CheatAlarm

Most single signs of cheating have an innocent explanation: lag, a lucky shot, a stash found by chance. CheatAlarm doesn't act on any of them. It adds them up into a score per player and tells the admins only when the score crosses the watch line (40), and again at the alarm line (100). It never kicks or bans anyone — an admin decides.

What it watches

• Rust's own antihack violations (noclip, flyhack, speedhack, eye, projectile, melee, cooldown…). The game forgets these within minutes and after a restart; CheatAlarm keeps them, grouped so one bad lag spike counts once rather than fifty times.
• Shots the game rejects, read from its combat log every few seconds and kept as evidence, where the game itself throws them away.
• Headshot rates on players and on NPCs, in three distance bands, compared with the rest of the server once there is enough data.
• Aim: shots fired away from where the player was looking (silent aim), flicks onto a shot that snap straight back, and automatic sprays where the view never climbs and the mouse never pulls down (no recoil).
• Long neck and fast fire: shots that start away from the player's eyes, and shots faster than the weapon can fire, with allowance for lag.
• ESP: how often a player keeps the crosshair on someone hidden behind a wall or the ground, and follows a hidden player moving across their view. Players who could have been heard — shooting, hitting or being hit — are left out.
• Honeypot stashes an admin buries where nobody would stumble on them. A player who uncovers one probably saw it through the ground — a red flag, and admins are told at once.
• F7 reports, counted once per reporter per day.
• Family-shared accounts, and above all ones shared from a banned owner.

Every statistic is judged against the rest of your server, so a good player on a server of good players doesn't stand out.

Traffic lights

Every piece of evidence belongs to one of seven kinds of cheat — movement, ESP, aim, eye, projectile, melee and timing — and each shows green, amber or red from the last 7 days of events and from the statistics. One odd event stays green. When two kinds are red at once the player gets extra points, once a day, because a cheat menu is rarely used for one thing only.

Points fade, halving every 14 days by default, so an old mistake stops counting, and no one kind of event can add more than 30 points a day. Every flag is kept with its evidence and logged to logs/CheatAlarm/, and player records carry over a map wipe.

The panel

/ca ui lists every player in a sortable table: score bar, headshot rates, traffic lights, F7 reports, honeypots. Click a player for a light per kind of cheat, points per day and every flag. The Evidence tab shows events by kind, the shot statistics and every rejected shot kept; the Combat tab shows accuracy per weapon, where hits land, kills, deaths and time played. The Server page shows the score spread, the server's own rates and every honeypot, and has an Include admins switch for testing on yourself. Each admin can also switch on a small see-through list of the five highest scores in a corner of their own screen.

Alerts reach admins in chat and, if you set one, a Discord webhook. Everything an admin sees is in English, Russian, German, French, Spanish, Brazilian Portuguese or Simplified Chinese, following their own client; the console, logs and Discord stay in English.

Light on the server

The per-tick checks run only while a watched player is holding a gun, and the honeypot hooks only while there are honeypots. cheatalarm.perf in the console shows exactly what it costs.

Every download is licensed to you and watermarked with your details.

• Adds evidence up over weeks into one score per player
• Alerts at a watch line and an alarm line, never kicks or bans
• Silent aim, snap back and no recoil statistics
• ESP: looks at players hidden behind cover
• Long neck and fire-rate checks, lag-aware
• Keeps Rust's antihack violations and rejected shots the game forgets
• Green, amber and red lights for seven kinds of cheat
• Headshot rates against the server, by distance
• Honeypot stashes to catch players who see through the ground
• F7 reports and family-shared accounts
• Sortable player panel with evidence, combat stats and a top-5 overlay
• Discord webhook alerts
• Seven bundled languages

1. Download CheatAlarm.cs from My Plugins.
2. Drop it into oxide/plugins or carbon/plugins.
3. Grant the permission:

o.grant group admin cheatalarm.admin

The file name must stay CheatAlarm.cs — Oxide matches it to the class name.

Admins are not watched. To test on yourself, open /ca ui, press Server and switch on Include admins — while it is on, admins are watched even with cheatalarm.exempt. Switch it off afterwards, and cheatalarm.wipe <your id> in the console removes your test record.

Rust keeps only the last server.combatlogsize events per player (30 by default). Raising it (say to 200) lets /ca log look further back; CheatAlarm doesn't change it for you.

{
  "Score that puts a player on the watch list": 40.0,
  "Score that raises the alarm": 100.0,
  "Days for event points to fade to half": 14.0,
  "Most points one kind of event can add per day (red flags are not capped)": 30.0,
  "Watch admins too (for testing on yourself)": false,
  "Discord webhook URL for alerts (empty = off)": "",
  "Web address shown in the panel's About dialog (empty hides the footer)": "https://deadinten.uk",
  "Flags kept per player": 100,
  "Seconds one antihack violation episode lasts": 10.0,
  "Honeypot stashes": {
    "Points for uncovering one (a red flag)": 50.0,
    "Seconds before an uncovered honeypot buries itself again": 300.0,
    "Bait put in each new honeypot": {
      "scrap": 150,
      "metal.refined": 25
    }
  },
  "Traffic lights": {
    "Days of events a light looks back over": 7.0,
    "Event points in that time for amber": 6.0,
    "Event points in that time for red": 15.0,
    "Standard deviations above the server for amber (red is each statistic's own start)": 2.0,
    "Red lights at once that add the extra points": 2,
    "Extra points, at most once a day (0 = off)": 25.0
  },
  "Shots the game rejects (read from its combat log)": {
    "Read them": true,
    "Seconds one episode lasts (one flag per kind per episode)": 30.0,
    "Points per episode, by light": {
      "Eye": 2.0,
      "Projectile": 2.0,
      "Melee": 2.0,
      "Timing": 2.0
    },
    "Rejected shots kept per player": 200
  }
}

Commands

Chat

• /ca — the players with the highest scores
• /ca show <name|id> — one player's score, statistics and recent flags (/ca <name|id> does the same)
• /ca clear <name|id> — you've looked and they're clean: zeroes the score and restarts their statistics; the flags stay in the history
• /ca log <name|id> — the game's own combat log for that player, then every rejected shot CheatAlarm has kept, by reason
• /ca ui [name|id] — open the panel
• /ca overlay — switch the top-5 overlay on or off
• /ca stash — bury a honeypot stash where you are looking
• /ca stash list — every honeypot, where it is and who found it
• /ca stash remove — remove the nearest honeypot within 10 m
• /ca stash show — green dots at every honeypot within 1 km, through the ground, on your screen only

Console / RCON

• cheatalarm.top, cheatalarm.show <id>, cheatalarm.clear <id>, cheatalarm.log <id>, cheatalarm.stashes
• cheatalarm.wipe <id> — removes a player's flags, statistics, rejected shots and alerts too (console only; for tidying up after testing on yourself)
• cheatalarm.perf — what the tick hook, the aim checks and the ESP sampling cost

Permissions

• cheatalarm.admin — alerts, commands and the panel
• cheatalarm.exempt — never watched