Boar Anticheat: Stopping Bedrock Movement Cheats on Geyser

Run a Minecraft server with Geyser and Bedrock players can join your Java world. So can Bedrock movement hackers, and most Java anticheats barely see them. Boar is a free anticheat that plugs into Geyser and cancels fly, speed, reach, and timer cheats on those Bedrock connections before they wreck the game for everyone else.

What Boar does

Boar runs as a GeyserMC extension. If you don't run Geyser, you can stop reading here, because this thing only watches Bedrock players who reach your Java server through Geyser. Java players never get touched by it.

The core idea is what Mojang calls server-authoritative movement with rewind. Instead of trusting a client that says "I'm standing right here," the server simulates where a player should be using vanilla physics, compares that against what the client claims, and rewinds world state so hit checks are judged fairly against lag. Bedrock Dedicated Server already supports this mode. Boar brings it to Geyser and, per the project's README, adds checks that BDS doesn't run.

It's a Java project, sitting at 101 stars on GitHub, MIT licensed. Free, and every line of the detection logic is there to read if you care to.

Why you'd run it

Cross-play servers have a blind spot. You might have a solid Java anticheat humming along while the Bedrock side stays wide open, because Geyser's translated movement often slips past Java anticheats or trips them into false-flagging legit phone players.

Concrete cases: a survival SMP that advertises cross-play and keeps drawing fly-hackers on mobile. A PvP server where Bedrock players land hits from well outside melee range. A busy public server (some of the servers on our list report five-figure concurrent player counts) where even a tiny fraction of cheaters adds up to a lot of ruined sessions.

(Slight tangent: one underrated perk of cross-play is that Bedrock players carry their own skins over through Geyser automatically. If you're building a server identity and want a consistent look for staff or builders, our skin gallery has over 230,000 free ones with a 3D previewer. Anyway, back to catching hackers.)

And if your real goal is keeping strangers out entirely, an anticheat isn't the first tool to reach for. A locked member list does more. Our whitelist creator builds a ready whitelist.json in a couple of clicks, and that stops drive-by griefers cold because they never connect. Boar is for the cheaters who are already allowed on.

Installing Boar on a Geyser server

Boar ships on Modrinth as a Geyser extension, and Geyser loads extensions from an extensions folder next to its config. The repo doesn't publish a long walkthrough, so here's the standard Geyser extension flow:

1. Download the latest Boar jar from its Modrinth page.
2. Drop the jar into your Geyser extensions directory.
3. Restart the server. A plugin reload isn't enough to pick up a new extension.
4. Watch the console for Boar's startup line, then open its generated config to set reach distance and other thresholds.

# Example paths, depending on how you run Geyser
# Standalone Geyser:
Geyser/extensions/boar.jar

# Geyser as a Spigot/Paper plugin:
plugins/Geyser-Spigot/extensions/boar.jar

This is server-side only. Players install nothing, update nothing, and won't know it exists unless they're cheating.

The checks, and how well they hold up

Movement prediction is the heart of it. Boar models vanilla Bedrock movement tick by tick and flags deviations from it. According to the README that covers nearly every movement cheat except vehicle-based ones: fly in all its flavors, speed, step, fast climb, high jump, jesus (walking on water), and no slow. No fall is caught through the fly check rather than a separate module, which the README argues makes it hard to bypass.

Reach is next. Boar cancels hits landed from beyond roughly 3 blocks, with the exact distance set in the config. The pitch is that it drops the cheater's hit without eating a legit player's hit at the edge of normal range.

Hitbox detection covers hitbox expansion, including "touch" style killaura where the attacker snaps onto a target that's technically adjacent.

Then there's the timer check. Real talk, boar flags clients running the game faster than the normal 20 ticks per second, and the README claims it catches speed-ups as small as 1.001x while still tolerating players who are just lagging.

The README says the movement approach is "mathematically impossible to bypass" because it's built off the vanilla movement code. I'd take that absolute framing with a grain of salt (every anticheat dev has said some version of it), but the method is sound and the honesty about missing features elsewhere in the README makes me trust the rest of it more. Actually, that's the thing that stands out: the project openly lists its gaps instead of pretending they don't exist.

Gotchas, uninstalling, and the fine print

• Bedrock only. Boar doesn't check Java players at all. You still need a dedicated Java anticheat running alongside it.
• No vehicle checks. Boat and horse movement cheats are outside its coverage right now, per the README.
• It's young. The README states plainly that many movement differences and features aren't implemented yet. Test on a staging server before you point it at your live one.
• Sensitivity cuts both ways. The project describes itself as extremely sensitive. Start with looser thresholds, watch your logs for a while, then tighten gradually so you don't punish players on bad connections.

Removing it is painless. Delete the jar from the extensions folder and restart. Boar doesn't edit world files or player data, so there's nothing to roll back and no vanilla state to restore.

On downloads: get the jar from the official Modrinth page and nowhere else. Open source means the code is auditable, which is a real plus, but it doesn't automatically make any given download safe. Your server, your call on how careful to be.

Alternatives and my take

If you run actual Bedrock Dedicated Server rather than Geyser, BDS has its own server-auth-with-rewind anticheat built in, which is what Boar is modeled on. Geyser also maintains an anticheat compatibility page worth reading before you commit to anything. For the Java half of a cross-play server, you'll want a separate Java anticheat regardless of what you pick for Bedrock.

My take: if you run Geyser and you've a Bedrock cheating problem, Boar is close to the only free, open, actively developed option aimed squarely at this specific gap. That alone makes it worth a staging trial. Go in knowing it's early, it's opinionated about sensitivity, and it's one half of a cross-play anticheat setup, not the whole thing.

The Java codebase is small enough to skim, the Discord and Modrinth pages are linked from the repo if you get stuck, and rolling it back costs you one deleted file. Low risk to try.