All projects
Open source
2026 · Designer & developer
Sunshine Sentinel
Turns scattered security alerts into explainable player incidents
- Java 21
- Paper API
- GrimAC API
- CoreProtect API
- SQLite
- Discord
- Version
- v0.1.0
- Runtime
- Paper 1.21.x · Java 21
- Storage
- SQLite (WAL)
- Risk model
- Explainable 0–100 score
Problem
On a live server, anti-cheat flags, blocked command probes and world edits arrive as three separate streams. Staff have to correlate them by hand before deciding whether anything deserves escalation — slow, inconsistent, and easy to abandon.
Approach
- Collects signals from GrimAC (typed event bus), SunshineCommandGuard (blocked command attempts) and CoreProtect (world activity snapshots) behind optional integrations.
- Scores players over a rolling 15-minute window with an explainable breakdown: base weight × decay × repetition × ping × TPS, plus diversity, cross-source and clustering bonuses.
- Maps scores to LOW / MEDIUM / HIGH / CRITICAL bands, creates incidents at 60, escalates notifications once at 80, and merges related activity into open incidents.
- Owns all mutable state on a single worker thread; database, HTTP and CoreProtect work stays off the server tick thread.
- Persists everything in a versioned SQLite (WAL) schema with restart recovery and daily retention purges.
- Never bans, kicks or rolls back — it is an investigation prioritization engine, and it never stores command arguments or chat content.
Impact
- Open source on GitHub with an active commit history since September 2026.
- Runs with any combination of integrations — including none — and stays idle until one becomes available.
- Defines a versioned integration contract with SunshineCommandGuard 1.4.0+ and reports incompatible builds in /sentinel status.
- Discord webhook delivery and an in-game incident GUI for review workflows.