OpSec: Community Edition

A client-side Minecraft Fabric mod that provides protection against client fingerprinting, tracking exploits, malicious server resource packs, and other privacy-focused features.

Community Edition Notice:
This project is an actively maintained continuation fork of the original OpSec mod by @aurickk. Following the archival of the upstream repository, OpSec: Community Edition maintains the codebase, fixes upstream bugs, and ports the mod forward to modern Minecraft versions (including Minecraft 26.3 "Wilderness Bound").

Official Sources:
Only download OpSec: Community Edition from these verified official sources:

• Modrinth
• GitHub Releases
  Builds from anywhere else are untrusted and may be malicious.

What it does

• Spoof as Vanilla - Set client brand name to pure vanilla and block outbound mod-detection channels.
• Channel Spoofing - Conditionally block mod network channels to prevent server-side mod detection.
• Known-Pack Filtering - Conditionally strip built-in mod pack identifiers from the configuration handshake.
• Isolate Pack Cache - Isolate server resource packs per-account UUID to prevent cross-account tracking.
• Block Local URLs - Block resource pack downloads/redirects targeting private or local IP addresses.
• Bypass Server Pack Requirement - Let the user toggle required server resource packs just like client packs.
• Strip Mod Shader Overrides - Strip server pack shader overrides targeting non-whitelisted mods to prevent crashes and GUI exploits.
• Key Resolution Protection - Protect against key resolution mod detection in any server packet.
• Meteor Fix - Disable Meteor Client's flawed key resolution protection so OpSec can safely handle fallbacks.
• Mod Whitelist - Automatically or manually exempt legitimate mods (VoiceChat, Minimaps) from protection.
• Chat Signing Control - Configure cryptographic chat message signing behavior.
• Account Manager - Switch between Minecraft accounts using session tokens or offline profiles directly in-game.
• Telemetry Blocking - Disable telemetry and analytics data sent to Mojang/Microsoft.

Configurations

The settings menu is accessible via the OpSec button in the multiplayer server selection screen or via Mod Menu.

If settings are changed while connected to a server, reconnecting is recommended to ensure changes apply cleanly.

Protection Tab

Whitelist Tab

Miscellaneous Tab

Accounts Tab

Debug Commands

When enabled in Misc → Debug Command, use /opsec in-game:

Feature Details

Spoof as Vanilla

Servers can query your client brand to detect whether you are running a modded client. OpSec provides true vanilla spoofing by setting the client brand to vanilla and suppressing outgoing mod channel registrations and mod-injected pack identifiers.

• ON: Appear as an unmodified, pure vanilla client.
• OFF (Default): Appear as a standard Fabric client.

Isolate Pack Cache

(Concept based on LiquidBounce)
Server-pushed resource packs can be used to track and fingerprint a player across multiple accounts. Instead of storing all resource packs in a shared cache (~/.minecraft/downloads/), OpSec isolates cached packs into separate subdirectories for each account UUID.

Block Local URLs

(Derived from ExploitPreventer by NikOverflow)
Malicious servers can send resource pack download URLs pointing to internal or private IP ranges (e.g. 192.168.x.x or 127.0.0.1) to port-scan your local network. OpSec checks all outgoing pack requests and redirects, blocking any connection targeting private or local addresses.

Bypass Server Pack Requirement

Servers can push required resource packs that vanilla clients cannot decline or disable without disconnecting. Declining or spoofing them blindly can be detected by servers probing translation keys defined within the pack.

With OpSec, the client downloads the pack, but strips the forced visual textures while preserving the pack's language files (so key translation probes continue to succeed). The server pack also becomes a toggleable item in your resource pack menu.

Modes:

• MANUAL (Default): Required packs apply like vanilla on push; you can still unequip them manually in the Resource Pack screen.
• ASK: Required packs are stripped on push and a prompt overlay lets you choose [Continue] or [Load Pack For Real].
• ALWAYS ON: All server packs are automatically stripped on push.

Strip Mod Shader Overrides

Some utility mods (e.g. Meteor Client) render their GUI with custom shaders loaded through Minecraft's resource manager. A malicious server pack can override files under assets/<mod>/shaders/ to crash the client, cause GPU DoS, or detect if the mod is present.

OpSec strips shader overrides targeting non-whitelisted mods from server packs so Minecraft falls back to the mod's bundled shaders. Vanilla (minecraft) shaders are never touched.

Key Resolution Protection

Servers can send translatable text components containing keys like key.attack or key.meteor-client.open-gui in any packet to probe which keys you have bound or which mod translation strings your client can resolve.

OpSec intercepts key resolution probes during server packet processing:

• With Spoof as Vanilla ON: Blocks all mod keys (returns raw key/fallback) and returns default vanilla keybinds when Fake Default Keybinds is enabled.
• With Spoof as Vanilla OFF: Allows Fabric API and whitelisted mods, blocking everything else.

Meteor Fix

Meteor Client features a key resolution protection implementation that fails when a server uses a translation key probe containing a fallback value (it echoes the raw key instead of the fallback value). OpSec provides a built-in mixin cancellation fix that disables Meteor's broken protection and allows OpSec's robust fallback resolver to take over safely.

ExploitPreventer Compatibility

If you prefer running ExploitPreventer alongside OpSec, overlapping features are automatically deferred to EP to prevent conflicts, while OpSec's unique features (e.g. Account Switcher, Shader Stripping, Meteor Fix, Telemetry Blocking) remain fully active.

Channel Spoofing & Known-Pack Filtering

• Channel Spoofing: Conditionally blocks mod channels registered with the server to prevent identification.
• Known-Pack Filtering: Intercepts ServerboundSelectKnownPacks packets and strips identifiers belonging to non-whitelisted mods while letting vanilla and whitelisted packs pass through.

Mod Whitelist

Legitimate client mods that rely on server communication (e.g., Simple Voice Chat, Xaero's World Map) can be whitelisted under the Whitelist tab (in AUTO or CUSTOM mode) so their required network channels pass through unblocked.

Account Manager

(Inspired by Meteor Client)
Allows managing and switching between Minecraft accounts using session tokens or offline usernames directly in-game without restarting the client. Includes token refresh validation and JSON import/export.

Telemetry Blocking

(Derived from No Chat Reports)
Blocks client telemetry data, gameplay events, and performance metrics from being transmitted to Mojang/Microsoft servers without affecting gameplay.

References & Credits

• @aurickk: Creator and original author of OpSec.
• ExploitPreventer: Local URL blocking and key resolution protection logic.
• No Chat Reports: Chat signing control and telemetry blocking logic.
• No Prying Eyes: Secure chat enforcement detection.
• MixinSquared: Mixin cancellation system for Meteor Fix.
• Stonecutter: Multi-version build orchestration.
• Fabric API: Fabric platform and translation hooks.

Disclaimer

OpSec: Community Edition is a client-side privacy tool designed to protect players from unwanted tracking, fingerprinting, and malicious server resource packs. It is not intended, designed, or encouraged for bypassing server rules, evading bans, or gaining unfair advantages in multiplayer games. Users are responsible for complying with the rules and terms of service of the servers they connect to.