Comparison based on publicly available information as of July 2026, including github.com/jonesdevelopment/sonar. Sonar is free open-source software we genuinely respect; spot an inaccuracy and we'll fix it — tell us on Discord.
The one difference that explains all the others
Sonar is a plugin. It runs on your server (or proxy), which means every connection it inspects has already been accepted by your kernel, allocated a session by your proxy, and parsed by your CPU. Arvoris is an edge network. It inspects connections at a PoP near the player, before they ever reach your hardware. Same goal — stop bots — on opposite sides of the wire. Almost every practical difference below follows from that.
Where Sonar is strong
- It's free and open source — GPL-3.0, per github.com/jonesdevelopment/sonar as of July 2026, with no player cap because it runs on your own hardware.
- Real physics verification — it sends new connections to a lightweight fake server and checks gravity, block collision, vehicle packets and vanilla protocol conformance, rather than pattern-matching nicknames or reconnect rate.
- Actively maintained — frequent releases and a healthy community.
- Zero third-party dependency — no DNS change, no external network in your path; everything runs where your server runs.
- Genuinely enough for many servers — if you can absorb the connection volume of the attacks you actually get, Sonar alone will hold, and it costs nothing.
Where Arvoris differs
- Filtering happens before your box — bots die at the edge PoP, so your server never allocates a connection slot, a thread or a login event for them. A plugin fights the same bots after they've already cost you those resources.
- It survives attacks bigger than your machine — a plugin is bounded by your uplink and your proxy's accept loop. Good antibots top out around 10–20k connections/sec per thread; a 1 Gbit+ Layer-7 flood is cheap to rent and saturates a single box long before the detection logic runs. The edge absorbs that upstream.
- The checks aren't public — open-source antibot code can be studied and beaten. Arvoris' gauntlet is proprietary and updated frequently, with per-session randomization so a recorded solution doesn't replay.
- Bypass-bot detection layered, not single-signal — CryoLimbo verification plus AntiVPN, risk scoring on origin/ASN/behavior, stolen-account detection and fingerprint bans. A bot that beats one layer still has to beat the rest.
- Volumetric protection in the same system — Sonar is a Layer-7 antibot only; a volumetric flood that fills your pipe is out of scope for any plugin. Arvoris antibot is the Layer-7 half of a stack that also absorbs Layer-4 floods at 500+ Tbps of anycast capacity.
- Real player IPs preserved — the true client address is delivered to your backend via PROXY protocol on every plan, so your bans and geo plugins keep working.
Bypass bots: the reason people outgrow a plugin
The failure mode isn't that Sonar's checks are weak — they're good. It's that they're public. Anyone can read exactly what Sonar verifies and build a client that produces physically-correct falling, valid collision and legitimate vehicle packets. That's what a bypass bot is, and it's why "Sonar bypass" is a search term. It's the structural cost of open source: the same transparency that makes the plugin trustworthy also hands attackers the test they need to pass.
Arvoris makes the opposite trade. The verification gauntlet isn't published, it changes, and it randomizes per session — spawn geometry, challenge order and identifiers differ each time, so a bot recorded against one attempt doesn't validate against the next. On top of the physics layer sit behavioral scoring, AntiVPN classification, account-reputation checks and client fingerprinting, so defeating any single signal isn't enough to get through. A bot tuned to beat a physics check still trips on the ones it can't see.
Side by side
| Where it runs | Sonar: on your server/proxy, after the connection is accepted. Arvoris: at the edge PoP, before your box sees it |
| Price | Sonar: free, no player cap (your hardware). Arvoris: free tier to 15 players, then $10/$25/$40 by player slots |
| Detection method | Sonar: vanilla physics + protocol conformance. Arvoris: proprietary randomized gauntlet + AntiVPN + risk scoring + fingerprint bans |
| Checks are public? | Sonar: yes (open source) — studyable by bot authors. Arvoris: no — proprietary and frequently updated |
| Survives a flood bigger than your box? | Sonar: no — bounded by your uplink and accept loop. Arvoris: yes — absorbed upstream at the edge |
| Volumetric (Layer-4) protection | Sonar: out of scope (antibot only). Arvoris: included, 500+ Tbps anycast absorption |
| Best role | Sonar: on-box second layer behind an edge. Arvoris: first line at the edge for scale, volumetric cover and bypass resistance |
The honest recommendation
This isn't really an either/or, and framing it that way does you a disservice. Run both. The right shape for almost any server is an edge provider in front and Sonar on the backend behind it: the edge absorbs the volume your machine physically cannot accept and stops bots before they cost you a connection slot, and Sonar acts as your second layer, verifying anything that reaches the box. Defence in depth is the point — two independent checks, on opposite sides of the wire, fail in different ways.
The reason the edge half matters even on a quiet server is that its absence is only discovered during the one attack that actually hurts. A plugin cannot help with a volumetric flood that fills your uplink — that is out of scope for anything running on your hardware, no matter how good it is. And a bypass bot written against Sonar's public checks is exactly the scenario where a second, unpublished gauntlet upstream earns its place. Keeping Sonar behind it isn't redundancy for its own sake; it's the layer that catches whatever the edge passes through.
Since Arvoris' free tier runs the full mitigation pipeline and Sonar is free and open source, the two-layer setup costs a DNS change and nothing else. If you'd rather run Sonar alone for now, it's a genuinely good plugin and it will serve a smaller server well — just know which half of the problem it can't cover.
Common questions
Is Sonar good?+
Yes — Sonar is one of the best free antibots available. It's open source (GPL-3.0, per github.com/jonesdevelopment/sonar as of July 2026), actively maintained, and it verifies real client physics — gravity, collision, vehicle packets and vanilla protocol conformance — rather than guessing from nicknames or reconnect rate. For a server that can absorb the connection volume of its attacks, Sonar is a genuinely good answer and it's free. It works best with an edge in front of it, though: a plugin can't do anything about a volumetric flood that fills your uplink, and its open checks are what bypass bots are written against. Run Sonar, and put something upstream to cover the half it structurally can't.
What is a bypass bot?+
A bot written specifically to defeat a known antibot. Because Sonar is open source, its exact checks are public — so bot authors study the code, build a client that produces physically-correct movement and valid packets, and pass verification. "Sonar bypass" is a thing people search for because open checks can be studied and beaten. Arvoris runs a proprietary, frequently-updated gauntlet with per-session randomization, so a bot tuned against one challenge doesn't automatically pass the next.
Can I use Arvoris and Sonar together?+
Yes, and it's a good setup. Put Arvoris at the edge to absorb the volume and catch bots upstream, and keep Sonar on your backend as a second layer for anything that reaches it. Edge filtering and a plugin aren't mutually exclusive — the edge handles the flood your box physically can't accept, and the plugin verifies whatever's left. Since Sonar is free and Arvoris has a free tier, running both costs nothing but a DNS change.
Why can't a plugin stop a large bot attack on its own?+
Because a plugin runs after your kernel has accepted the TCP connection, your proxy has allocated a session, and your CPU has parsed the handshake. Its verification logic is excellent, but it only runs once the connection is already on your box. When a join flood is large enough to saturate your uplink or exhaust your proxy's accept loop, the plugin never gets a turn — the connections that would have failed verification have already consumed the resource that mattered. Arvoris filters before that point, upstream of your hardware.
Does Arvoris verify players like Sonar does?+
Yes — CryoLimbo detours suspicious joins into a lightweight limbo world and makes them prove they're human, from a simple captcha up to multi-level behavioral checks, before they ever touch your backend. The difference is where it runs (the edge, not your box) and that the checks aren't published for bot authors to reverse-engineer. It also layers AntiVPN, risk scoring and fingerprint bans on top, which a physics-only plugin doesn't do.
Is Arvoris free like Sonar?+
Arvoris has a free tier (up to 15 concurrent players, the full mitigation pipeline, real player IPs, no bandwidth cap), but Sonar itself is fully free with no player cap since it runs on your own hardware. The honest framing: Sonar costs you nothing but your own CPU and uplink; Arvoris costs nothing on the free tier and gives you an edge that doesn't depend on your box surviving the flood. Most servers end up wanting both.
Test it in five minutes on a spare subdomain: create a free network, point it at your backend, and keep Sonar running behind it. The free plan is the same pipeline as every paid tier, so a weekend trial tells you more than any table.