What Is ServerConfigCleaner and Why Every Server Owner Needs It
Running a Minecraft server with mods is a fantastic way to create unique multiplayer experiences, but it comes with hidden security risks that many administrators overlook. One of the most dangerous quirks involves how both NeoForge and MinecraftForge handle server configuration files. By default, these modloaders synchronize the entire content of all "server configs" to every client that joins. While that sounds harmless, some mod developers accidentally placed secret values like Discord bot tokens, API keys, or database passwords inside those files. ServerConfigCleaner is a lightweight mod that steps in to scrub those sensitive entries before they ever leave your server, keeping your private data truly private.
The Silent Danger of Automatic Config Sync
When a player connects to a modded server, the server sends a copy of its configuration files to the client. This ensures that everyone sees the same recipes, world generation rules, and balance settings. The problem is that the sync process does not distinguish between a harmless option like "maxPlayers" and a critical secret like a Discord bot token. If a mod stores its bot token in a server config, that token is broadcast to every single player who joins. A malicious user can easily extract it, hijack your bot, and wreak havoc. Even well-known mods have fallen into this trap simply because the naming convention of server configs does not clearly indicate that their contents will be shared.
How ServerConfigCleaner Protects Your Secrets
This mod works in two intelligent stages to stop leaks without breaking any functionality. First, during server launch, it scans all server configuration options using a rough heuristic to detect entries that might contain sensitive information. Because the heuristic is deliberately broad, it will flag many false positives – completely safe options that just happen to match a pattern. For example, an option like logistics.seatHostileMobs in Create might be flagged because it contains the substring "Host". That’s harmless, but the mod doesn’t know that yet.
After the initial scan, ServerConfigCleaner requires you to classify each flagged option in its own configuration file, config/serverconfigcleaner-common.toml. You’ll add false positives to a list so they are ignored, and you’ll place genuinely sensitive keys in a doNotSync list using the format doNotSync = ["mymod:discord.token"]. The mod ships with a built-in set of known false positives and known problematic options, so in most cases you won’t have to lift a finger. The launch will proceed smoothly once all found values are classified.
In the second stage, whenever the server prepares to sync its configs to a client, ServerConfigCleaner intercepts the data. Any option that you marked as sensitive is replaced with its default value before transmission. Since developers typically set a meaningless default like "INSERT BOT TOKEN HERE", the client receives that placeholder instead of the real secret. Your server keeps using the actual token internally, but no player ever sees it.
Version Compatibility Made Clear
Because ServerConfigCleaner supports a wide range of Minecraft versions and two different modloaders, its versioning scheme can look confusing at first glance. Here’s a straightforward breakdown to help you grab the correct file:
- MinecraftForge 1.13.2 – 1.16.5: Use the version suffix
-1.13.2 - MinecraftForge 1.17.x – 1.20.1: Use the version suffix
-1.17.1 - NeoForge 1.20.1: Use the version suffix
-1.17.1 - MinecraftForge 1.20.2 and newer: Look for the suffix
-1.20.2-mcf - NeoForge 1.20.2 – 1.20.5: Pick the file ending with
-1.20.2-neo - NeoForge 1.21.0 and above: Grab the version tagged
-1.21.0-neo
Always double-check that the modloader matches your setup, because a Forge file will not work on NeoForge and vice versa. If you’re using a modern launcher like the foxygame.net launcher, you can simply search for ServerConfigCleaner in the built-in mod browser and install it with a single click, automatically matching the correct version to your instance. That convenience saves you from manually hunting down files and worrying about loader mismatches.
Classifying Options and Avoiding Launch Blocks
When you first add ServerConfigCleaner to a modpack, the server will pause during startup if it discovers any unclassified options. This is by design – the mod refuses to let the server run until every potential secret is accounted for. The configuration file will list all detected entries, and you must move them either to the false positives list or the doNotSync list. The mod’s default lists already cover many common cases, so you’ll likely only need to intervene if you’re using obscure or freshly updated mods. Once everything is sorted, subsequent launches will be seamless.
For server admins who worry about forgetting to update the config after adding new mods, the mod’s strict launch check acts as a safety net. It forces you to review any new server config options before they can be accidentally synced. This proactive approach means you never have to wonder whether a secret slipped through.
Reporting Missed Values Responsibly
If you encounter false positives that are not in the default list, the mod author encourages you to open an issue on the project’s repository so they can be added for everyone’s benefit. However, if you discover a genuinely sensitive option that is missing from the default set of protected values, do not post it publicly. Instead, contact the developer directly through Discord (malte0811) or via email (available on the GitHub profile), or reach out to ThatGravyBoat on Discord (thatgravyboat). This private disclosure ensures that the vulnerability is patched without exposing any real tokens or keys.
Why This Mod Is a Must-Have for Every Modded Server
ServerConfigCleaner fills a critical gap that neither Forge nor NeoForge addresses on their own. It operates with minimal performance overhead, requires little configuration once the initial classification is done, and completely eliminates the risk of leaking sensitive data through config sync. Whether you run a small private server for friends or a large public network, the peace of mind it offers is invaluable. Pair it with a modern launcher that simplifies mod management, and keeping your server secure becomes a background task rather than a constant worry. By scrubbing secrets before they ever reach a client, this mod turns a dangerous design oversight into a fully controlled process.