AntiCheat and collection consent
Rust AntiCheat and Minecraft Checker are separate systems. Selecting a Minecraft directory for an inspection does not consent to another application's computer-wide collection.
Rust AntiCheat components
.anticheat component | Purpose and boundaries |
|---|---|
Oxide.Ext.ozProtectAC | net48 Rust/uMod extension, Harmony and movement/combat/loot checks; depends on Rust/Unity and is not a Minecraft mod |
aclient/Client | Standalone Windows net8.0 application with its own tray, scanners, heartbeat and bounded disk queue |
aclient/Service | Separate Windows worker: identity/presence, secure channel, screenshot requests, IPC; not the full Client scanner |
aclient/Tray + Shared | Separate Service controller and shared IPC/identity/capture code; not the standalone Client tray |
.aback | Separate backend with server keys, client sessions, violations, screenshots and releases |
Source audit reports successful builds and isolated fixtures. This does not establish Service installation, native screenshot operation in a user's session, detection quality or live Rust compatibility.
Collection scope
Standalone Client requires explicit DataCollectionConsent: true beside the executable. Consent defaults to off. Scope includes HWID, Steam metadata, computer/user/system/IP information and configured process, file, DLL, service, USB/device, VM/debugger observations. Public IP discovery uses an existing external ipify request. Logs and the bounded offline heartbeat queue are stored in the user's ozProtect LocalAppData directory.
ScreenshotConsent is separate and also defaults to off. Screenshots capture all monitors, including unrelated visible applications, rather than only the game window. Backend configuration must not enable local consent for the user.
Service requires OZPROTECT_COLLECTION_CONSENT=1 before identity/network initialization and separate OZPROTECT_SCREENSHOT_CONSENT=1 before capture. Service installation and launch-account permissions need independent review. A Windows service session does not establish interactive desktop capture.
Protocol
Use the released client and its assigned service origin. The application manages its own session; a Network panel token is not an AntiCheat client key. Public documentation covers installation, consent and user actions. Internal service interfaces are not published here.
Minecraft and limits
The local GameContext model stores GameId, ProjectId, PlayerId, MinecraftUuid, but the current Steam/HWID backend handshake does not bind them to an authenticated Minecraft identity. The inspected audit reports Minecraft startup rejection before HWID/network. Rust AntiCheat is not a ready Minecraft client.
Scanner findings can be heuristic observations. SelfProtection source does not establish entry-point activation. Rust RequireClientAC does not establish complete presence enforcement either: the audit found players without the expected HWID being skipped.
With multiple pods, Redis sessions do not replace shared presence: the audit identifies a process-local Map in ClientPing.js. Cross-pod presence verification remains separate backend work.
Sources: .anticheat/docs/anticheat-source-audit-20261028.md, aclient/Client/README.md, .aback/http/clientChallenge.js, encryptedClient.js, common/SecureChannel.js, SessionStore.js.