Server ExpressJS — Central API Server

This repository is the central API server for the MCEngine/MCPaimon ecosystem. Every Minecraft server connects to this single Express.js backend, so player data and AI agent data are shared across servers instead of being stored per server.

Overview

• /api/vip & /api/status — MCPremium system for VIP data and player statuses
• POST /api/economy — custom currency system with account types (COIN, COPPER, SILVER, GOLD, POINT)
• POST /api/economy/market — Market extension store for item listings (save/retrieve items)
• POST /api/economy/slayerrewards — SlayerRewards extension store for kill and reward logs
• POST /api/backpack — backpack item storage with multi-thread locking support
• /api/mcagents/* — MCAgents central store for AI platforms, models, accounts, sessions, prompts and logs

MCAgents Integration

The MCAgents plugin is the main plugin and talks to this server through the /api/mcagents route (set database.type: "api" in the plugin's config.yml). MCAgents extensions (such as PlayerTools and ServerTools) only add tools to the MCAgents plugin — they do not have their own routes on this server.

Documentation

• MCPremium API
• Economy API
• Market API
• SlayerRewards API
• Backpack API
• MCAgents API

Authentication

All API requests require a valid Bearer token in the Authorization header.

Authorization: Bearer YOUR_API_TOKEN

Security

• Bearer token required: the server refuses to start when API_TOKEN is not set, and tokens are compared in constant time.
• Rate limiting: 100 requests per 15 minutes per client address.
• Brute force lockout: after 10 failed authentications in 15 minutes, the client address receives 429 until the window expires.
• Reverse proxies: set TRUST_PROXY to the number of proxy hops so limits key on the real client address.
• Consistent JSON errors: malformed JSON bodies return 400, unknown routes 404, and unexpected failures 500 — always as JSON.

Notes

• account_type defaults to player when omitted in relevant systems.
• The API is protected by API_TOKEN from .env.