> For the complete documentation index, see [llms.txt](https://lethium.gitbook.io/lethium-docs/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://lethium.gitbook.io/lethium-docs/server-setup/security-and-utilities.md).

# Security and supporting plugins

EasyCommandBlocker, SkinsRestorer, ViaVersion, MiniMOTD, Vault, PlaceholderAPI, ProtocolLib, nightcore and other supporting plugins.

### EasyCommandBlocker

File: `plugins/EasyCommandBlocker/config.yml`. Apply with its reload command or a restart.

It does two jobs:

#### 1. Decides which commands players see when they press Tab

```yaml
tab:
  default:
    priority: 0
    commands:
      - "/clickem"
      - "/pet"
      - "/zones"
      ...
  vip:
    priority: 1
    extends: default
    commands:
      - "/home"
```

Only the commands in the player's group list appear in tab-complete. The `default` group is applied to players who have the permission **`ecb.tab.default`** (LuckPerms `default` group has it). About 120 commands are listed: every ClickEm shortcut plus `/msg`, `/r`, `/store`, `/discord`, `/tiktok`, `/tutorial`.

{% hint style="warning" %}
**Commands missing from this list still work, they just do not autocomplete.** A few newer commands are not listed yet: `/language`, `/lang`, `/languages`, `/verify` and `/captcha`. Add `"/language"`, `"/lang"`, `"/languages"`, `"/verify"` and `"/captcha"` under `tab.default.commands`. Whenever you add a command to the server, add it here.
{% endhint %}

The `vip` group `extends` default and adds `/home`. Create more groups the same way, then give LuckPerms the permission `ecb.tab.<group>`.

#### 2. Blocks commands players must not use

```yaml
commands:
  - "/?"
  - "/ver"
  - "/version"
  - "/plugins"
  - "/pl"
  - "/about"
  - "/bukkit:help"
block_colon_commands: true
use_commands_as_whitelist: false
```

Blocked commands show the message: **"You don't have permissions to use that command."** with a sound and a title (`blocked_command_default_actions`). `block_colon_commands: true` blocks any command written with a colon (`/minecraft:me`, `/essentials:msg`), which stops players bypassing blocks.

`custom_commands_actions` can run a different action (like a kick) for a group of commands.

{% hint style="info" %}
The blocked message says `[CLICKEM]`. Change the brand in `blocked_command_default_actions` if you rename the server.
{% endhint %}

### SkinsRestorer

File: `plugins/SkinsRestorer/config.yml`. Manages **player skins**: it restores skins for Bedrock and linked players and gives players `/skin <name>`. The server itself runs in online mode (`online-mode=true` in `server.properties`). Storage `type: FILE` (local files). The skin change cooldown is 30 seconds (`commands.skinChangeCooldown`).

### ViaVersion and ViaBackwards

Lets players on **newer and older Minecraft versions** join a 1.21.11 server. No configuration needed. `block-versions: []` blocks nothing. If a new Minecraft version comes out, update both jars together.

### MiniMOTD

File: `plugins/MiniMOTD/main.conf`. The server list line.

```
CLICK'EM SIMULATOR (gradient)
The more you click, the richer you get.
```

| Setting                             | Value                    |
| ----------------------------------- | ------------------------ |
| `motds`                             | `line1`, `line2`, `icon` |
| `player-count-settings.max-players` | 69 (display only)        |
| `fake-players`                      | off                      |

MiniMOTD uses MiniMessage. Bedrock players see the same MOTD through Geyser's `passthrough-motd`. The real slot limit is `max-players` in `server.properties` (200).

### Vault

Connects ClickEm, EssentialsX and chat plugins to a shared **economy and prefix** API. There is nothing to configure. Keep only one economy plugin providing Vault, see [EssentialsX](/lethium-docs/server-setup/essentialsx.md).

### PlaceholderAPI

Files: `plugins/PlaceholderAPI/config.yml`, `expansions/`, `javascripts/`.

The bridge that lets plugins share placeholders. Installed expansions:

| Expansion                                            | Gives                                                 |
| ---------------------------------------------------- | ----------------------------------------------------- |
| `luckperms`                                          | `%luckperms_*%`                                       |
| `vault`                                              | `%vault_prefix%`, `%vault_eco_balance%`               |
| `player`                                             | `%player_name%` and more                              |
| `statistic`                                          | `%statistic_hours_played%`, `%statistic_time_played%` |
| `world`, `essentials`, `bungee`, `formatter`, `math` | Utility                                               |
| `floodgate`                                          | `%floodgate_isbedrock%`                               |
| `javascript`                                         | Your own `%javascript_<name>%` from `javascripts/`    |

ClickEm's own `%clickem_*%` placeholders are built in, not an expansion file. See [Placeholders](/lethium-docs/placeholders.md).

| Command                                           | Use                       |
| ------------------------------------------------- | ------------------------- |
| `/papi list`                                      | Installed expansions      |
| `/papi parse me <placeholder>`                    | Test a placeholder        |
| `/papi reload`                                    | Reload                    |
| `/papi ecloud download <name>` and `/papi reload` | Install another expansion |

### ProtocolLib and packetevents

Libraries other plugins depend on to read and send packets: ProtocolLib for **AntiDamageParticles**, packetevents for LethiumLanguage and DonutBans. No configuration.

### AntiDamageParticles

Removes the red heart particles that appear above damaged mobs, which would clutter the arena. Nothing to configure.

### Nightcore

Library that **ExcellentCrates** needs. Its folder (`plugins/nightcore/`) holds shared currency and colour settings. Leave it alone.

### bStats and FancyAnalytics

Anonymous usage statistics. Safe to leave, or turn off in their `config.yml` (`enabled: false`).

### Other plugins in the package

| Plugin            | Purpose                                                                                     |
| ----------------- | ------------------------------------------------------------------------------------------- |
| **LethiumBans**   | Staff moderation. See [Staff moderation](/lethium-docs/server-setup/staff-moderation.md).   |
| **IA-Edit**       | An ItemsAdder in-game editor add-on.                                                        |
| **MobDisabler**   | Stops natural mob spawning. See [Worlds](/lethium-docs/server-setup/worlds-and-regions.md). |
| **CinematicView** | Camera flights. See [MythicMobs](/lethium-docs/server-setup/mythicmobs.md).                 |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://lethium.gitbook.io/lethium-docs/server-setup/security-and-utilities.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.