Dash

Dash is a self-hosted web admin dashboard for Minecraft servers.

Run a server without juggling terminal windows, FTP clients, config folders and disconnected admin plugins. Dash puts live performance, console access, player care, files, backups, reports, permissions, updates and recovery tools into one responsive browser workspace.

Dash is built as a family of native server dashboards:

Each local dashboard is designed to manage the server it actually runs on. NeoDash is optional: use it when you want fleet-wide visibility, provisioning and signed handoff between multiple Dash-connected servers.

New in 5.0

Dash 5.0 is the biggest release so far: a new Material 3 Expressive interface in 14 languages, a standard MCP server instead of a built-in AI, a much more careful Autopilot, a complete security layer, and operations and community tools that run your server for you.

• Material 3 Expressive interface on every page, with phone layout, dark and light themes and 14 languages
• Autopilot: explained, guarded, undoable automatic fixes with learning statistics and your own rules
• AI access (MCP): connect Claude, ChatGPT-compatible clients, Cursor or scripts through scoped API tokens, off by default
• Security: two-factor login and passkeys for everyone, session overview with new-device alerts, IP allow-list, signed audit log, guided secret rotation
• Operations: scheduled restarts with countdown, one-click maintenance mode, lag detective, update manager with trial run and rollback, encrypted offsite backups with automatic restore test
• Community: public status page, whitelist applications, ban appeals, chat moderation, GDPR export and erase
• No more beta: Intelligence, Maintenance and Guardian are regular features; the internal Dash AI is gone, replaced by MCP

The table shows what each project contains in 5.0. Loader limits on FabricDash and ForgeDash: the update manager cannot run a trial in the Shadow Boot Lab on a mod server (it says so and never reports a pass; installing needs an explicit override); the update swap on Windows with Fabric completes only after the server process ends; a restart needs a launcher script or host that starts the server again; the apply and appeal hints in the join message are Paper only; chat moderation has no bypass permission (operators can be exempt) and Fabric cannot rewrite a message, it refuses it and sends the censored text as a system line.

What Dash Gives You

Dash is not a generic hosting panel bolted onto Minecraft. It is a dashboard that understands a live server and its day-to-day operating work.

Use it to:

• See server health before players notice a problem
• Run commands and read the live console from a browser
• Manage players, moderation, inventories and linked Dash accounts
• Browse, edit, upload, download and safely organize server files
• Discover compatible plugins or mods through Modrinth
• Create verified backups, prepare maintenance and inspect recovery options
• Give staff exactly the permissions they need, with an audit trail behind sensitive actions
• Receive player reports through a dedicated public form without exposing the admin dashboard
• Move from one server to another through NeoDash without losing a secure, loader-native workflow

The interface is designed for real operations: compact controls, readable data, responsive layouts, keyboard support, useful loading and error states, reduced-motion support and navigation that keeps the current page visible until the next one is ready.

Server Overview and Live Console

The Dashboard gives you an immediate view of the state that matters:

• Server uptime and current Dash version
• TPS, MSPT, memory, CPU and loaded chunks
• Online player count and per-world activity
• Server start, restart and stop controls, protected by permissions
• Live charts for health and resource use
• Quick access to the live console and common administration actions

The remote console is built for browser-based administration, not just a static log viewer.

• Read current console output
• Send server commands from a focused command field
• Keep command history available for the session
• Clear the visible console view without deleting actual server logs
• Restrict access with server-side permissions

For historical metrics, Graphs provides real 1h, 6h, 24h and 7d ranges, live or paused refresh, responsive canvases, tooltips, empty states and JSON or CSV export.

Player Management and Player Profiles

Dash turns player administration into a proper workspace rather than a long, horizontally scrolling table.

• Responsive player cards for desktop and mobile
• Player names, UUIDs, status, ping, world and location
• Skin avatars and a click-to-open interactive 3D skin viewer
• Drag-to-rotate and scroll-to-zoom skin previews with a static fallback when 3D rendering is unavailable
• Player profiles, session history and staff notes
• Moderation controls for kick, ban, unban and whitelist actions where permitted
• Inventory and ender-chest tools where the active platform supports them
• Permission-aware actions instead of a one-size-fits-all admin surface
• Existing Dash-account links shown directly on the player record, with permitted account actions close by

The linked-account view matters for teams: an operator can see whether a Minecraft identity is already connected to a Dash user rather than having to guess from two separate systems.

Files, Plugins and Mods

The file manager is intentionally server-aware and guarded. It gives staff the useful controls without treating the server root like an unrestricted file browser.

• Whole-row file and folder interaction: click the file bubble, not a tiny filename target
• Browse folders, configuration, logs, worlds, plugins or mods
• Upload without throwing the page back to the top
• Create, edit, rename, download and delete files when the current role permits it
• Download folders as ZIP archives
• Detect binary files and preserve protected lock or PID files from unsafe actions
• Use canonical path handling, bounded uploads and safe archive rules behind the interface

The local Plugins or Mods workspace works together with Modrinth discovery:

• See installed plugins or mods and their local status
• Upload local JAR files when the server policy allows it
• Search Modrinth from the dashboard
• Filter results by the active server loader and exact Minecraft version
• Resolve an installable file for the correct platform and patch instead of showing unrelated projects
• Keep local loader maintenance in Dash, FabricDash or ForgeDash where the server context is exact

Tickets and Public Player Reports

Dash includes two connected but deliberately separate workflows: staff tickets inside Dash and public player reports outside it.

Staff tickets

The Tickets workspace includes:

• Inbox, My Tickets, New Report, Staff Notes and Report Links views
• Search, filters, pagination, statuses and priorities
• Replies and internal staff context
• Permission-aware status changes and deletion
• Clear empty, loading and validation states

Public reports without dashboard access

Every player can create a report without becoming a Dash administrator.

• /dash ticket creates a report link
• /dash report <player> prepares a player report
• Links are short-lived, single-use and open a dedicated report-only website
• The report page never becomes a dashboard login screen and does not expose admin routes
• Reports can attach bounded automatic context such as reporter UUID, world, coordinates, ping and server version
• The public URL uses the configured HTTPS report-url, so it can use the server's real SSL domain instead of a private IP or native HTTP address

Reports belong to the local Dash, FabricDash or ForgeDash server. NeoDash does not redirect an unauthenticated report user into the fleet panel.

Users, Roles, Permissions and Audit

Dash has its own dashboard user system for server teams.

• Create users, invite operators and assign role-based access
• Use built-in rank levels or configure custom roles
• Protect the Main Admin account and its sensitive controls
• Handle NeoDash-linked users through the signed bridge workflow
• Scope access to dashboard data, console, server controls, player actions, inventory tools, files, plugins or mods, users, settings, backups, reports, notifications and advanced workspaces
• Track important administrative actions in the audit log

The audit log provides useful operational evidence for events such as authentication, commands, file changes, settings changes, plugin or mod actions, backup workflows, report actions and approved high-risk changes.

Backups, Maintenance and Updates

Dash gives operators a more deliberate way to change and recover a server.

• Create verified backups with scoped content and retention controls
• Schedule backups and recurring server tasks such as save-all
• Keep restore points available for changes that need a recovery path
• Preview maintenance work and validate backups before high-risk actions
• Run restore drills, configuration-drift checks, capacity forecasts and compatibility checks
• Review installed extension state, update information and supported update paths
• Use digest-aware downloads rather than trusting a filename alone

Maintenance remains server-local. Fleet-wide planning, provisioning and lifecycle control belongs in NeoDash; loader-specific server work stays in the dashboard that owns the server.

Operations You Can Trust

These tools take over the routine work around restarts, updates and backups. They are off or in the safest mode until you switch them on, and every action is audited.

Scheduled restarts with countdown

• Daily, weekly or one-off schedules with time zone and daylight-saving rules
• Player warnings in chat and as titles at marks you choose (for example 10 minutes, 1 minute, 10 seconds)
• Optional quiet window: the restart waits while players are online and is forced after a limit you set
• Skip, cancel or start a countdown by hand; /dash restart schedule|cancel|now for the console
• Linked to the maintenance window and shown as a dashboard card and on the status page

One-click maintenance mode

• Turns the whitelist on, sets a maintenance message in the server list and kicks players politely after a countdown
• Staff stay in; the previous whitelist state and MOTD come back when you switch it off
• Optional automatic end time, a banner on every panel page and a state that survives restarts; /dash maintenance on|off|status

Lag detective

• Answers "why is it lagging right now?" with evidence: TPS and MSPT history, chunks, entities and tasks
• With spark installed it runs a short profile and attributes the cost to plugins; without spark it says so and uses clear heuristics
• Ranks suspects with a plain-language explanation and a recommended action, and never changes anything by itself

Update manager with trial run and rollback

• Finds updates through Modrinth (file hash lookup) and GitHub, with changelog, version type and compatibility
• Tests the update first on a copy of your server in the Shadow Boot Lab and reports pass or fail with evidence
• Rolls out only after a pass (or a typed override), keeps a backup of the old file and configuration
• Watches the first minutes after the restart and rolls back automatically on errors, a disabled plugin, a TPS drop or a restart loop
• Manual rollback for 30 days; downloads only from Modrinth or GitHub over HTTPS with hash verification; notify-only by default

Encrypted offsite backups with automatic restore test

• Upload backups to S3-compatible storage (AWS, Backblaze B2, Wasabi, MinIO), Google Drive or a local or NAS folder
• Encrypted on your server with AES-256-GCM before anything leaves it; the key stays with you
• A standalone Decrypt.java restores a backup without the plugin
• Optional weekly restore test: downloads the newest copy, decrypts it, unpacks it into a temporary folder and checks it, without touching the live server
• Retention, retry queue, bandwidth limit and failure alerts

Notifications and Delivery Health

Notifications are organized around actual destinations and delivery state rather than inactive placeholder fields.

• Overview of current notification state
• Destination configuration and test delivery
• Event selection for relevant server and security signals
• Delivery health and visible failure feedback
• Per-user or role-aware notification controls where configured
• Existing Discord delivery retained as a real server-backed integration

Intelligence Center

Intelligence is the advanced optional workspace for operators who need more than a health number. It is organized around the questions that arise during real incidents: what happened, what can safely change, who is affected and how do we recover?

Investigate

• Shadow Boot Lab with bounded input and safe failure results
• Root Cause Explorer
• Performance Regression Radar
• Plugin or mod Resource Attribution
• Guided Safe Mode
• Dependency and Impact Map

Change and recover

• State Time Machine
• Backup Content Explorer
• Adaptive Maintenance Window
• Action Guardrails
• Restore drills and recovery previews
• Configuration Drift and Capacity Forecasting
• Compatibility Center for loader-aware extension checks

Care for players and staff

• Player Journey Replay
• Support and Appeals Inbox
• Cross-Server Player Identity
• Player Experience Score
• Just-in-Time Staff Access
• Dual-Control Actions

Protect the service

• Retention Center
• Supply Chain Center
• Config Schema Assistant
• Universal Search
• World Health Center
• Storage Intelligence
• Service Level Dashboard
• Operator War Room
• Public Status Page

Intelligence is a regular feature. It can be disabled in Settings without removing the standard dashboard.

Guardian

Guardian keeps security evidence, investigation and recovery in a focused workspace instead of an endless page.

• Investigate event evidence and nearby history
• Work with cases, staff notes and targeted search
• Review protection policies, activity and alerts
• Use recovery previews and guarded rollback or restore actions
• Configure retention while keeping destructive work permission-gated
• Page long activity streams so event timelines remain usable

Guardian is optional and can be disabled independently. High-impact actions stay server-authorized, previewed and audited.

Autopilot: Careful Automatic Fixes

Autopilot reads your logs, finds the cause of a problem and proposes the smallest safe fix. You decide how much freedom it gets:

• Off, Suggest (default, only shows what it would do), Approve (waits for your click) or Auto (acts alone inside strict limits)
• Every finding shows its confidence, the factors behind it, the evidence lines, alternatives and what would change its mind
• Guardrails: daily action cap, cooldown, quiet hours, a deny list, and restarts only if you allow them
• Every action is journaled, verified afterwards ("was the problem really fixed?") and can be undone
• Learning statistics: how often Autopilot was right, how often you rejected or undid it, by problem type, with a suggested confidence threshold that is only ever applied by you
• Your own rules: "if this error appears, then notify me" or "then propose this action", with a test button; a rule can never do more than the guardrails allow
• Rejected means quiet: a rejected proposal is not made again until the evidence gets worse or your chosen pause (1 hour to forever) ends
• NeoDash adds fleet warnings: if a plugin causes trouble on one server, it checks every other server that runs the same plugin and warns you in advance

Security That Grows With Your Team

• Two-factor login for every user: authenticator apps (QR code generated locally, no external service), ten one-time recovery codes, and a policy for everyone or for selected roles with a grace period
• Passkeys: sign in with a fingerprint, phone or security key; passkeys can replace password plus code
• Sessions and devices: see where you are signed in, sign out single devices, and get an alert when a new device appears; admins see everyone's sessions
• IP allow-list: restrict the panel to your networks (IPv4 and IPv6), with trusted-proxy support, a "would I lock myself out?" preview and a console switch (/dash allowlist off) for emergencies
• Signed audit log: every entry is chained to the one before it and signed regularly; export it and verify that nothing was changed, in the panel or offline with the included verifier
• Guided secret rotation: replace the bridge secret between Dash and NeoDash with an automatic connection test and rollback, re-test Discord webhooks, and see which API tokens are due for rotation
• Scoped API tokens: each token carries only the scopes you give it and never more than its owner may do

Community Tools

• Your own public website. Switch on the public site and the status page, whitelist applications, ban appeals, support tickets and player reports are served on a separate port that exposes nothing else: login, panel, API and staff pages answer 404 there. Point your domain at it with nginx, Caddy or Cloudflare, for example https://paper.example.de/whitelist. The main admin edits every path, the site title and the public base URL in the panel and changes apply immediately. A dashboard card and copy/open buttons on the staff pages show where the site lives, and /dash site prints the addresses. On Paper, players who are not whitelisted are told in the kick message where to apply, and banned players where to appeal.
• Restart button: with Dash linked to NeoDash the restart no longer hangs on "restarting" (the browser now opens NeoDash's confirm page), NeoDash's own restart and stop controls send the current server, and Dash without a restart script says honestly that the server will only stop. NeoDash fleet: opening a server interface is faster and no longer needs several clicks. Lag detective: the page no longer reloads every few seconds while a diagnosis runs.

Everything here is off by default and only the Main Admin can switch it on.

• Public status page: real server state, uptime over 24 hours, 7 and 30 days, incidents and planned maintenance, a JSON feed and an embeddable badge; every widget is opt-in
• Whitelist applications: a public form with abuse protection, staff review, approve with one click and a status link for the applicant
• Ban appeals: banned players can appeal without learning anything about other names; staff see the ban details and can unban or reject with a cooldown
• Chat moderation: word filters that see through tricks like leetspeak and spacing, link protection, spam rules, an escalating mute ladder and an overview of suspicious players, with data kept only as long as you choose
• GDPR tool: export everything Dash knows about a player as a ZIP, or erase it with a preview and typed confirmation; the audit chain stays intact and receipts are signed

AI access: A Standard MCP Server for Your Own Assistant

Dash no longer ships its own AI. Instead it speaks the open Model Context Protocol (MCP), so the assistant you already use (Claude, ChatGPT-compatible clients, Cursor, scripts) can look at and, if you allow it, operate your server. It is off by default; only the Main Admin switches it on in AI access.

• Streamable HTTP endpoint POST /mcp (JSON-RPC 2.0), tools plus read-only resources
• Authentication with the scoped API tokens of API access: a token acts as its owner and never does more than the owner may
• Read tools: status, performance history, console, players, profiles, Guardian lookup, Intelligence diagnosis, Autopilot status, backups, plugins, files (panel data, keys and secrets are never readable), audit log, tickets
• Action tools: console command (with the API deny list and guardrails), kick, ban, unban, whitelist (a reason is mandatory), Autopilot approvals, backups, tickets
• Every tool states whether it is read-only or destructive; every tool can be switched off individually; a kill switch cuts everything at once
• Secrets, tokens and addresses are masked in all output, results are size-capped, calls are rate limited and every call is written to the audit log
• Browser pages are refused unless their origin is allowed (cross-site and DNS-rebinding protection)
• Copy-and-paste connection snippets and the presets "MCP read-only" and "MCP operator" on the page

Deterministic crash and log diagnostics remain available in Maintenance.

A Dashboard That Fits Your Team

The first-run setup provides three sensible starting profiles:

• Light: dashboard, console, players, files, extensions, updates and essential settings
• Normal (recommended): Light plus tickets, notifications, graphs, users, audit and plugin settings
• Full functionality: Normal plus every advanced administration workspace

Intelligence, Maintenance and Guardian can be switched on or off individually through feature availability settings.

The sidebar is customizable directly where it is used:

• Drag items with a mouse or touch and long-press interaction
• Reorder entries to match the team's working sequence
• Hide unused items
• Restore hidden items from the customization list
• Keep the chosen order locally between visits

English, German, Spanish and further interface languages are available through the user language selector.

NeoDash: Optional Multi-Server Management

NeoDash is the central control plane for the Dash ecosystem. Install it when you operate more than one server or want a dedicated Linux-host management surface.

NeoDash repository: https://github.com/Framepersecond/NeoDash

With NeoDash, you can:

• View connected servers and fleet health in one place
• Start, stop, restart, create, install and scan server directories
• Provision Paper, Fabric, Quilt, NeoForge and Vanilla servers
• Select Minecraft 1.21 through 1.21.11, 26.2 or 26.3 with the appropriate Java runtime
• Resolve the correct stable Dash artifact from Modrinth by loader and exact Minecraft version
• Manage fleet users, roles, assignments, audit history, groups and updates
• Run verified backups, scoped restores and optional Google Drive mirroring
• Open Dash, FabricDash and ForgeDash through signed, replay-protected SSO
• Keep plugin dashboard return links on the configured public HTTPS NeoDash domain

NeoDash is optional. A single server can run Dash, FabricDash or ForgeDash perfectly well on its own.

NeoDash quick install

curl -sSL https://raw.githubusercontent.com/Framepersecond/NeoDash/main/install.sh | bash

Native Linux is recommended. Docker artifacts are also available. Java 25 is required when NeoDash directly manages Minecraft 26.2 or 26.3 workloads.

Compatibility and Installation

Choose the build that matches both the server loader and exact Minecraft version.

Paper, Spigot, Purpur and Bukkit

1. Download Dash.
2. Place the JAR in plugins/.
3. Restart the server.
4. Run /dash register as an operator.
5. Open the one-time setup link and create the first administrator.

Fabric and NeoForge

1. Download the artifact built for the exact Minecraft version.
2. Place it in mods/.
3. Restart the server.
4. Run /dash register as an operator.
5. Complete the one-time setup.

Security Notice

Dash is powerful because it can control a real server. Treat the dashboard with the same care as console or host access.

• Use HTTPS or a trusted reverse proxy
• Set report-url to the public HTTPS dashboard origin before sharing report links
• Use strong, unique credentials and protect the Main Admin account
• Grant the smallest practical role to each operator
• Review the audit log and notification delivery health
• Keep console, files, updates, backups and advanced mutation permissions restricted to trusted staff
• Give assistants the smallest token scopes that do the job (start with "MCP read-only")
• Turn on two-factor login for every account, and keep a copy of the audit log public key off the server

Dash enforces authenticated sessions, CSRF protection, server-side permissions, canonical path checks, bounded requests and uploads, protected-file rules, guarded archive handling, digest-aware downloads and action audit logging. Sensitive key material stays server-side and is masked in the interface.

Partner

Dash is proudly partnered with EmeraldHost, a Minecraft server host. Use the code Frxme10 for 10% off your server.

If Dash saves you time, you can support its development on Buy Me a Coffee. Thank you!

Projects

• Dash - Paper, Purpur, Spigot, Bukkit and compatible servers
  https://github.com/Framepersecond/Dash

• FabricDash - Fabric servers
  https://github.com/Framepersecond/FabricDash

• ForgeDash - NeoForge servers
  https://github.com/Framepersecond/ForgeDash

• NeoDash - optional central control plane
  https://github.com/Framepersecond/NeoDash

Dash gives a single server a serious web administration surface. Add NeoDash when that server becomes a fleet.