwaysPreTouch \
-XX:G1NewSizePercent=30 \
-XX:G1MaxNewSizePercent=40 \
-XX:G1HeapRegionSize=8M \
-XX:G1ReservePercent=20 \
-XX:G1HeapWastePercent=5 \
-XX:G1MixedGCCountTarget=4 \
-XX:InitiatingHeapOccupancyPercent=15 \
-XX:G1MixedGCLiveThresholdPercent=90 \
-XX:G1RSetUpdatingPauseTimePercent=5 \
-XX:SurvivorRatio=32 \
-XX:+PerfDisableSharedMem \
-XX:MaxTenuringThreshold=1 \
-Dfile.encoding=UTF-8 \
-jar server.jar --noguiFor under 12 GB memory budgets, reduce heap and use smaller region size.
After each change set:
spark tps
spark healthreportKeep the change only if MSPT/tick stability improves under representative load.
velocity.toml essentials:
bind = "0.0.0.0:25565"
online-mode = true
player-info-forwarding-mode = "modern"
forwarding-secret-file = "forwarding.secret"server.properties on backend:
online-mode=falsePaper backend forwarding support (config/paper-global.yml):
proxies:
velocity:
enabled: true
online-mode: true
secret: "paste-the-shared-forwarding-secret-here"Use the same secret value stored in Velocity's forwarding.secret file; the backend config takes the secret string itself, not a file path.
Keep enforce-secure-profile at the server default unless you are handling a specific legacy-client or incident workaround. It is not part of the baseline Velocity setup. Also confirm settings.bungeecord: false in spigot.yml; do not enable BungeeCord forwarding and Velocity modern forwarding at the same time.
online-mode expectations or direct backend exposure.| Asset | Frequency | Retention | Notes |
|---|---|---|---|
World folders (world*) | Hourly incremental + daily full | 7 daily, 4 weekly | Highest priority |
plugins/, config/, and root server state | Daily | 14 daily | Required for operational restore |
| Proxy config/secrets | Daily | 30 daily | Store encrypted off-host |
| Container/orchestration files | On change + weekly | 8 weeks | Git-tracked where possible |
For a production server, quiesce world writes before copying live world folders. The example below assumes a maintenance window and a cleanly stopped server. If you use RCON-based live backups instead, choose a client/secret mechanism that does not expose the password in command arguments, flush chunks first, and test the restore path before trusting the backup.
#!/usr/bin/env bash
set -euo pipefail
: "${SERVER_STOPPED_CONFIRMED:?set SERVER_STOPPED_CONFIRMED=1 after stopping the server cleanly}"
DATE="$(date +%Y-%m-%d_%H-%M-%S)"
BACKUP_ROOT="/backups/minecraft"
SERVER_ROOT="/srv/minecraft"
DEST="${BACKUP_ROOT}/${DATE}"
mkdir -p "$DEST"
tar -czf "${DEST}/worlds.tar.gz" -C "$SERVER_ROOT" world world_nether world_the_end
state_items=()
for item in \
plugins config server.properties bukkit.yml spigot.yml paper-global.yml \
paper-world-defaults.yml permissions.yml ops.json whitelist.json \
banned-players.json banned-ips.json; do
[[ -e "$SERVER_ROOT/$item" ]] && state_items+=("$item")
done
if [[ "${#state_items[@]}" -gt 0 ]]; then
tar -czf "${DEST}/server-state.tar.gz" -C "$SERVER_ROOT" "${state_items[@]}"
fiDefine targets:
RPO (acceptable data loss window)RTO (acceptable restore duration)df -h
free -hWindows PowerShell host example:
Get-PSDrive -PSProvider FileSystem
Get-CimInstance Win32_OperatingSystem | Select-Object FreePhysicalMemory,TotalVisibleMemorySizeFrom server/proxy console:
spark tps
spark healthreport| Symptom | First checks | Typical root cause |
|---|---|---|
| Startup crash after plugin update | latest logs, plugin dependency chain | incompatible plugin/API mismatch |
| High MSPT only at peak hours | Spark profiler, entity/chunk stats | mob farms, heavy scheduled tasks, chunk I/O |
| Players cannot join via proxy | forwarding mode + secret + backend exposure | Velocity/backend config mismatch |
| Periodic hard lag spikes | GC pauses + autosave + backup overlap | memory pressure, backup I/O contention |
server.properties high-impact keysmax-players=100
view-distance=10
simulation-distance=8
sync-chunk-writes=true
max-tick-time=60000
enable-rcon=falsebukkit.yml and spigot.ymlUse Spigot/Bukkit docs as authoritative for version-specific defaults and side effects. Tune conservatively and re-measure after every change set.
config/paper-global.ymlconfig/paper-world-defaults.ymlAdjust these only after profiling identifies an actionable bottleneck.
services:
paper:
image: itzg/minecraft-server:java21
container_name: mc-paper
environment:
EULA: "TRUE"
TYPE: "PAPER"
VERSION: "1.21.11"
MEMORY: "10G"
ports:
- "25565:25565"
volumes:
- ./data:/data
restart: unless-stoppedThis Docker example targets the repository's 1.21.x guidance and Java 21. Minecraft 26.1.x/Paper 26.x requires Java 25 and Paper's 26.x version line; use a Java 25 image and re-check plugin compatibility before changing VERSION.
online-mode=true unless proxy forwarding requires backend online-mode=false.forwarding.secret, panel credentials, backup credentials).~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.