How to screenshare a Minecraft player for cheats

A Minecraft screenshare is when server staff check a suspected player's PC for cheats, not a live stream of their screen. With Ocean it takes four steps: staff generate a pin, the player downloads the scanner and enters the pin, the scan reads the PC, and staff review the report before they decide on a ban.

Ocean Anti-Cheat is a forensic screenshare tool for game server staff that reads the traces a cheat leaves on a player's PC, including the ones they tried to hide, and Minecraft Java is the one game it covers for free. The steps below follow Ocean's own flow, as the downloads page, the pricing page and the Minecraft detection docs describe it.

Step 1: Generate a pin

In the Ocean dashboard, click Generate PIN, select Minecraft Java as the game and generate the pin. Then send the player the code, the link or the QR. The pin has eight characters. Pins expire, so generate one when the player is ready to scan.

You can start without paying. On the pricing page as of 2026-11-06, the free plan gives three pins a day with a linked Discord account and one pin a day without, with online report review. Ocean+ costs $12 once and removes that cap, and Enterprise gives 10 slots for $84.99 every six months for a staff team.

Step 2: The player downloads the scanner and enters the pin

The player opens anticheat.ac/downloads, picks Windows or Linux, enters the eight-character pin and runs Ocean as administrator on the PC they play on. Before the scan starts, tell them what it reads: the privacy policy lists every item, including the desktop screenshot taken when the scan starts. If Ocean will not start, the downloads page has the fix for the Visual C++ runtime error.

Step 3: Let the scan run

A typical scan takes about 60 seconds. Hardware, system activity and the detection rules you enable can change the duration. Ocean runs as a protected process, so the player cannot close it from Task Manager while it scans.

The scan reads what ran before it started as well as what is running now, so a client closed five minutes earlier still leaves traces. These Minecraft detect logs show what it looks for in the game:

• ÆGIR Touch (Ocean+): a generic protection against cheats that use malicious internal functions in Minecraft Java. A scan that triggers it concludes that the player is using illegal modifications.
• Generic Clicker (JNativeHook): a generic autoclicker that uses JNativeHook imports, usually seen in autoclickers made with Java.
• Generic JVM/JVMTI Injection: cheats that execute instructions using JVM and JVMTI.
• Generic Modifications: changes to the files the game has loaded.
• Jnic Obfuscator Functions: a loaded mod obfuscated with JNIC, so its code cannot be read. It is highly suspicious and needs a manual check.
• Anomalous Class Detected: classes that are obfuscated, packaged or outside the inheritance tree of a normal Java application. The docs note that it can rarely false-flag on closed-source modloaders such as Lunar Client or Badlion Client.
• Generic Internal SelfDestruct [Type C]: an internal cheat that destroyed itself.

The integrity checks add Generic Packed Mods, for mods with obfuscation or suspicious modules, and RUIN mode, which detects the slightest modification to the game instance. With RUIN, the player has to close the game at the end of the scan. ÆGIR and RUIN come with Ocean+, not with the free plan.

Step 4: Review the report and decide

The result opens in the dashboard as soon as the scan ends. For Minecraft, the report also lists the Minecraft mods found on the system and a Java Connection Log, with the server connections and disconnections logged since the last boot, so you can see which servers the player joined. Ocean then sorts what it finds so staff know what is proof and what needs a look:

• Detect logs are confirmed detections: direct residues of a known cheat, generic highly suspicious executables and specific tampering methods.
• Warning logs are modifications that can be used to evade detection but are not proof on their own. Your server decides the penalty.
• Suspicious logs are executables flagged with a reason, such as packers and protectors, .NET tooling or macro tools. Read the reason, then check manually.

If you are choosing a tool, see how Ocean compares with Echo and Detect.ac. If your community also plays other games, read how to PC check a player on FiveM or how to PC check someone for cheating on Roblox.