Easy NPC can execute commands and import presets, but the server decides how much authority an NPC is allowed to use.

There are two relevant command levels:

• the level stored on an action entry
• the maximum level allowed for the NPC on this server

The effective level is always the lower of the two.

Example:

• action level: ADMINS
• NPC level: GAMEMASTERS
• effective level: GAMEMASTERS

The server assigns authority when an NPC is created or updated through trusted code paths such as:

• preset import
• browser spawn
• editor updates

The imported preset does not keep full authority automatically. The server clamps it to the rules in config/easy_npc/security.cfg.

Default command level limits:

• normal player: ALL
• creative non-admin player: MODERATORS
• admin import: ADMINS
• trusted server-side import without player context: ADMINS

Security rules are not limited to command actions. The server can also allow or block whole NPC features.

Every feature is guarded by a minimum role. There are four roles, from lowest to highest:

A feature is available to its configured role and everything above it.

Current features and their default role:

URL_RESOURCE is the switch to look at when players report that they cannot add a remote skin. Set feature.URL_RESOURCE=NORMAL_PLAYER to open it for everyone, or ADMIN to lock it down.

Security settings are stored in:

config/easy_npc/security.cfg

Important command-level settings:

• normalPlayerCommandLevel
• creativePlayerCommandLevel
• maxAdminImportedCommandLevel
• serverTrustedCommandLevel
• blockUnsafeNpcCommands
• unsafeNpcCommands
• executeAsUserCommandAllowList.ALL
• executeAsUserCommandAllowList.MODERATORS
• executeAsUserCommandAllowList.GAMEMASTERS
• executeAsUserCommandAllowList.ADMINS
• executeAsUserCommandAllowList.OWNERS

Important spawn-related settings:

• npcSpawnRateLimitCreative
• npcSpawnRateLimitAdmin
• feature.SPAWN_NPC

The file also supports per-feature role entries such as:

• feature.DIALOG
• feature.TRADING
• feature.OBJECTIVE
• feature.POSITION

Default values from the current code:

normalPlayerCommandLevel=ALL
creativePlayerCommandLevel=MODERATORS
maxAdminImportedCommandLevel=ADMINS
serverTrustedCommandLevel=ADMINS
blockUnsafeNpcCommands=true
unsafeNpcCommands=ban,ban-ip,banlist,debug,deop,difficulty,forceload,function,gamerule,kick,op,pardon,reload,save-all,save-off,save-on,schedule,setidletimeout,setworldspawn,spawnpoint,spreadplayers,stop,whitelist
executeAsUserCommandAllowList.ALL=
executeAsUserCommandAllowList.MODERATORS=
executeAsUserCommandAllowList.GAMEMASTERS=
executeAsUserCommandAllowList.ADMINS=
executeAsUserCommandAllowList.OWNERS=
npcSpawnRateLimitCreative=5
npcSpawnRateLimitAdmin=20
feature.DIALOG=NORMAL_PLAYER
feature.TRADING=CREATIVE_PLAYER
feature.COMMAND_ACTION=CREATIVE_PLAYER
feature.SCOREBOARD_ACTION=CREATIVE_PLAYER
feature.INTERACT_BLOCK_ACTION=CREATIVE_PLAYER
feature.OPEN_TRADING_ACTION=CREATIVE_PLAYER
feature.OBJECTIVE=CREATIVE_PLAYER
feature.MOVEMENT=CREATIVE_PLAYER
feature.POSITION=CREATIVE_PLAYER
feature.COMBAT_ATTRIBUTE=CREATIVE_PLAYER
feature.BASE_ATTRIBUTE=CREATIVE_PLAYER
feature.SPAWN_NPC=CREATIVE_PLAYER
feature.WORLD_PRESET=CREATIVE_PLAYER
feature.CUSTOM_PRESET=CREATIVE_PLAYER
feature.LOCAL_PRESET=NORMAL_PLAYER
feature.DEFAULT_PRESET_IMPORT=CREATIVE_PLAYER
feature.URL_RESOURCE=CREATIVE_PLAYER

Other Easy NPC config files are documented on Configuration Files.

Suitable for public gameplay NPCs and harmless command actions.

Examples:

• /say Welcome!
• /scoreboard players add @initiator reputation 1

Suitable for builder or event helper NPCs.

Suitable for world-control style commands such as time or weather changes.

Suitable for stronger server administration commands.

The highest level. Use only for tightly controlled private or development setups.

Preset import is sanitized before the NPC is created or updated.

Depending on the actor role and feature rules, the server may:

• remove trading data
• remove objective data
• remove movement or attribute data
• remove blocked actions
• clamp command permission levels
• rewrite or remove owner data

The importing player receives a short warning if server rules changed the preset during import.

The preset browser can show a server-rules preview before import.

The preview can mark features as:

• allowed
• blocked
• reduced

This uses the same security rules as actual preset import.

If blockUnsafeNpcCommands=true is enabled, Easy NPC blocks critical server-management commands from NPC command execution.

This is intended to protect commands such as:

• operator management
• whitelist or ban changes
• direct stop commands

The blocked command roots are configured with unsafeNpcCommands. Entries are command roots without arguments; /op Steve and op are both normalized to op.

The unsafe list is checked before any allowlist. If a server really wants to allow a command such as op, it must remove op from unsafeNpcCommands and also add it to the matching executeAsUserCommandAllowList.<LEVEL> entry.

For maintenance workflows, prefer a safer trigger such as a scoreboard value, a tag, or an external admin-only automation step.

Command actions normally execute as the NPC. This is the compatible path for NPC messages, effects, rewards, and commands such as:

• /say Welcome!
• /give @initiator stone
• /playsound minecraft:entity.villager.ambient master @a ~ ~ ~ 1 1

These commands are capped by the NPC command level and blocked only if their root command is in unsafeNpcCommands.

Execute as player is stricter. It uses the interacting player as the command source, so it can look like the player performed the action. Because of that, every user-executed command must be explicitly allowlisted with its command name (the first word, without arguments):

executeAsUserCommandAllowList.GAMEMASTERS=shop,tp

Notes:

• List command names only. /tp @s ~1 ~ ~ is allowlisted by adding tp.
• Wildcards are not supported. A literal * is ignored (with a warning in the log), because it would open every command at that level.
• blockUnsafeNpcCommands and unsafeNpcCommands do not affect this allowlist; they only apply to the execute-as-NPC path.
• Add the entry at the level shown in the block message (or any lower level), then restart the server. The file is read at startup from config/easy_npc/security.cfg in the server directory.

The command still cannot exceed the lower of:

• the action entry command level
• the NPC's stored command level

Example:

• A normal-player NPC with command level ALL cannot elevate /shop to GAMEMASTERS, even if shop is allowlisted at GAMEMASTERS.
• An admin-created NPC with command level GAMEMASTERS can run an allowlisted /shop command at GAMEMASTERS.
• /say as player is blocked by default unless the server explicitly allowlists say.

The server log states exactly why a command was blocked:

• Blocked execute-as-player command 'tp' … because no matching allowlist entry is active up to GAMEMASTERS — the command name is not allowlisted at that level. Add it to executeAsUserCommandAllowList.GAMEMASTERS (the block message prints the exact key and the absolute path of the loaded config file) and restart the server.
• Execute-as-player allowlist matched command 'daycare' … but the command is not available … — the allowlist is correct, but the command relies on external or player-specific permissions that Easy NPC cannot elevate (for example a third-party permission plugin). Grant the player the required permission, or run the command as the NPC instead using @initiator, e.g. /tp @initiator ….

If a command such as /tp only needs the player as a target (not as the source), prefer running it as the NPC with /tp @initiator …. Execute as player is only required when the command must run with the player as the command source.

• public gameplay NPCs: ALL
• builder or event NPCs: MODERATORS
• world-control NPCs: GAMEMASTERS
• admin-only NPCs: ADMINS
• owner-only or dev-only automation: OWNERS