Piston syncs signed server mods to the client, checks every jar's hash, and boots vanilla Minecraft with the right flags. No zipping modpacks by hand, no just trusting a random .jar someone sent you.
Five steps, one command, zero manual jar-wrangling.
Client pulls manifest.json plus its .sig and .pub.
Ed25519 against the pinned server key. First contact asks first.
Missing jars get downloaded, SHA-256'd, and cached.
Asset index reconciled, native libs unpacked for your OS.
Child JVM, real vanilla args, mods already on the classpath.
The pieces that make Piston safe to point at a server you don't own.
Every manifest carries an Ed25519 signature. Tamper with one byte and the client throws it out before touching a single mod.
First connection shows the server key's fingerprint to compare. After that it's pinned — a key swap gets flagged, never waved through.
Mods are stored by hash, so identical jars across servers only get downloaded once.
Piston reads Mojang's real version.json and reuses its libraries, JVM flags, and Java version as-is.
Device-code flow for real accounts, or skip it and launch offline with a deterministic UUID.
A tiny piston.mod.json per mod says id, version, and side — server-only mods never leave the server.
Piston asks before it trusts a server, not after. The server owner publishes their key's fingerprint, you compare it once, and that's the whole ceremony.
Doesn't match what's shown on screen? Piston just says no.
Sign a manifest, drop it on your web server, hand players one command.
Start with the pipeline