Article
Anti-xray false positives: why caves fool detectors
You install an x-ray detector on your Minecraft server, and the alert list fills up with players who did nothing wrong. Check them and it is nearly always the same profile: they were exploring a cave. This is not a tuning problem — it is a fundamental limit of the way most detectors measure suspicion.
The "ore per 100 blocks broken" ratio
Almost every anti-xray detector, including those built on CoreProtect logs, rests on the same idea: count the ore a player collects, divide it by the number of blocks they broke, and raise an alert above a certain threshold.
The intuition is sound. A player digging blind through solid stone breaks a lot of blocks to find little ore: their yield is low and, above all, steady. A player who can see through blocks goes straight to the point: they break little and collect a lot. The yield spikes, the alert fires.
The problem is that this reasoning assumes something nobody ever checks: that the ore was hidden inside stone to begin with. In a cave, it is not.
In a cave the ore is already exposed on the walls. The player picks it up without ever having to dig to reach it — the denominator of the ratio stays tiny while the numerator climbs. Mathematically, a cave explorer produces exactly the signature we attribute to an x-rayer.
That is why a perfectly honest player can blow past any "diamonds per 100 blocks" threshold without cheating once: they did not dig, they bent down and picked it up.
What Caves & Cliffs made worse
The 1.18 underground rework made the phenomenon far more common. Caves became much larger and much more numerous, with cave biomes exposing considerable surfaces of rock. Mechanically, the share of ore that is naturally visible, without breaking anything, went up a great deal.
The direct consequence for moderation: a detector whose thresholds were calibrated back in the era of small caves became much noisier after 1.18, without a single change in its code or in player behaviour.
The four terrain types that trigger the most false positives
| Terrain | Why it fires |
|---|---|
| Large caves | Dozens of ores visible on the walls, reachable on foot. Enormous apparent yield, almost no blocks broken. |
| Ravines | They cut vertically through many terrain layers: a single ravine exposes ore across the whole height, deep levels included. |
| Abandoned mineshafts | The corridors already run through the rock. The player harvests along existing tunnels, exactly the way an x-rayer would harvest along tunnels they had dug. |
| Amethyst geodes | A dense volume of valuable blocks concentrated in one place, in a single short session — the perfect spike for a counter that only looks at quantities. |
Why raising the threshold fixes nothing
The natural instinct, when faced with too many alerts, is to raise the trigger threshold. It works: the false positives disappear. But something else disappears with them.
A careful x-rayer does not strip the map. They take just enough to stay credible — often at a yield lower than that of a player who has just walked into a good cave. By pushing the threshold above the noise from caves, you mechanically push it above them as well.
With a single threshold on yield, there is no setting that cleanly separates the two populations: they overlap. This is not a badly placed slider — it is an indicator that measures the wrong thing.
How to check an alert by hand with CoreProtect
Before sanctioning anyone on the word of a counter, the question to settle is simple: was the ore reachable without digging? CoreProtect logs can answer it.
1. List what the player actually broke
/co lookup u:PlayerName a:-block t:7da:-block keeps only blocks that were broken (not placed), over the last 7 days. What matters here is not the number of ores but the share of ordinary rock in the list: stone, deepslate, tuff, granite.
- Lots of rock for little ore → the player dug to move forward. Classic mining profile.
- Almost only ore, very little rock → they did not need to dig to reach it. That is the signature of a cave harvest… but also of x-ray. This indicator alone settles nothing — move on to the next step.
2. Look at the surroundings of a find
Note the coordinates of one of the ores in the list, go there, and inspect the area:
/co lookup a:-block r:8 t:7dThe 8-block radius around the point tells you whether the player opened a passage up to the ore, or simply arrived through space that was already open. Finish with your own eyes, in spectator mode: is there a natural cavity there? Ore bordered by pre-existing air was visible to everyone — ore that was surrounded by solid rock was not.
3. Beware of what the logs do not show
CoreProtect logs the blocks broken, not what the player could see. A tunnel that passes close to a vein without touching it, a turnaround just short of an ore, a descent that stops exactly at the right layer: none of those signals show up in any counter, and they are often the most telling ones.
Going further How to detect an x-rayer with CoreProtect: the full investigation method →What actually separates an x-rayer from an explorer
The underlying difference is not how much the player collected, but the shape of what they dug:
- The volume dug out. An x-rayer opens narrow corridors through intact rock. An explorer moves through empty space that already existed. Rebuilding what was broken separates those two cases where a plain counter merges them.
- Blocks broken relative to distance travelled. Crossing 200 blocks of cave costs virtually zero broken blocks; crossing 200 blocks of solid stone costs at least 200 broken blocks.
- Was the ore touching pre-existing air? That is the question separating "visible to anyone" from "invisible without cheating". It is answered block by block, not on average.
- The detour and the return. Leaving a straight corridor, going after one specific vein, then coming back exactly onto the corridor's axis: that pattern does not happen by chance, and it is the hardest one to fake for anyone trying to pass as an honest miner.
None of these four signals can be derived from an ore total. All of them can be derived from the path.
Key points
- Cave false positives are not a tuning flaw: they come from the ore-to-blocks ratio wrongly assuming the ore was hidden.
- 1.18 amplified the phenomenon considerably by exposing far more ore naturally.
- Raising the threshold removes the false positives and the careful real cheaters: the two populations overlap.
- The question that settles it is always the same: was the ore reachable without digging?
- Any score is only a triage aid. The decision belongs to a moderator who looked at the case.
TunnelVision works on exactly this problem
TunnelVision reads back your CoreProtect history, rebuilds mining sessions and reasons about the shape of the paths rather than an ore counter — cave sessions, surface gathering and overly short sessions are filtered out before they reach your list. Every session that comes back carries the indicators that explain its score, never an automatic sanction.