Skip to main content
Log inSign up

Forensic screenshare

For game server staff: Ocean reads the traces a cheat leaves on a player's PC, including the ones they tried to hide.

Start a scanRead the documentation

Windows and Linux

Supported games

How a screenshare scan works

Three steps, from a suspicion to a decision you can defend.

  1. Create a pin

    Generate a pin in the dashboard and send it to the player.

  2. The player runs the scanner

    They download the client and enter the pin.

  3. Read the result

    The result opens in your dashboard as soon as the scan ends.

Everything your staff needs in one report

The verdict, the traces that back it and the player's history, side by side.

Player risk
A risk score for the player, with the history of the player's earlier scans.
Cleaning score
Signs that the PC was cleaned before the scan, rated from none to high.
Forensic timeline
Every event on the PC before the scan, in order, on the PC's own clock.
Alt account map
Every device and account linked to the scan, scored by how strongly they connect. On paid plans.
AI opinion
A written read of the detections, warnings and suspicious activity, in the language you pick.
Scan comparison
Two scans of the same player side by side, with what appeared and what disappeared.
Screenshot
A screenshot taken during the scan, next to the findings.
Export
A complete report to download and keep as proof behind a ban.

Deep checks beyond running processes

Each check is documented in the detection docs, so your staff knows exactly what a result means.

Recovery
Files deleted before the scan are recovered on NTFS and FAT32.
Antivirus correlation
See which file the antivirus flagged, the detection type and when it was flagged.
Memory analysis
Volatile memory is checked during the scan, not only what is left on disk.
RUIN mode
Detects the slightest modification to a Minecraft Java instance. Ocean+ only; the game closes at the end of the scan.
Engines
Ranks unknown executables through VirusTotal so new cheats and bypasses do not slip by. Uses your VirusTotal API key from the dashboard.
Untrusted files
Executables with many VirusTotal flags are listed separately for manual review.

A clear verdict for every finding

Ocean sorts what it finds so your team knows what is proof, what needs a look, and what is someone covering their tracks.

  • Legit
  • Suspicious
  • Cheating
Detect logs
Confirmed detections: direct residues of a known cheat, generic highly suspicious executables, and specific tampering methods.
Warning logs
Modifications that can be used to evade detection but are not proof on their own. Your server decides the penalty.
Suspicious logs
Executables flagged with a reason: packers and protectors, .NET tooling, VM checks, macro tools. Read the reason, then check manually.
Bypass routes
Execution from a network share, an external device such as a phone, or straight out of a RAR archive is flagged as a bypass method.

An hour on a call, or about a minute

A manual screenshare ties up a staff member and a player, and still ends on a guess.

What gets checked
Manual screenshare: Whatever the staff member thinks to open
Ocean: What is running and what ran before the scan
Staff needed
Manual screenshare: One staff member per player, on a call
Ocean: None while the scan runs
Who can review it later
Manual screenshare: Only whoever was on the call
Ocean: Anyone on your staff, from the dashboard

If a tool only looks at what is running, a cheat closed five minutes before the scan never shows up.

Custom detections for your server

Write your own detection strings, configs and scan screens. Ocean encrypts them and ships them to the client, so every server runs the checks it needs.

Included with every paid license
Detection strings
Your own strings, matched on the player's machine.
Configs and rules
Your own rules for what each scan checks.
Scan screens
Your server's own screen inside the scanner.

Discord and API integrations

Where your community lives.

Twelve Discord addons support scan workflows, results, bans and team collaboration.

Explore the community (opens in a new tab)

Ocean API.

RESTful access to scan data, risk scores, and detections. API keys need an active license or Enterprise membership. PIN creation is Enterprise owner only. /v1/version stays public.

  • GETscanned-users lookup
  • GETuser risk score
  • GETpin results & status
  • POSTpin create
  • GETDB query
  • GETversion
Read API documentation

Ocean speaks MCP

A remote MCP server lets Claude, Cursor and other AI agents look up scanned users, risk scores, scan PINs and the cheater database.

.mcp.json
{
  "mcpServers": {
    "ocean": {
      "type": "http",
      "url": "https://api.anticheat.ac/mcp"
    }
  }
}
  • Streamable HTTP transport
  • OAuth 2.1 with PKCE
  • Dynamic client registration

Tools and scopes

  • lookup_scanned_userscanned-users:lookup
  • get_user_risk_scoreuser:risk-score
  • create_scan_pinpins:create
  • get_scan_pin_statuspins:status
  • get_scan_pin_resultspins:results
  • query_cheater_databasedb:query
  • get_client_versionpublic

Scopes follow the same license rules as API keys.

Read the MCP documentation

Frequently asked questions

Something else? Ask in our Discord (opens in a new tab)

Is Ocean free?

Ocean is free for Minecraft: three pins a day with a linked Discord account, one pin a day without. Every other game needs a paid license, which comes with unlimited pins.

Can a player close Ocean during the scan?

No. Ocean runs as a protected process, so it cannot be closed from Task Manager while it scans.

What is Ocean+?

Ocean+ is the Minecraft module, built for 1.9 and later, with more than 800 detection types that look at behaviour instead of fixed signatures, for a one-time payment.

What does a scan collect?

The system version, hashed hardware identifiers, records of what ran and when, and the state of the game's processes. The privacy policy lists every item.

What payment methods do you accept?

Cards, PayPal, crypto, PaySafeCard, Pix, Mercado Pago and other local methods. The pricing page has the full list.