# Staff tools in five minutes

Source: https://tehoclient.dev/recipes/staff-setup
SDK: 1.0.0

Most servers hand their moderators a modded client, a pile of plugins and a list of commands, then hope nobody leaks the X-Ray. Teho turns that around: the staff tools are part of the client every player already has, they only switch on for the people you grant them to, and they only work on your server.

This page gets a working staff team in about five minutes. Most of it is config, and the one piece of code is optional.



### Decide who gets what

Staff tools are granted by permission. The default `config.yml` already maps five permission nodes to sensible groups of tools, so for most servers this step is just giving your ranks the right nodes in your permission plugin.

| Give this node | And the moderator gets |
|---|---|
| `tehoapi.staff.moderate` | Inspector cards, the action wheel, the alert feed, click teleport, the combat overlay |
| `tehoapi.staff.esp` | Player ESP and nametags through walls, entity ESP, tracers, highlights, movement trails |
| `tehoapi.staff.xray` | X-Ray for ores and spawners, storage ESP |
| `tehoapi.staff.freecam` | Freecam and spectate |
| `tehoapi.staff.admin` | The lag map and fullbright |

A trial moderator might only get `moderate`, while a senior one gets all five. With LuckPerms:

```text
/lp group mod permission set tehoapi.staff.moderate true
/lp group mod permission set tehoapi.staff.esp true
/lp group srmod permission set tehoapi.staff.xray true
/lp group srmod permission set tehoapi.staff.freecam true
```

### Tell X-Ray what to look for

X-Ray shows the blocks you list, each in its own colour. Add anything your server cares about, such as custom ores or spawners:

```yaml
staff:
  radius: 48
  xray-blocks:
    - "minecraft:diamond_ore #5FE0DC"
    - "minecraft:deepslate_diamond_ore #5FE0DC"
    - "minecraft:ancient_debris #B07CFF"
    - "minecraft:spawner #FF5555"
```

Run `/tehoapi reload`. The next time a moderator joins, they get a one-time prompt naming your server and the tools you are granting. Once they accept, the tools are theirs on your server only.

### Wire up your anticheat

Your anticheat already knows when someone is suspicious. Point its alert or punishment command at Teho, and every moderator with the alert feed gets the alert in their HUD, with one key to teleport and one to spectate:

```text
tehoapi alert %player% high Reach_VL_%vl%
```

Underscores turn into spaces, so this reads "Reach VL 12". Use `info`, `warn` or `high` for the severity.

### Learn the three moves

That is the whole setup. Here is what your moderators will actually do with it:

1. **Look at a player and inspect them.** A card shows their health, ping, game mode, first join and Teho Client, with action buttons underneath.
2. **Open the action wheel** while looking at someone, and pick Freeze, Spectate, Teleport, Inventory, Screenshot, Mod check or Path history. Freezing shows the suspect a full-screen "You are frozen" overlay with your text.
3. **React to alerts.** The feed shows who flagged and how badly, and the teleport and spectate keys jump straight to them.

Screenshots and mod checks run on the suspect's own client, and the suspect is asked every time, so nobody's screen is captured without them knowing. Screenshots are saved under `plugins/TehoAPI/screenshots/`.

### Optional: add your own card

If your server keeps its own data, such as alts, warnings or punishment history, show it on the inspector card. This is the only code on the page:

```java
@EventHandler
public void onInspect(TehoInspectEvent event) {
    if (event.getTarget().kind() != Target.Kind.PLAYER) {
        return;
    }
    UUID id = event.getTarget().id();
    event.getResponder().reply(InspectCard.builder("Skyline record")
            .row("Alts", alts.of(id).size())
            .row("Warnings", warnings.of(id), 0xFFC24D)
            .action("history", "Punishment history")
            .build());
}

@EventHandler
public void onAction(TehoStaffActionEvent event) {
    if (event.getAction().equals("history")) {
        history.open(event.getPlayer(), event.getTarget().id());
    }
}
```



## Why this is safer than a hacked client

- The tools only work on servers that grant them. A moderator who leaves your team, or joins another server, has nothing.
- Every grant needs the moderator's consent once, and they can revoke it any time in Settings -> Servers.
- You can see exactly who has what: `/tehoapi list` shows each player's granted, accepted and active tools.
- Turning a tool on fires `TehoStaffToolEvent`, so you can, for example, vanish a moderator the moment they enter freecam.


  - [The full staff toolkit](https://tehoclient.dev/modules/staff) — Highlights, trails, lag maps and the whole API.
  - [Suspect tools](https://tehoclient.dev/modules/suspect) — Freeze, screenshot and mod-list requests.
  - [Every staff command](https://tehoclient.dev/owners/commands) — For testing without code.