How it works
A quick look under the hood: how flags travel from Grim on your server all the way to your dashboard, and how player positions become a live map.
Grim does the detection
Grim is a prediction-based anticheat. Instead of guessing from statistics, it simulates what a legitimate player could physically do next and compares that to what actually happened. When reality drifts too far from the prediction, Grim raises a flag for a specific check — for example movement checks, timer, reach or aim — with a violation level (VL) that grows the more a player trips it.
Warden AC doesn't change any of this. Grim keeps making the decisions; Warden AC listens.
The plugin listens and streams
The Warden AC plugin hooks into Grim's flag events. Each time Grim flags a player, the plugin forwards a compact message to the backend: which player, which check, the violation level and a short verbose detail. It also samples lightweight telemetry — mainly player positions — so the dashboard can draw a live map. All of this travels over a secure WebSocket connection authenticated by your network key.
The backend fans it out
The backend receives everything from your servers, stores what needs to persist (player registry, moderation history), and pushes live events to any dashboards your team has open. That's why flags, joins and map movement appear in near real time without refreshing.
The dashboard is where you act
Your moderators watch flags roll in, open a player to see the full story behind a flag, and take action — warn, kick, ban or send an on-screen alert. Those actions travel back down to the right server through the same connection, and the plugin carries them out in-game.
Version support
Your server itself runs a modern Paper build (Java 21). Players don't have to: with ViaVersion, clients from 1.8 all the way to 1.21 can join, and Grim checks them all. So you get broad version coverage for players while running a single up-to-date server.