Threat score

How Argus turns staff actions into a 1–5 star rating — the signals, the weights, the decay and why it is explainable.

Argus v1.1.1Paper · Purpur · Folia-safe1.21 – 1.21.x

The threat score is a number from 0 to 100 shown as a 1–5 star rating. It is produced by weighted signals and time decay — no machine learning, no black box. Every star can be traced back to the actions that caused it.

Signals

Signal	Default weight	Fires when
`honeypot_triggered`	40	A monitored member opens or breaks a honeypot container.
`collusion`	30	Repeated item hand-offs to the same accomplice — see Collusion.
`item_injection`	26	Creative item grabs or `/give`, weighted by material and quantity.
`economy_injection`	22	`/eco give`, `/money give` and equivalents, weighted by amount.
`ban_abuse`	18	A ban reversed by a different staff member within `ban-abuse.window-minutes`.
`favoritism`	16	Gives or teleports repeatedly funnelled to the same player.
`inventory_access`	14	`/invsee` or opening another player's container.
`silent_abuse`	12	Sensitive actions taken with visibility deliberately reduced.
`burst_activity`	10	More than `burst.threshold` sensitive actions inside `burst.window-seconds`.
`off_hours`	8	Acting while `low-staff-threshold` or fewer other staff are online.
`legitimate_moderation`	4	Kicks, mutes and warns — tracked, barely weighted.
`peak_activity`	2	Acting during busy hours with witnesses around.

Context signals versus action signals

off_hours, burst_activity and peak_activity are context. On their own they mean nothing — a staff member online at 04:00 has done nothing wrong. They shade the action signals that happen alongside them.

This is why the same /give produces different ratings:

Peak hours, one give: item_injection + peak_activity → low, unremarkable.
Alone at 04:00, one give: item_injection + off_hours → worth a glance.
Alone at 04:00, twenty gives in two minutes: item_injection + off_hours + burst_activity → the rating you want to be woken up for.

Moderation is tracked, not punished

Kicks, mutes and warns are recorded as MODERATION actions and carry a token weight of 4. Moderating is the job — scoring it heavily would produce a plugin that flags your most active staff for being active.

Mass abuse still surfaces, because a moderator who issues thirty punishments in ninety seconds trips burst_activity regardless of what each individual action was.

Ban abuse

A different pattern, deliberately handled outside normal scoring: a ban that is reversed by somebody else within signals.ban-abuse.window-minutes (15 by default) flags the person who placed it. A wrongful ban that a colleague had to quietly undo is the signal, and it belongs to the banner, not the unbanner.

Two details that make it work:

Self-reversals are exempt. Realising your own mistake and fixing it is not abuse.
The review runs before the monitored gate. A senior without argus.monitored can still trigger the review of somebody else's ban by unbanning. Otherwise the "junior bans, senior unbans" pattern would be invisible.

Decay

Scores are not permanent. A member's score halves every scoring.half-life-hours of clean play — 72 hours by default. Three days after a bad night, four stars are two.

plugins/Argus/config.yml

scoring:  half-life-hours: 72

Shorten it on a busy network where staff legitimately touch a lot of sensitive things. Lengthen it if you want history to stick around long enough for a monthly review.

Reading the breakdown

Open /argus, click a member, open Why. You get the individual signals, when they fired and how many points each contributed. The rating is never presented without the reasoning, because a number you cannot argue with is a number you cannot act on.

Tune from your own data

Do not rewrite the weights on day one. Run the defaults for a week, look at which members ended up where, and adjust the two or three signals that produced results you disagree with.

Clearing a score

The GUI's Clear action resets a member's score to zero. It does not erase the audit log — the entries stay, and /argus verify still covers them. Clearing says "I have reviewed this and it is fine", not "this never happened".