Menus and GUIs on a Minecraft server: DeluxeMenus and more

In short: DeluxeMenus is the classic: YAML menus, dozens of actions, click requirements and command arguments; it needs PlaceholderAPI. zMenu is free, runs on Paper and its forks only, reloads menus on the fly, has a visual editor and imports DeluxeMenus menus with one command. CommandPanels runs on Paper and Folia, has a web editor with no account needed, and besides chests offers Minecraft dialogs and forms for Bedrock players. In all of them a console action is the console: never feed it what a player types.

What a GUI menu is#

The plugin opens an inventory window for the player — usually a chest with 9 to 54 slots — and lays out items as buttons with a name and a description. Players can't take the items, and a click runs actions: a command as the player or the console, a message, another menu, another server on the network. With placeholders a button shows the player's own data: balance, rank, a mode's player count. Menus are often opened by clicking an NPC — see NPCs on a server.

Menu plugins compared#

A menu in DeluxeMenus#

Menus are registered under gui_menus in plugins/DeluxeMenus/config.yml, and the menu file itself lives in the gui_menus folder. After editing, run /dm reload. /dm open <menu> is an admin command; for players the docs recommend giving each menu its own command with open_command.

gui_menus:
  servers:
    file: servers.yml

menu_title: '&8Choose a mode'
open_command: servers
size: 27
items:
  survival:
    material: GRASS_BLOCK
    slot: 11
    display_name: '&#55FF55Survival'
    lore:
    - '&7Your name: &f%player_name%'
    left_click_commands:
    - '[close]'
    - '[connect] survival'
  bread:
    material: BREAD
    slot: 15
    display_name: '&eBread for VIPs'
    left_click_requirement:
      requirements:
        vip:
          type: has permission
          permission: menu.vip
      deny_commands:
      - '[message] &cYou need the VIP rank'
    left_click_commands:
    - '[console] give %player_name% bread 16'
    - '[close]'

• size is 9, 18, 27, 36, 45 or 54 (54 by default); slot counts from 0.
• Colours: & codes and hex as &#aaFF00 (1.16+); messages can also use the [minimessage] action. A hex string is easy to build in the gradient text generator.
• Actions run top to bottom: [player], [console], [message], [openguimenu], [connect], [close], [refresh], [sound]; money and permissions — [takemoney], [givemoney], [givepermission] through Vault (see economy and Vault).
• The <delay=20> tag delays an action by 20 ticks, and <chance=50> runs it with a 50% chance.
• [connect] goes through the proxy's messaging channel: on Velocity, bungee-plugin-message-channel turns it on — see Velocity setup.

Security: the [console] action#

[console] runs a command as the console for anyone who clicks. With a fixed command that's fine — that's how menus hand out rewards. The danger is when something a player typed ends up in a console command, or when the wrong person can edit a menu.

• Player arguments stay out of the console. DeluxeMenus can pass command arguments into a menu (args, referenced in the menu by name in curly braces). Since version 1.14.1 the order of parsing arguments and placeholders was changed for security reasons; the docs flag the parse_placeholders_after_arguments and arguments_support_placeholders options with security warnings — the second lets players parse any placeholder they like. Leave them off and don't build [console] commands from arguments.
• Requirement first, reward second. Gate [console] rewards with a left_click_requirement on a permission or money (has permission and has money need Vault), and put [takemoney] before the reward.
• No OP. /dm execute runs any action for a player and requires OP; don't hand out OP for the sake of menus — grant permissions through LuckPerms.
• Menu files are for admins only. Whoever edits a menu's YAML can write any [console] command into it. Read ready-made menus from the internet before installing them — see plugin malware.

Which one to pick#

• A Spigot server, menus built from the wiki's examples — DeluxeMenus.
• Paper, a visual editor and menus without reloads — zMenu; to move from DeluxeMenus use /zm convert deluxemenus, which leaves the original files untouched.
• Bedrock players through Geyser — CommandPanels: it has a separate menu type, Bedrock forms through Floodgate. Connecting Bedrock players is covered in Geyser and Bedrock.

Menus, inventories and the anticheat#

A menu is an inventory window, and every click in it reaches the server as a packet. Cheats and exploits both use that: InvMove lets a player run with a window open, XCarry hides items in the crafting grid, and dupe exploits send clicks on slots the window doesn't have. DGuard — the best anticheat for a modern Minecraft server — checks inventory and packets alongside combat, movement, building and the world: BadPackets compares every click with what a vanilla client could send. Evidence builds up, and you set how strict punishments are.

FAQ#