Article
Why a suspicion score should never be enough to ban
A number between 0 and 100 has something reassuring about it: it looks objective, it settles things, it avoids an argument. That is exactly why you should never stop there. Here is what each indicator in an x-ray score cannot prove on its own, and what a score is actually for.
A score does one thing: sort, not judge
A suspicion score adds up several imperfect indicators into a single number. That is useful for one specific reason: on a server with dozens of active miners, you have to decide where to start looking. It is useful only for that. The number itself knows nothing of the player, the context, or the explanation they might give if asked.
Every indicator, taken alone, has a known blind spot
This is not a hidden weakness: it becomes obvious as soon as you ask what each indicator actually measures, rather than what you hope it measures.
| Indicator | What it is meant to catch | What honestly produces the same signal |
|---|---|---|
| Ore yield per blocks broken | A player finding more than digging blind could explain. | A player exploring a cave and picking up ore that is already exposed — see why caves fool detectors. |
| Ore mined with no visible face | An ore reached without any natural cavity having revealed it. | Any ordinary miner in virgin stone: they are blind by construction on every block, and it is only a signal when applied to a session claiming to be a cave traversal — see detecting an x-rayer in caves. |
| Detour towards a vein | A change of direction towards a target that could not be seen. | A player pausing for an entirely different reason — a redstone circuit, a marker placed earlier, a round trip to their base — then resuming their route by coincidence. |
| An outlier session | A result too high to be explained by luck. | Luck itself: across enough sessions and enough players, an exceptional evening always ends up happening to someone honest. |
None of these indicators is useless. The problem only appears if any one of them, alone, is allowed to decide.
The single-threshold trap
Faced with a noisy indicator, the instinct is to raise the trigger threshold until the awkward cases disappear. It always works — and it always hides something else at the same time: a careful cheater does not aim for an extreme yield, they aim for just under the threshold you just raised. With a single threshold, there is often no setting that cleanly separates the two populations, because they genuinely overlap — not because of bad calibration.
"Not enough evidence" must mean "we don't know," not "round it up against them"
An indicator computed from a single event — a single vein, a single turn, a single session — is not a measurement, it is a coin flip. The right response is not to round it one way or the other: it is to recognise there is not yet enough material for that number to mean anything, and to leave it out of the verdict rather than letting it weigh in as if it were reliable.
A system that always answers the question "what is their score?" — even when the only data available is a single vein spotted once — creates the illusion of a precise answer where the honest answer is "we don't know yet."
Why you need at least two independent signals
A strange path, on its own, is still just a strange path: it has an innocent explanation in a non-trivial share of cases. What becomes hard to explain any other way is when several indicators that do not measure the same thing point together in the same direction — an abnormal yield and blocks never seen and a path that goes straight to the point. Any one of these three could be a coincidence. All three at once, much less often.
The full method How to detect an x-rayer with CoreProtect: cross-checking at least two independent signals →What a score cannot know
- The player's reputation. A trusted regular of two years and an account created yesterday should not be treated the same, and a score does not tell them apart.
- The announced context. A player who said they were going off to explore a big cave, or who is streaming their session, needs no algorithm to be cleared.
- Their explanation. The only way to get an explanation is to ask a human — a score never asks anything, it computes.
- The consequences of a mistake. Wrongly banning a legitimate player costs the trust of everyone who knows them; that spreads faster than an apology.
So what is a score actually for
Exactly what a human cannot do at the scale of an entire server: read back dozens of mining sessions and surface first the ones that genuinely deserve a look, with the indicators that explain why each one surfaced. Triage buys back the time an investigation needs; it never replaces the investigation itself.
A score, a counter or an alert exist to decide what to look at, never to decide a sanction. The decision belongs to a human who opened the case, cross-checked at least two independent signals, and gave the player a chance to explain themselves.
What to remember
- A score adds up imperfect indicators: it sorts, it does not judge.
- Every indicator taken alone has a known legitimate case that produces the same signal.
- Raising a single threshold hides as many careful cheaters as it hides false positives.
- An indicator computed from a single event should be left out, not rounded up against the player.
- You need at least two independent signals pointing the same way.
- A score knows neither the player's reputation, nor their context, nor their explanation.
- The final decision always belongs to a human.
This is the principle that guides TunnelVision
TunnelVision never bans, never automatically alerts a player, and never computes a score from an indicator that lacks enough material to be reliable. Every session that surfaces comes with the detail of the indicators explaining its ranking — never with a ready-made verdict. The decision stays entirely yours.