How this works
A static malware scanner for Minecraft mod and client jars. Read the part you need — or jump to what happens to your upload, which is the one most people want.
The scanner
It never runs the jar
The engine reads bytecode with ASM — parsing bytes, never loading or linking a class. Nothing inside a jar you upload executes on our machines. That property is the entire safety model, and it is why it is safe to hand this a live sample.
Signals, then chains
One API call means nothing. A mod that opens a URL, uses reflection and writes a file is a normal mod. Verdicts come from combinations — a fetch next to class definition, a credential read next to a covert destination — and from chains that have no benign form.
Code from bundled libraries is discounted, and where a library is published on Maven its bytes are checked against the real build. A genuine gson stops counting against the author entirely; a gson with two files nobody ever published does the opposite.
What it cannot see
Machine code, and code that is not in the file. A native library, or a payload fetched or decrypted at runtime, is outside what any bytecode scanner can read. When that happens the report says so rather than reporting a reassuring score.
What the verdicts mean
There is no “safe”
Static analysis cannot prove a jar is clean. It shows what the code reaches for; it cannot show what is not there. No indicators means no rule fired, not that the file is trustworthy. Read the code before trusting it — the decompiler is right there for that.
The bands
Low — ordinary mod behaviour: reflection, an update check, config writes. Suspicious — enough signals to be worth reading. High risk and Malicious indicators — a real chain fired; treat it as hostile.
Undeterminable is its own answer and carries no score. It means the code that actually runs is not in the file. “We could not see it” is a different claim from “this is malicious”, and a licensed client whose DRM downloads encrypted classes trips every loader chain there is without being malware. The report keeps the two apart.
Your uploads, and privacy
What we record
The file, its name, size, SHA-256 and content hash, and the full report. If you are signed in the scan is linked to your account; if you are not, it is not attributed to anyone.
Signing in with Discord requests the identify scope only. We store your Discord id, display name and avatar hash. We never ask for your email or your servers. Only a SHA-256 of an API key is stored, so a key is shown once and cannot be recovered — not by us, and not out of a backup.
Third parties, and deletion
A VirusTotal lookup happens only when you press the button, and uploading to VirusTotal is a separate button again. Nothing is sent there automatically.
Ask on Discord and we will remove a specific upload and its reports. There is no self-service delete: the corpus is what detection is measured against, so removals are handled by hand.
API
Sign in and create a key on the account page. Send it as Authorization: Bearer rs_live_… to POST /api/scan with a multipart file field, or to POST /api/url with a JSON url. Full reference on Docs.
The API is a paid feature — the daily budget comes with a plan (see Plans). Scanning in the browser is unlimited, free and anonymous, and is going to stay that way: a key is for driving this from a script, not a gate on the tool itself.
Uploading a jar that has been scanned before returns the stored report and tells you when it was decided, with a button to run it again. That is deliberate: every scan spawns a JVM, and re-deriving an answer we already have helps nobody.
Contact
Discord is the fastest way to reach us. Bug reports, false positives, samples worth adding and takedown requests all belong there.
False positives are bugs and get treated as one. Send the jar and the report link. Detection is measured in both directions against a corpus, so a clean file scoring badly is a regression, not a judgement call.
Terms
Provided as is, with no warranty. A clean report is not a guarantee of safety and a bad report is not a legal accusation. Use your own judgement, and read the code.
Scan files. Do not use this service to distribute malware, to attack it, or to work around the API limit with multiple accounts. Uploading means you accept that we keep the file as described above.
We are not liable for anything that follows from running a file, whatever this scanner said about it. Static analysis has limits and the report says what they are.