Recon: The Next-Generation Remote Control tool for Minecraft

Recon is a modern, secure, and reliable REST API-based alternative to the traditional Minecraft RCON protocol. Designed for stability and ease of integration, Recon solves the common issues associated with RCON, such as connection drops, permission management difficulties, and inconsistent response handling.

Why Recon?

The name Recon stands for three core principles:

• Reliable-con: Built for stability. No more random connection drops.
• Response-con: Guaranteed command execution feedback.
• Rest-con: Uses a standard REST API (HTTP/JSON) for effortless integration with any modern platform.

Key Features

• 🚀 REST API Protocol: Ditch the clunky RCON packets for clean, standard HTTP requests.
• 🔒 Security: Every request and response is encrypted using AES. Includes Nonce and Timestamp validation to prevent replay attacks.
• 👥 Per-User Permissions: Manage API access for multiple users with individual settings for:
  • Whitelisted IP addresses.
  • OP privilege toggling.
  • Execution as a specific player.
• 📥 Command Queue: If a player is offline when a command is sent, Recon can queue it to execute immediately upon their next login.
• 🌍 Multi-Language Support: Built-in support for Arabic, German, English, Spanish, French, Hindi, Indonesian, Japanese, Portuguese, Russian, and Chinese.
• 🏗️ Multi-Platform Clients: Ready-to-use client libraries for PHP, Java, Python, JavaScript, TypeScript, Go, and Dart.
• ⚡ High Performance: Supports Paper, Folia (asynchronous), and BungeeCord/Velocity environments.

Installation

1. Download the latest Recon.jar and place it in your server's plugins folder.
2. Restart the server to generate configurations.
3. Configure the HTTP port (default: 4161) and other settings in config.yml.
4. Use the /recon command in-game to create your first API user.

User Storage Backend

By default, Recon stores users in users.yml.

You can switch to MySQL or MariaDB from config.yml:

Notes:

• migrate-from-yaml-on-first-run: true imports existing users.yml data into DB when DB table is empty.
• /recon reload also applies backend type changes and reconnects user storage.

Security & Protocols

Recon protects every command and response with application-layer encryption, so it provides meaningful security even without a TLS certificate. Two protocols are supported:

	v2 (recommended, default)	v1 (legacy)
Cipher	AES-256-GCM (authenticated encryption)	AES-256-CBC (no authentication)
Key derivation	PBKDF2-HMAC-SHA256 (configurable iterations)	single SHA-256
Tamper detection	✅ GCM auth tag	❌
Metadata binding	✅ user/nonce/timestamp bound as AAD	❌
Brute-force resistance	✅ slow KDF	❌ fast hash
Mutual authentication	✅ response proves the server knows the password	❌

Why v2 is secure without TLS:

• AES-256-GCM detects any tampering of the encrypted command/response (no padding-oracle).
• PBKDF2 makes offline password brute-force expensive even if traffic is sniffed.
• The AAD binds user, nonce, and timestamp into the ciphertext, so a MITM cannot alter them. Combined with nonce + timestamp replay protection, this gives strong protection on a plain HTTP link.

For maximum security, set security.allow-legacy-protocol: false in config.yml to require v2 from all clients. You may still place Recon behind a TLS-terminating reverse proxy and/or bind it to 127.0.0.1 via bind-address for defense in depth.

API Specification

Recon listens for POST requests at the root path (/).

Request Body (protocol v2)

{
  "user": "username",
  "protocol": 2,
  "iterations": 100000,
  "nonce": "random_string",
  "timestamp": 1234567890,
  "queue": true,
  "command": "AES_GCM_ENCRYPTED_COMMAND"
}

• protocol: 2 for the hardened protocol, 1 (or omit) for legacy.
• iterations (v2 only): PBKDF2 iteration count. Must be >= the server's security.pbkdf2-iterations floor and <= 1000000.
• queue is optional and defaults to false.
  • If allow-queue-for-all-users: true in config.yml, queue is enabled when request has queue: true.
  • If allow-queue-for-all-users: false, request queue: true is ignored by default.
  • Even when global setting is false, users with queue: true in users.yml can still use queue.

Protocol v2 cryptography

• Key: PBKDF2-HMAC-SHA256(password, salt = "<nonce>_<timestamp>", iterations, 32 bytes)
• Cipher: AES-256-GCM with a random 12-byte IV and 128-bit tag
• AAD: "<user>|<nonce>|<timestamp>"
• Wire format of command/response: Base64( IV(12) ‖ ciphertext ‖ tag(16) )

Legacy v1 uses SHA-256(password_nonce_timestamp) + AES-256-CBC with Base64( IV(16) ‖ ciphertext ).

Response Body

{
  "user": "username",
  "protocol": 2,
  "iterations": 100000,
  "nonce": "server_random_string",
  "timestamp": 1234567890,
  "success": true,
  "response": "AES_GCM_ENCRYPTED_RESPONSE",
  "plainResponse": "AES_GCM_ENCRYPTED_RESPONSE_NO_COLOR",
  "error": "Error message (only if success is false)"
}

The response is encrypted with the same protocol using the server's nonce/timestamp (and echoed iterations for v2), so the client can verify the server's authenticity.

Commands

Command	Short Form	Description	Permission
/recon create user:<name> password:<pw> [ip:<ip>] [op:<bool>] [player:<name>]　[queue:<bool>] [permission:<perm>]	/recon create u: pw: [i:] [o:] [pl:] [q:] [pe:]	Create a new profile for a specific user or player.	recon.create.other.*
/recon create password:<pw> [ip:<ip>] [op:<bool>] [queue:<bool>] [permission:<perm>]	/recon create pw: [i:] [o:] [q:] [pe:]	Create your own profile (target is yourself).	recon.create.own.*
/recon edit user:<name> [password:<pw>] [ip:<+/-ip>] [op:<bool>] [queue:<bool>] [player:<name>] [permission:<+/-perm>]	/recon edit u: [pw:] [i:] [o:] [q:] [pl:] [pe:]	Edit a specific user's profile. Use + or - for IPs/Perms.	recon.edit.other.*
/recon edit [password:<pw>] [ip:<+/-ip>] [op:<bool>] [queue:<bool>] [permission:<+/-perm>]	/recon edit [pw:] [i:] [o:] [q:] [pe:]	Edit your own connection profile.	recon.edit.own.*
/recon info [user:<name>]	/recon info [u:]	View profile details for yourself or another user.	recon.info.own / recon.info.other
/recon test	-	Test connection stability and credentials.	(None)
/recon reload	-	Reload configuration and language files.	recon.reload
/recon remove user:<name>	/recon remove u:	Remove a user connection profile.	recon.remove

• Permissions can be set to group.default, worldedit.*, etc.

---

Client Libraries

Check the examples/ directory for sample implementations in various languages:

• Dart
• Go
• Java
• JavaScript
• PHP
• Python
• TypeScript

Mobile Application

Recon is the Next-Generation Remote Control tool for Minecraft—an RCON alternative designed for both players and admins. 🚀 This plugin includes a function to automatically generate individual connection profiles for every player. These profiles allow players to enjoy a more streamlined gameplay experience by leveraging the application's shortcut capabilities. ✅ Shortcuts can be uploaded to the cloud and shared by entering an ID. ☁

Important

This application is a smartphone client for Recon. To use it, you must first install the Recon plugin on your server.

Get it on Google Play or App Store.

License

Copyright (c) 2026 Enabify. Licensed under the MIT License with additional restrictions regarding mobile application distribution. See LICENSE for details.

Note: Redistribution of this software as a mobile application on any digital app store is exclusively reserved for Enabify.