About

Modgrade helps players choose Minecraft mods, modpacks, resource packs, data packs, shaders and server plugins.

For each project, we read its files and its history on Modrinth and CurseForge. We look for risky code, check which Minecraft versions it really supports and measure how well it is maintained. This gives a grade from A to F.

Every project of a type is graded by the same rules, computed automatically. We never change a grade by hand.

We also show which AI tools were used to make a project. This is not part of the grade.

Modgrade is not affiliated with Mojang, Microsoft, Modrinth or CurseForge.

How Modgrade works

What runs on its own

• Every 30 minutes, the list of projects is synced with Modrinth and CurseForge.
• Every new file is downloaded and analysed without being run.
• Some files are also looked up on VirusTotal by their fingerprint, starting with the ones our checks flag and the ones checked with the Scanner. No file is sent to VirusTotal.
• Every day, files with risky code are decompiled and read on isolated machines that are deleted after each run.
• Every night, grades are computed with fixed rules. The rules are on the How it works page.
• Every 2 hours, the pages are updated with the latest results.

What a person decides

• Projects found as malware are reviewed by a person, and any result can be corrected.
• Reporting a project to Modrinth or CurseForge.
• Whether an alert someone disputes is a real alert or a false one.
• Changes to the detection rules.

How we use AI

• Grades and security results do not use AI. They come from fixed rules, the same for every project.
• What a connection is for. When the code connects to the internet, an AI model writes one sentence on what the connection does, for example "Checks for updates on GitHub". It only gets the code of that method and the address, never a whole file and never anything about a player. The sentence is shown only when every part of it can be found in the code. It never changes a grade, an alert or a badge.
• Project summaries. The short line under a project's name and the "About" text are written by an AI model from the project's official texts: its Modrinth and CurseForge pages and, when there is one, its GitHub README. A second pass checks them against those texts. We do this for four reasons:
  • The official descriptions are full of formatting, images and videos. Shown as they are, they load slowly and often display badly.
  • Each page should add something, not copy text that is already on the platforms.
  • Summaries written in other languages are put into English.
  • The README often explains what a mod does better than the store page.
  For the author's own words, every project page links to its official pages.
• Reviewing alerts. AI helps sort alerts and read decompiled code before a person reviews them.
• Finding AI use in mods does not use AI. It relies on evidence: the Modrinth form, image metadata and the project's code history.

The Scanner

The Scanner runs in your browser. Your files never leave your computer: only their fingerprints are sent, to find them in our data.

Limits

Reading code without running it cannot prove that a file is harmless, so a project without an alert is not guaranteed to be harmless. False alerts can happen. If you think a result is wrong, tell us through the Contact page and we will check again.

Contact

Questions, or a result you think is wrong: [email protected]