BASALT
The player runs it. They see everything it found. Nothing is sent automatically.
Basalt inspects a computer for the things staff look for during a manual screenshare — installed mods, resource packs, recently deleted files, running programs — and turns it into a report the player reviews before deciding whether to hand it over.
A tool that inspects someone's computer is only legitimate if it is transparent about it. These aren't features — they're the product.
No remote execution, no silent mode. Nobody can point Basalt at someone else's machine.
Every item collected is shown on the player's own screen, including every screenshot, before anything is written to disk.
There is no networking code in the app at all. The output is a local file that the player forwards themselves — or doesn't.
Every check has a toggle and a plain-English description. Declining one is recorded as a fact, never as suspicious.
"Trust me, it doesn't upload anything" is worth nothing on its own. So the test suite parses every source file in the package and fails the build if any networking import appears anywhere — sockets, HTTP clients, or otherwise. The same test blocks keylogging and clipboard libraries, credential-store filenames, and any call that deletes files or writes to the registry.
You don't have to take our word for it. Read the test, then read the code.
No setting enables any of this. It isn't in the binary.
Browser access is limited to two things: download-history metadata, and browsing history — which is opt-in and off by default, with an explicit warning that it's the most privacy-sensitive check available. Both are read-only, and both are shown to the player before export.
Every screenshare tool has this limitation. Most don't mention it.
Reports are signed and stored in a compressed binary format, so a player can't open one in Notepad and change a result — any edit is detected, and the Viewer shows a red banner.
But Basalt runs on the machine of the person being checked, and the signing key ships inside the binary. Someone determined enough can extract it, patch the build, or generate a clean report from scratch. That's a limit of any client-side tool, not a flaw specific to Basalt.
A green banner means "nothing obvious was altered". It does not mean "this machine is clean."
The only workflows that actually defeat a forged report are staff watching the scan happen, and server-side detection. Basalt makes a live screenshare far faster and more thorough than clicking through folders by hand — it doesn't replace one.
Windows, 64-bit. No installation and no Python required — both are self-contained executables.
Run by the player being checked. Produces the report.
Run by staff. Verifies and displays a report.
Every report records the SHA-256 of the Scanner that produced it. Staff can match that against the hashes below to confirm a report came from a real Basalt build rather than something dressed up to look like one.
| File | Size | SHA-256 |
|---|---|---|
BasaltScanner.exe | 56.2 MB | ee0b40c673487db61fea4b1b800447752fc22ed4c5c5f734c44587b00983968f |
BasaltViewer.exe | 207.2 MB | ba6ff3592864e88e2146f3eb347750fc3015a5aa21b010b3badcd69c430902dc |
On Windows: Get-FileHash BasaltScanner.exe -Algorithm SHA256
These builds aren't code-signed, so SmartScreen shows an "unrecognised app" prompt. That warning is accurate and you should treat unsigned downloads with suspicion in general — which is exactly why the source is public and the hashes are above. Check both before running it.
Every check is individually toggleable, and its description is shown before the scan starts.
| Check | What it reads |
|---|---|
| Minecraft Detection | Every install, every mod jar with its hash and mod id, keybinds and gamma |
| Log Analysis | The open instance's logs and its archived history |
| Resource Packs | Installed packs, plus texture analysis that detects X-ray packs |
| Process & Injection | Running processes and JVM -javaagent injection flags |
| Recent Files | Recently changed files in Downloads, Desktop, Temp and AppData |
| Recycle Bin | Deleted files with their original paths and deletion times |
| Deleted-File Traces | NTFS journal records of recently deleted files |
| Execution History | Windows Prefetch — evidence a program ran, even if since deleted |
| Startup & Tasks | Registry Run keys, Startup folder, Scheduled Tasks |
| Open Windows | Visible window titles — catches a cheat GUI directly |
| Explorer Recents | Recently opened files, even ones since deleted |
| USB History | Previously connected storage devices |
| DNS Cache | Cached lookups — catches cheat sites after history is cleared |
| Browser Downloads | Download metadata only: filename, source URL, time |
| Browsing History | Visited URLs — opt-in, off by default |
| Clock Check | Future-dated files, indicating clock tampering |
| Screen Captures | Screenshots of all monitors, spaced across the scan |
| System Snapshot | OS, hostname, timezone, uptime |
Basalt doesn't decide whether a mod breaks your server's rules — rules vary far too much for that, and guessing produces false positives that teach staff to ignore the results.
Instead it lists everything, marks known cheat clients as alerts, marks recognised-legitimate mods as such at any version, and marks anything unrecognised as "a human should glance at this." Unknown is not the same as malicious. You apply your own rules.