Fast local security engine active

Defend Your Server. Scan Every Plugin.

Fast local malware screening for Minecraft plugins and common archive formats. Files stay on your device while the scanner checks 150+ security rules, metadata, hashes and encoded indicators.

Start Scan Join Community
150+
Security Checks
100%
Local Processing
0
File Uploads
3
Scan Modes
Local scan · 150+ checks · Context-aware detection · No upload
// CORE SCANNER

Upload & Analyze Your Plugin

Drag & drop your .jar file for instant deep security analysis — 150+ security checks, plugin.yml parsing, hash verification

AngkorDev Scan PRO — Local Threat Intelligence Engine
ONLINE
SENTINEL PRO All engines active 150+ security checks · Plugin.yml parser · Hash verify · Unlimited scans
Context-aware detection · Static analysis · Archive/PE/script scan · Targeted raw-byte scan
SMART SCAN MODE
Smart mode balances speed and accuracy. Best for normal plugin checks before installing on your server.
Engine: Local UniversalQueue: 0Last scan: —
QUICK TOOLS
Batch ScanDrop multiple .jar, .zip, .exe, .dll, .bat, .ps1 and more.
Context RulesLess false-positive results.
Encoded ScanDecodes Base64 / hidden URLs.
Clean ReportExport JSON, CSV, TXT, summary.
BATCH QUEUEWaiting
Drop any file to scan
or click to browse · .jar .zip .rar .ror .exe .dll .bat .ps1 .apk .7z and more · up to 100MB each
JAR/ZIP/APK/EXE/SCRIPT · SHA-256/MD5 · Local static scan
plugin.jar — scanning in progress
Initializing...0%
0
RISK %
Plugin Scan Report
Threats 0
Security Verdict
Ext. URLs 0
Classes 0
SECURITY VERDICT
// CLASS DECOMPILER

Plugin Code Viewer

Browse all classes inside your .jar — view bytecode strings, threat highlights, line numbers, in-file search

No file loaded — scan a file above
CLASS FILES
Select a file from the tree
Select a class file to view bytecode strings and threat analysis
// CAPABILITIES

What AngkorDev Scan Detects

150+ security checks across 14 categories — the most comprehensive Minecraft plugin security scanner

Backdoor Detection
Detects hidden chat triggers, console injection, OP self-grant, LuckPerms escalation, UUID-based attacker accounts, sign/book/inventory backdoors, PacketListener abuse.
Chat TriggerOP GrantUUIDVelocity
Data Exfiltration
Context-aware Discord webhook detection (confirms only malicious when paired with data-harvesting). Also detects Telegram, Slack, GitHub Raw, Pastebin, Hastebin, ngrok tunnels, Tor.
DiscordTelegramSlackTor
Command Execution
Detects Runtime.exec, ProcessBuilder, shell execution chains, ScriptEngine eval, GroovyShell, ProcessHandle kill, and all common OS command execution patterns.
Runtime.execGroovyScript
150+ Threat Checks
Expanded pattern library covering obfuscation (AES, XOR, Base64, char arrays, split strings), anti-analysis (debugger detection, time bombs), crypto miners, SSH injection and persistence.
AES/XORMinerSSHPersist
Plugin.yml Parser
Automatically extracts plugin metadata — name, version, author, main class, API version, dependencies, and all declared commands. Displayed in a clear info panel beside results.
NameVersionCommands
Hash Verification
Computes SHA256 and MD5 hashes of the uploaded .jar file directly in-browser. Compare against known-good or known-malicious hash databases to verify plugin authenticity.
SHA256MD5Verify
Advanced Decompiler
Optimized ASCII and UTF-16LE string extraction with chunked raw-byte checks, syntax highlighting, line numbers, in-file search and jump-to-threat navigation.
Chunked ScanLine NumsSearch
Export Reports
Export full scan results as structured JSON (for SIEM/automation), CSV (spreadsheet), or plain-text report. Share via auto-generated link with encoded scan summary.
JSONCSVTXTShare
// SECURITY ARCHITECTURE

Fast, Local and Evidence-Based

The scanner prioritizes useful evidence instead of fake live statistics or unsupported safety promises.

Private Local Processing
Files are analyzed inside your browser. JAR, ZIP, APK, scripts and supported binaries are not uploaded by this page.
Context-Aware Verdicts
Common APIs and webhooks are evaluated with surrounding credential, command, network and persistence indicators to reduce obvious false positives.
Reviewable Evidence
Every result includes the affected entry, threat category, extracted indicators, hashes and exportable reports for manual verification.
// PLANS

Simple Pricing

Free for individual server owners. PRO for teams and enterprises.

FREE
$0/mo
For individual server owners
  • ✓5 scans/day
  • ✓60+ threat patterns
  • ✓Basic decompiler
  • ✓JSON export
  • ✗Plugin.yml parser
  • ✗Hash verification
  • ✗150+ checks
MOST POPULAR
SENTINEL PRO
$9/mo
For serious server admins & security teams
  • ✓Unlimited scans
  • ✓150+ security checks
  • ✓Plugin.yml parser
  • ✓Hash verification
  • ✓Advanced decompiler + line #s
  • ✓JSON / CSV / TXT export
  • ✓Priority threat feed
ENTERPRISE
$49/mo
For hosting providers and large networks
  • ✓Everything in PRO
  • ✓REST API access
  • ✓Bulk scan endpoint
  • ✓Webhooks & SIEM integration
  • ✓Custom threat rules
  • ✓SLA + priority support
  • ✓Self-hosted option
// REST API

Developer API

Integrate AngkorDev Scan into your hosting panel, Discord bot, or CI/CD pipeline

POST /v1/scan Upload and scan .jar, .zip, .exe, .dll, .apk, scripts and archives
curl -X POST https://api.angkordev.pro/v1/scan \ -H "Authorization: Bearer YOUR_API_KEY" \ -F "file=@plugin.jar"
Response:
{ "score": 85, "verdict": "BACKDOOR_DETECTED", "threats": [{ "label": "Discord Webhook Exfiltration", "severity": "critical" }], "sha256": "a1b2c3...", "classes": 42 }
GET /v1/scan/:id Retrieve a previous scan report
curl https://api.angkordev.pro/v1/scan/scan_abc123 \ -H "Authorization: Bearer YOUR_API_KEY"
// FAQ

Frequently Asked

Does the .jar file get uploaded to a server?▼
No. All scanning is done entirely in your browser using JavaScript and JSZip. ZIP/JAR/APK files are opened locally, EXE/DLL/scripts are analyzed locally, and your files never leave your machine.
Can it scan obfuscated plugins and EXE files?▼
Yes. The scanner extracts ASCII and UTF-16LE strings, checks encoded signals, and performs a targeted raw-byte scan across the complete file. This helps detect hidden URLs, Base64 signals, suspicious commands and common obfuscation indicators.
Why does a Discord webhook trigger only a WARNING sometimes?▼
Because many legitimate plugins use Discord webhooks for admin notifications. The scanner escalates a webhook to CRITICAL only when it appears with credential, token, configuration or host-data harvesting indicators. A standalone webhook remains a WARNING for manual verification.
What does the risk score mean?▼
0–10: Clean. 11–45: Low risk (warnings only, investigate). 46–79: Suspicious (critical indicators found). 80–89: Dangerous. 90–100: Backdoor/Malware detected. Scores ≥80 trigger automatic red-alert banners.