Any host. Every transaction validated.

The open-source game backend for s&box. Let players host or run dedicated servers: saves, purchases, rewards and combat results are checked on your server before anything is saved. You don't need dedicated gameplay servers just to protect stored data.
  • Game values: define weapons, items, prices and tuning once. Your game loads every table in one call and predicts locally (a zombie's health is 20 × its level); your endpoints check each claim against the same numbers.
  • Versioned with every build: publishing a build snapshots its endpoints, collections and game values. Players still on the old build keep theirs, so nobody is sent an item their build cannot load. Or keep it simple and push straight to live.
  • Built against exploits: endpoint-only collections refuse direct client writes. Endpoints recompute rewards from game values and the server clock, so hits faster than a weapon can fire, a skewed client clock or a replayed kill are rejected, not saved.
  • Any host: player-hosted, P2P, dedicated and hybrid. Player hosts only hold the public key; secret keys never ship in your game.
  • Simple and yours: one command installs the open-source server (AGPL-3.0) on your machine or VPS, with SQLite or PostgreSQL and a free HTTPS name. No sboxcool account or subscription.
  • Modern tooling: owner dashboard with guided editors, dry-run endpoint tests, version history and live monitoring, plus YAML editor sync, this C# library, a CLI and MCP for coding agents.
Start: add this library via Editor → Library Manager. Run your backend, then set its Base URL and project keys in Editor → Network Storage → Setup. Restart if the menu is missing.
Keep authority on the backend: use endpoint-only collections and validated rules. Never ship secret keys. Server checks bound what a client can claim; they cannot prove client-reported gameplay happened.
Screenshots: the owner console from release 0.5.4 with generated sample data.