▲ 1 r/XMCL

v0.66.1 REBORN P2P + Mini Fixing BUG

🐛 Bug Fixes & Patches

🏗️ Refactors

u/Banerbansa — 8 days ago
▲ 1 r/XMCL

P2P Multiplayer Reborn: Cloudflare Workers, DPoP Security & Zero-Trust Privacy

We are thrilled to announce that P2P Online Multiplayer is officially back and fully operational in XMCL v0.66.0 and v0.66.1!

Following the temporary downtime caused by Deno Deploy quota exhaustion, we completely rebuilt our WebRTC signaling infrastructure from the ground up. The new system is powered by Cloudflare Workers with Durable Objects, client-side DPoP cryptographic authentication (RFC 9449), and an architecture designed around strict zero-trust privacy.

Major Update

about 8 hours ago

P2P Multiplayer Reborn: Cloudflare Workers, DPoP Security & Zero-Trust Privacy

Previous Post

SERVICE STATUS: ONLINE

P2P Multiplayer Room Hosting is Fully Restored! Update your launcher to XMCL v0.66.1 or later to enjoy high-speed, port-forwarding-free multiplayer with your friends worldwide.

1. The Return of Seamless World Sharing

XMCL's P2P multiplayer allows you to host single-player Minecraft worlds and play with friends across the internet without port forwarding, dedicated server setups, or third-party VPN tools like Hamachi or Radmin.

With the release of XMCL v0.66.0 (new account system, host-star multiplayer v2 client, room master migration & reconnect) and stability patches in v0.66.1 (P2P connection fix, DPoP auth, multiplayer gated behind account login), room creation, WebRTC ICE candidate exchanges, and connection handshakes are faster and more reliable than ever.

2. New Backend Architecture: Cloudflare Workers, Durable Objects & xmcl-web-api

To replace the legacy Deno Deploy infrastructure, we migrated our entire backend to Cloudflare Workers and open-sourced the brand-new backend repository: xmcl-web-api. The backend is built on the Hono web framework.

+---------------------------+                                     +---------------------------+
|                           |       signaling.xmcl.app            |                           |
|   Host XMCL Launcher     | <==== WebSocket + DPoP Auth ====>   |   Guest XMCL Launcher     |
|   (Local DPoP Key Pair)  |    (Durable Object per Room)        |   (Local DPoP Key Pair)   |
+---------------------------+                                     +---------------------------+
             |                                                                 |
             +=================== Direct WebRTC P2P Connection ===============+
                              (Encrypted Host-Star DataChannel)

Production Domain Split

The backend runs as three independent Cloudflare Workers, each with its own domain:

Domain Purpose
api.xmcl.app Core API: launcher updates, notifications, flights, mod translations
ai.xmcl.app AI chat completions proxy (Agnes)
signaling.xmcl.app Multiplayer room signaling (/v1/multiplayer/*) and WebRTC (/v1/rtc/official)

Why Cloudflare Workers & Durable Objects?

  • Global Low Latency: Signal exchanges route through Cloudflare's 300+ edge data centers globally, minimizing WebRTC connection setup times.
  • Stateful Room Objects: Each P2P room is managed by a dedicated MultiplayerRoomObject Durable Object instance with master/member roles and revisioned room-state snapshots. When a room closes or all players disconnect, the Durable Object is automatically evicted from memory.
  • High Availability: Built-in DDoS protection and serverless scalability ensure room signaling never suffers from traffic spikes or single-point failures -- eliminating the Deno Deploy quota exhaustion that caused the previous outage.

3. Why Account Sessions are Now Required

The XMCL account system was introduced in v0.66.0 (add account system #1619). Starting with v0.66.1, hosting or joining P2P online multiplayer rooms requires logging in to a lightweight XMCL Web Account (gate multiplayer behind XMCL account login).

The Reasons for Account Authentication:

  1. Spam & Abuse Prevention: Open WebRTC signaling brokers are vulnerable to automated botnets, room spamming, and denial-of-service exploits. Account sessions provide rate-limiting and access control.
  2. Cryptographic Identity Verification: Accounts enable the launcher to issue secure, DPoP-signed session tokens to verify that room hosts and guests are legitimate clients.
  3. STUN/TURN Relay Management: When direct P2P connections are restricted by strict NAT routers, account sessions grant authenticated relay access to keep your game connected smoothly.

4. Zero-Trust Privacy & Security Architecture

We understand that introducing user accounts raises privacy questions. We designed our authentication and session system under a strict Zero-Trust Privacy Model.

+-----------------------------------------------------------------------------------+
|                        XMCL ZERO-TRUST PRIVACY ARCHITECTURE                       |
+-----------------------------------------------------------------------------------+
|  1. Client-Side DPoP  : Private keys generated & stored on your device only.      |
|  2. Developer Access   : ZERO access to private keys, tokens, or credentials.     |
|  3. Cloudflare Managed : Auth & signaling run in isolated Cloudflare Workers.      |
|  4. Ephemeral Rooms    : Durable Objects evicted when rooms close or idle out.     |
|  5. No Data Harvesting : Zero tracking, zero IP logging, zero activity selling.    |
+-----------------------------------------------------------------------------------+

1. Client-Side DPoP Cryptographic Security (RFC 9449)

XMCL v0.66.1 implements DPoP (Demonstrating Proof-of-Possession) as a client-side authentication mechanism for Web Account sessions.

  • When you log in, your launcher generates an asymmetric cryptographic key pair locally on your computer. The private key never leaves your device.
  • Every API request sent to xmcl-web-api includes a DPoP proof signed by your local private key, cryptographically binding the token to your specific device.
  • Even if a session token were intercepted in transit, it is completely useless without your device's private key. This eliminates traditional token-theft attacks.

2. Zero Access by Developers & Moderators

  • Core XMCL developers, server admins, and moderators have ZERO access to user private keys or credentials.
  • All account authentication, token issuance, and validation run strictly inside Cloudflare's isolated Worker execution environment. No human operator can extract runtime secrets from a running Worker.

3. Ephemeral Room Signaling via Durable Objects

  • P2P room signaling data lives exclusively inside Cloudflare Durable Objects -- stateful, per-room instances that exist only while a room is active.
  • When all players disconnect or a room is closed, the Durable Object is automatically evicted from memory. No room state, chat history, or connection metadata persists after a session ends.
  • The launcher does not maintain any database storing user activity logs, connection history, or room archives.

4. No Data Harvesting or Activity Tracking

  • The launcher does NOT collect, harvest, track, or monetize user account data, IP addresses, or playing habits.
  • XMCL remains 100% open-source, allowing anyone to audit both the launcher source code and the xmcl-web-api backend repository.

5. How to Start Playing P2P in XMCL v0.66.1

Getting back into P2P multiplayer takes less than a minute:

  1. Update XMCL: Download the latest version (v0.66.1).
  2. Create / Sign In to Account: Click the account menu in the top-right corner and create a lightweight XMCL account.
  3. Launch Your World: Start any Minecraft single-player world.
  4. Open P2P Room: Press Esc -> Click "Open to LAN / P2P" -> Share your room link or QR code with your friends!

6. Open Source Verification & Release Links

We invite security researchers and community developers to inspect our open-source codebase:

Thank you for your patience during the backend migration. Happy gaming!

The XMCL Core Team

u/Banerbansa — 8 days ago

Стосовно одного лаунчера від українця

Я просто побачив відео про лаунчер CL launcher і я шукав огляди на цей лаунчер, але я не зміг знайти крім нього - https://youtu.be/PMiezww5OA4

Честно кажучи просто хотілось поспілкуватися як ви відноситесь до цього лаунчера ? Просто цікаво хто використовує цей лаунчера і поспілкуватися що до вайб кодинга по цьому лаунчеру

u/Banerbansa — 9 days ago
▲ 3 r/XMCL

v0.66.0 Big Update for AI + Bug Fixing

🚀 Features

🐛 Bug Fixes & Patches

🏗️ Refactors

u/Banerbansa — 10 days ago
▲ 1 r/XMCL

Status Update: P2P Multiplayer Service Downtime & Backend Migration

An in-depth update regarding the temporary outage of XMCL's Peer-to-Peer (P2P) online multiplayer service, how the launcher interacts with `xmcl-web-api`, why Deno API limits were exhausted, and our current backend migration.

---

<PostDetail>

:::warning SERVICE NOTICE

**P2P Online Room Hosting is Temporarily Unavailable.**

When attempting to create or join P2P rooms in XMCL, you may encounter `multiplayer_room_request_failed` or WebSocket connection errors. Local LAN play and joining dedicated servers remain **100% functional**.

:::

## Overview

Over the past few days, many players have reported that creating or joining online multiplayer rooms through X Minecraft Launcher (XMCL) is currently failing.

We want to provide full transparency by explaining how XMCL's P2P multiplayer system works behind the scenes, how the launcher communicates with our backend ([`xmcl-web-api`](https://github.com/Voxelum/xmcl-web-api)), why changes in Deno Deploy's free tier quotas caused this service interruption, and how we are fixing it.

---

## How XMCL P2P Multiplayer Works

XMCL's P2P multiplayer allows players to host single-player Minecraft worlds and open them to friends over the internet **without port forwarding, external server hosting, or third-party VPN tools like Hamachi**.

```

+------------------+ Signaling & Ticket Broker +------------------+

| | (https://api.xmcl.app / Web-API) | |

| Host Launcher | <======== WebSocket Control ========> | Guest Launcher |

| | (SDP & ICE Exchange) | |

+------------------+ +------------------+

| |

+================ Direct P2P WebRTC Connection ===============+

(Host-Star DataChannel Mesh)

```

### 1. Launcher Architecture & `xmcl-web-api`

The launcher (`xmcl-electron-app`) uses `@xmcl/wrtc-multiplayer` and `PeerService` to manage room life-cycles and peer connections:

- **Host Room Creation**: The host issues a request to `POST /v2/multiplayer/rooms`. The backend validates the player's XMCL session token and issues a 5-minute single-use admission ticket and WebSocket URL.

- **Control Socket**: The host opens a persistent control WebSocket (`GET /v2/multiplayer/rooms/:roomId/socket?ticket=...`).

- **Guest Admission**: Guests request an admission ticket via `POST /v2/multiplayer/rooms/:roomId/join` and connect via WebSocket to exchange WebRTC offer/answer SDP payloads and ICE candidates.

- **Direct P2P DataChannels**: Once SDP negotiation finishes, guests close their temporary WebSocket connection. All Minecraft game traffic and mod/file transfers flow **directly between peers** via WebRTC DataChannels and a local virtual port bridge (`http://localhost:25566/files/...\`). Game traffic is **never** relayed through the web API servers.

### 2. Network Topology: Host-Star Mesh

Rather than forcing every guest to connect to every other guest, XMCL uses an efficient **Host-Star topology**:

- The **Host** maintains a persistent control socket to accept new guest handshakes immediately.

- **Guests** establish WebRTC links exclusively with the host.

- STUN/TURN servers (`/rtc/official`) assist in discovering public IP addresses and traversing complex home NATs/routers (via UPnP / NAT-PMP).

---

## The Root Cause: Deno API Quotas & Limit Exhaustion

Our primary public deployment of [`xmcl-web-api`](https://github.com/Voxelum/xmcl-web-api) relied on **Deno Deploy** (using Deno KV and native WebSocket `BroadcastChannel` signaling).

Recently, Deno instituted strict platform policy updates and reduced free-tier quotas across Deno Deploy and Deno KV:

  1. **Exponential User Growth**: As XMCL's player base expanded, the sheer volume of daily WebSocket room creations, authorization tickets, and real-time signaling exchanges increased dramatically.

  2. **Quota Exhaustion**: The total API usage generated by active P2P multiplayer sessions **surpassed 100% of all Deno free-tier limits**.

  3. **API Rejection**: Deno Deploy began rejecting incoming `/v2/multiplayer/rooms` API requests and closing WebSocket connections.

Because the signaling server acts as the essential "handshake broker" required for WebRTC peers to exchange ICE candidates and establish direct connections, room creation became unavailable worldwide.

---

## What We Are Doing: Migration to Cloudflare Durable Objects

We are actively completing a major architectural migration of [`xmcl-web-api`](https://github.com/Voxelum/xmcl-web-api) away from Deno Deploy to **Cloudflare Workers with `MultiplayerRoom` Durable Objects**.

### Why Cloudflare Durable Objects?

- **Global High Availability**: Durable Objects provide stateful, low-latency WebSocket signaling nodes globally distributed across Cloudflare's edge network.

- **Zero Third-Party Quota Blocks**: Eliminates the strict free-tier API rate limits that broke the Deno deployment.

- **Enhanced Security**: Admission tickets (`XMCL_MULTIPLAYER_TICKET_SECRET`) expire after 5 minutes and single-use validation prevents room hijacking.

- **Improved TURN Infrastructure**: Expanded STUN/TURN relay server pools for higher NAT traversal success rates.

---

## What Players Should Do

:::tip PLEASE WAIT PATIENTLY

We kindly ask all players to **please wait and be patient** while we complete the backend migration and deploy the new signaling infrastructure.

:::

While online P2P room hosting is being restored:

- 📶 **Local Area Network (LAN) Play**: Playing with friends on the same physical Wi-Fi or home network operates via local multicast/ssdp discovery and remains **100% functional**.

- 🌐 **Dedicated Minecraft Servers**: Joining standard public or private Minecraft servers via IP address or domain is **completely unaffected**.

---

## Announcement Channels

Once the new Cloudflare Durable Objects backend is fully deployed and verified, **we will immediately announce service restoration** on our official communication channels:

- 📰 **XMCL Blog**: Updates and post-mortems will be published directly here in our journal.

- 💬 **Community Channels**: Announcements will be posted in our **Discord server** and **Reddit community**.

*(Note: Official status announcements are published via our blog and social channels rather than GitHub repository issues).*

We sincerely apologize for the disruption to your multiplayer gaming sessions. Thank you for your patience, support, and understanding while we upgrade our infrastructure!

blog -https://xmcl.app/en/blog/posts/p2p-multiplayer-status

reddit.com
u/Banerbansa — 21 days ago
▲ 2 r/XMCL

v0.65.1

0.65.1

🐛 Bug Fixes & Patches

🏗️ Refactors

reddit.com
u/Banerbansa — 26 days ago
▲ 1 r/XMCL

v0.65.0 + New Designer site

🚀 Features

🐛 Bug Fixes & Patches

new site - https://xmcl.app

reddit.com
u/Banerbansa — 29 days ago
▲ 1 r/XMCL

v0.63.1 Mini-fixin

🐛 Bug Fixes & Patches

🏗️ Refactors

reddit.com
u/Banerbansa — 1 month ago
▲ 1 r/XMCL

v0.63.0 Big Fixing and UI new

🚀 Features

🐛 Bug Fixes & Patches

🏗️ Refactors

reddit.com
u/Banerbansa — 1 month ago
▲ 1 r/XMCL

Hello FLATHUB VERIFICATION !

Flathub check blue

We are thrilled to announce that X Minecraft Launcher (XMCL) is now officially verified on Flathub! You will now see the blue verification badge next to our launcher on the store.

👉 Check us out at: app.xmcl.voxelum on Flathub

Our Journey to Verification

We couldn't get through before because a lot of things were missing, but we figured it out, and now—hello, verification!

Getting verified on Flathub requires proving the ownership of the domain associated with the App ID. Since our App ID is app.xmcl.voxelum, we needed to demonstrate control over our domain and address some metadata checks required by Flathub's modern AppStream validator.

Here is what we solved to make this happen:

1. Domain Ownership Verification

Flathub validates developers by looking for a unique verification token at a specific secure URL. We added our verification token under the .well-known/ directory of our official website (xmcl.app):

Once the site deployed the token, Flathub verified the domain xmcl.app immediately.

2. Refining AppData / AppStream Metadata

To comply with Flathub's strict quality standards, we updated our app description and metadata rules inside app.xmcl.voxelum.metainfo.xml:

  • Friendly Summary: Simplified the app summary to "Play and manage Minecraft" (under 35 characters, non-technical, and free of articles or redundant app name mentions).
  • Asset Updating: Replaced all old screenshots in the metadata package with fresh, high-resolution snapshots of the latest XMCL interface showcasing our multi-instance manager, modpack explorer, mod downloader, server dashboard, and game creation flow.

What This Means For You

The blue checkmark on Flathub means you can download and update XMCL with full confidence, knowing the Flatpak package is verified and maintained by the official development team.

Thank you to everyone in the community for your continued support!

reddit.com
u/Banerbansa — 1 month ago
▲ 1 r/XMCL

👋 Welcome to r/XMCL - Introduce Yourself and Read First!

Hey everyone! I'm u/Banerbansa, a founding moderator of r/XMCL.

This is our new home for all things related to {{ADD WHAT YOUR SUBREDDIT IS ABOUT HERE}}. We're excited to have you join us!

What to Post
Post anything that you think the community would find interesting, helpful, or inspiring. Feel free to share your thoughts, photos, or questions about {{ADD SOME EXAMPLES OF WHAT YOU WANT PEOPLE IN THE COMMUNITY TO POST}}.

Community Vibe
We're all about being friendly, constructive, and inclusive. Let's build a space where everyone feels comfortable sharing and connecting.

How to Get Started

  1. Introduce yourself in the comments below.
  2. Post something today! Even a simple question can spark a great conversation.
  3. If you know someone who would love this community, invite them to join.
  4. Interested in helping out? We're always looking for new moderators, so feel free to reach out to me to apply.

Thanks for being part of the very first wave. Together, let's make r/XMCL amazing.

reddit.com
u/Banerbansa — 2 months ago
▲ 1 r/XMCL

0.61.0 NEW UI SETTING &amp; GAMEPAD SUPPORT (AND STEAM DECK !)

🚀 Features

>- **ui**: overhaul settings page with search and better UX (#1524) ([c860ada0a214c7cf74a24f94cc5cc76b9e493c11](https://github.com/Voxelum/x-minecraft-launcher/commit/c860ada0a214c7cf74a24f94cc5cc76b9e493c11))

>- link resourcepack/shaderpack/save folder to global shared folder ([8fddcaa6b9a9cba842634d6759430046db2e3478](https://github.com/Voxelum/x-minecraft-launcher/commit/8fddcaa6b9a9cba842634d6759430046db2e3478))

>- auto pick background from OS desktop wallpaper ([c2681814b5ba36b56174ce4104eefb84f3d07762](https://github.com/Voxelum/x-minecraft-launcher/commit/c2681814b5ba36b56174ce4104eefb84f3d07762))

>- support datapacks from CurseForge/Modrinth per save ([b69c3b6ed199bd13a524395ebef2c18816f2a183](https://github.com/Voxelum/x-minecraft-launcher/commit/b69c3b6ed199bd13a524395ebef2c18816f2a183))

>- **ui**: extract shared ModloaderSelector and use it in version card ([96fc2eb9ecf1b899654fbc05ff5bcc337370c310](https://github.com/Voxelum/x-minecraft-launcher/commit/96fc2eb9ecf1b899654fbc05ff5bcc337370c310))

>- Support gamepad (#1514) ([21492d271155a46f8015791b7f0ee00bd0bc67ae](https://github.com/Voxelum/x-minecraft-launcher/commit/21492d271155a46f8015791b7f0ee00bd0bc67ae))

🐛 Bug Fixes & Patches

>- convert custom postprocess fallback to telemetry event ([5d089b8fae02fea334141a3fedf7a51d36babc08](https://github.com/Voxelum/x-minecraft-launcher/commit/5d089b8fae02fea334141a3fedf7a51d36babc08))

>- **i18n**: avoid Ukrainian duration plural crash ([971109039a58b535a42f72a1b2ed8d892681281e](https://github.com/Voxelum/x-minecraft-launcher/commit/971109039a58b535a42f72a1b2ed8d892681281e))

>- **telemetry**: suppress Vuetify detached overlay errors ([61d5f91f8956822abf8d54cf681de4367bbbc246](https://github.com/Voxelum/x-minecraft-launcher/commit/61d5f91f8956822abf8d54cf681de4367bbbc246))

>- **runtime**: recover project mapping sqlite cache ([70c52fc809898a9056914629a8a164d3392cda7c](https://github.com/Voxelum/x-minecraft-launcher/commit/70c52fc809898a9056914629a8a164d3392cda7c))

>- **runtime**: classify version metadata fetch failures ([ced3983ab53e2367a57f14986eca891b7dea1d46](https://github.com/Voxelum/x-minecraft-launcher/commit/ced3983ab53e2367a57f14986eca891b7dea1d46))

>- Complete some missing ui in market view ([6c24f1f3f5bde7788f54fbe4ee4a444a37484c6d](https://github.com/Voxelum/x-minecraft-launcher/commit/6c24f1f3f5bde7788f54fbe4ee4a444a37484c6d))

>- **sqlite**: suppress benign rollback + no-such-table telemetry storms ([ed954ef3e126a0c0693c6c01f9f3b68ac09ffdab](https://github.com/Voxelum/x-minecraft-launcher/commit/ed954ef3e126a0c0693c6c01f9f3b68ac09ffdab))

>- update microsoft registration URL to signup.live.com (#1534) ([c7a79944581b802d6cb8b05cbd5aaaf15bd4b7b6](https://github.com/Voxelum/x-minecraft-launcher/commit/c7a79944581b802d6cb8b05cbd5aaaf15bd4b7b6))

>- Try fix race condition of worker queue ([37b16aa259c9797fa46fe126244bb466c730e576](https://github.com/Voxelum/x-minecraft-launcher/commit/37b16aa259c9797fa46fe126244bb466c730e576))

u/Banerbansa — 2 months ago
▲ 2 r/XMCL+1 crossposts

Gamepad Test on the Launcher (I'll show you how to use it, create an instance, and install a mod to enable gamepad support for the Java v

I was working in (dev); sometimes there might be a glitch effect, but it only shows up in the recording.

I don't use a gamepad very often (or rather, rarely), so I've been dragging my feet on this. But by creating this, we'll provide REAL support for the Steam Deck—unlike PrismLauncher, which just added a text mention but failed to implement even basic gamepad support.

I’ve now reached the final stage, and after version 6.0.0, gamepad support will be 100% ready.

I’ll answer a few quick questions right away:

* Will there be support for other gamepads? - Yes, there will be support for Xbox, PS5, PS4, and PS3 (PS2 and PS1 aren’t really supported), and once it’s released, I’ll try to add support for Nintendo and Wii

* Do I need a license to use this feature? - No, it’s free

* Is there keyboard support? - There used to be... but I removed it at CI010’s request

Here are his words

* Is the mod safe to install? - Don’t blame us—blame Modrinth—that’s where the mod is downloaded from

* Can I choose not to install the mod? - Yes, just press “B”

/If you have any questions or suggestions, let me know—I’ll look into them and make improvements/

In the meantime, here’s my PR: https://github.com/Voxelum/x-minecraft-launcher/pull/1514

reddit.com
u/Banerbansa — 2 months ago
▲ 1 r/XMCL

BEDROCK SUPPORT VERSION COMING SOON

1. It will appear if a bedrock is purchased

Hello everyone! I wanted to tell you that we recently started a new project and finished it. In the new version you will be able to play the Bedrock version (though only on Windows), there will be no physical support for Linux and Mac, and it is also not possible to implement it. Also, Bedrock is available only to those who have purchased a license.

2. It will be normal if this happens, you need to click download and wait, it downloads through winget bedrock.

check and you can play :3

reddit.com
u/Banerbansa — 2 months ago
▲ 1 r/XMCL

Hello to technology and modern technologies! 😼

Questions, design, themes, ideas, we are developing a launcher that wins in functionality, design and most importantly, that this is not a fork of MultiMC or another launcher - the design was made from scratch, the functionality is difficult. The main goal on our server is to help people get pleasant emotions from the launcher, as well as answer questions and show small updates

reddit.com
u/Banerbansa — 2 months ago