What Thorium does
Thorium is a server-side anti-cheat. The plugin on your Minecraft server streams movement, combat and interaction telemetry to Thorium’s detection engine, which replays it against a model of what vanilla play can actually produce. When the telemetry could not have come from a legitimate client, it raises a detection.
Why server-side
A client-side anti-cheat asks the player’s computer whether the player is cheating. Thorium never trusts the client: every judgement is made from what the server observed, so a modified client cannot lie its way past it.
What gets sent
- Position, velocity and ground state per tick
- Combat events: attacks, hit registration, aim deltas
- Block interactions: placement, breaking, reach
- Inventory and container actions
- Client brand, and transaction round-trips used to measure latency
Player IP addresses are only sent when you switch on IP Heuristic Analysis in network settings. It is off by default for new networks that have not explicitly enabled it.
What it does not do
- It does not read files, memory or processes on a player’s machine.
- It does not require players to install anything.
- It does not ban on its own unless you configure a ladder that does.
Latency and performance
Telemetry is batched and compressed, and detection runs off your server’s main thread. The plugin’s per-tick work is a snapshot of already-available state; it does not add packet round-trips to gameplay.