
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
craftlink
Advanced tools
A Discord bot to control a Minecraft server remotely.


/say from In-Game POV
While there is some validation around the commands sent to the server, it is important to note that it is likely not secure.
It is very possible that this could be abused to send and execute malicious code!
Since this connection gives full control over a Minecraft server and it's various properties and settings, the bot requires and is limited to a single Discord channel within a Discord server.
It is recommended this channel be private and limited to only server admins and moderators.
Granular permissions based on Discord role may come eventually...!
Requires Python 3.9+.
Install via pip install craftlink.
Or, clone and run poetry install to install from source.
You'll need to download the Bedrock Server, or the Java server.
You'll probably want to run your server manually first to configure your world. You can migrate an
existing local world to be a server pretty easily by copying the world data into
<server_directory>/worlds (Bedrock), or replacing the <server_directory>/world folder (Java).
Currently supports Windows and Linux (tested on Debian).
Likely works on MacOS, but not yet tested.
To run locally, just invoke craftlink with the necesary arguments/environment variables set.
Required arguments:
-t, --discord-bot-token, DISCORD_BOT_TOKEN - Token to use to authenticate the Discord bot.-c, --discord-channel-id, DISCORD_CHANNEL_ID - Discord channel ID to target the bot's messages to.-d, --server-install-directory, SERVER_INSTALL_DIRECTORY - Directory that the server executable is in.Optional arguments:
-y, --server-type, SERVER_TYPE - Type of server to be run ("bedrock" or "java"), defaults to bedrock.-m, --java-memory-min, JAVA_MEMORY_MIN - (Java only) minimum server memory to allocate, defaults to 1024.-x, --java-memory-max, JAVA_MEMORY_MAX - (Java only) maximum server memory to allocate, defaults to 1024.-is-arm64, IS_ARM64 - Flag to indicate running on arm64 architecture.You must use the switch --isarm-64 and set the environment variable IS_ARM64
so the command is dispatched correctly.
The Bedrock binary is meant for x86_64 architecture; to get it to run
on arm64 devices, box64 emulation is used.
If building the Bedrock Docker image, specify --platform=linux/arm64 and
box64 will be installed automatically.
Otherwise, ensure your system has box64 installed and available in the PATH.
(Shoutout to this issue comment
from docker-minecraft-bedrock-server
for pointing me in the right direction here.)
To run in a Docker container, you'll need to ensure your .env file is populated first.
Copy .env.template and fill in the blanks.
Ensure that SERVER_INSTALL_DIRECTORY is the directory to your local server files, not
the directory in the Docker image.
By default this image will mount existing server files from the host machine to the container. Note that for Bedrock, you only need to have the below files and folders, you don't need the executable/binary.
allowlist.jsonpermissions.jsonserver.propertiesworldsFor Java, the entire directory will be mounted.
Regardless of server type, ensure you run the world locally once before mounting it.
When ready, run docker compose up <server_type: java or bedrock> to run.
/say.In no way affiliated with Microsoft or Mojang (that'd be dope though, feel free to reach out, folks).
FAQs
A Discord bot to control a Minecraft Bedrock server remotely.
We found that craftlink demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.