<aside>

⚠️ Read this before installing Thrall lets any process holding the auth token control your Minecraft client - send chat, run commands, leave worlds, move the player, swap accounts. The defaults protect you, but you should understand the threat model

• The server binds to 127.0.0.1 (localhost) by default - only programs on the same machine can reach it
• Every request requires a bearer token, auto-generated on first run and stored in <gamedir>/config/thrall.json.
• The token is also printed once to the Minecraft log on first generation - copy it from there
• CORS is restricted to loopback origins, so a browser tab on a random website cannot talk to it even if you're logged in

Do not install Thrall if you don't trust every process running on your machine, or if you don't understand the implications of giving software the ability to control your account

</aside>

<aside>

Install

1. Install Fabric Loader for Minecraft 1.21.8.

2. Drop these into <gamedir>/mods/:

   • Fabric API (≥ 0.130.0+1.21.8)
   • Fabric Language Kotlin (≥ 1.13.5+kotlin.2.2.10)
   • thrall-x.y.z.jar (this mod)

3. Launch the client. On first run you'll see something like:

   [Thrall] ===============================================================
   [Thrall] Thrall generated a new auth token. Add it to your bot config:
   [Thrall]     7f9c…64-hex-chars…
   [Thrall] (stored in /…/.minecraft/config/thrall.json - treat it as a password)
   [Thrall] ===============================================================
   

   Copy that token into whichever client you're driving the mod from

</aside>

<aside>

Config

<gamedir>/config/thrall.json is created on first run with defaults; edit and restart MC to change anything