Ekaxiom

A privacy-respecting build of Axiom — Moulberry's high-end Minecraft world-editing client, with the telemetry stripped out and every commercial feature unlocked.

Ekaxiom is the same Axiom you know. Same world-editing tools, same mixin compatibility, same multiplayer protocol, same modpacks. Two differences:

• Zero phone-home. No UUID, no server hostname, no server IP — nothing — leaves your client. The remote kill switch is dead. The license check never runs.
• Every commercial feature unlocked. hasCommercialLicense() returns true at the bytecode level. Nothing is gated, nothing is paywalled.

The Fabric mod id (axiom), package names, and mixin namespaces are kept identical to upstream, so Ekaxiom drops into any modpack or server that supports Axiom without further config.

Install

Grab the latest patched jar from the Releases page and drop it into ~/.minecraft/mods/. Done.

CI auto-builds Ekaxiom within 24 hours of every upstream Axiom release. Release tags mirror upstream — v5.4.1-unlock is built from upstream Axiom 5.4.1, and so on.

Why Ekaxiom exists

Axiom is closed-source ("All Rights Reserved") and, in upstream form:

• sends (your UUID, server hostname, server IP) to axiom.moulberry.com every time you join a public server,
• carries a remote kill switch (mod_disabled in the /api/mcauth/meta response),
• gates a long list of features behind a paid JWT license.

The audit notes under reports/ walk through, phase by phase, exactly what each network call does and why it's safe to neutralize. Six methods across three classes — that's the entire patch surface. No protocol changes, no surrounding code touched, no obfuscation of intent.

Read the audit. Trust the patch.

How it works

AxiomPatcher.java is a single-file ASM 9.7 bytecode patcher. It takes the official Axiom jar from Modrinth (sha512-verified), rewrites exactly six methods, and writes a patched jar.

Class	Method	Rewrite
Authorization	getMeta()	empty Meta record → no kill switch, no nag
Authorization	hasCommercialLicense()	true — the master switch
Authorization	checkCommercial(UUID)	flips the local flag, returns TRUE
Authorization	checkServer(String, String, UUID)	returns COMMERCIAL
Authorization (duplicated in JIJ, Greek-omicron homoglyph package)	same four	same
LocalizationLoader	fetchUpdateCount()	throws → caller falls back to cached i18n

User-visible strings (mod list entry, in-game UI, chat, tutorial copy, language values) are rebranded to Ekaxiom so a patched jar is never mistaken for the upstream paid build.

Two safety nets fire on every CI run:

1. Strict completeness check. If Moulberry restructures a class or renames a method, the patcher refuses to ship a partial patch. The workflow fails loudly, no release is cut, the previous release stays canonical.
2. Bytecode smoke test. Confirms no moulberry.com URL constants and no HttpURLConnection invocations survive in the rewritten method bodies.

Build it yourself

If you'd rather not trust the release jar, the build is fully reproducible:

# Prereqs: JDK 17+, curl, unzip
mkdir -p tools && cd tools
for j in asm asm-tree asm-commons asm-util; do
    curl -sSLO "https://repo1.maven.org/maven2/org/ow2/asm/$j/9.7.1/$j-9.7.1.jar"
done
cd ..

javac --release 17 \
    -cp "tools/asm-9.7.1.jar:tools/asm-tree-9.7.1.jar:tools/asm-commons-9.7.1.jar" \
    AxiomPatcher.java

curl -sSL -o Axiom-5.4.1-for-MC26.1.jar \
    "https://cdn.modrinth.com/data/N6n5dqoA/versions/FR24mVMv/Axiom-5.4.1-for-MC26.1.jar"

# Verify upstream sha512 before patching
test "$(shasum -a 512 Axiom-5.4.1-for-MC26.1.jar | cut -d' ' -f1)" = \
     "5e923c7e19d53743455c91e3192f5c2b935dab77b31afa2eeddbadacdd5f5cf8cabc42144a2401a57becd63c8639502ff7933d09c59583007aa06925dfbbf3f8"

java -cp ".:tools/asm-9.7.1.jar:tools/asm-tree-9.7.1.jar:tools/asm-commons-9.7.1.jar" \
    AxiomPatcher Axiom-5.4.1-for-MC26.1.jar Axiom-5.4.1-patched.jar

Drop Axiom-5.4.1-patched.jar into ~/.minecraft/mods/.

What the audit found

A short summary of reports/ — read the full chain (PHASE 0 → PHASE 7) for evidence:

• No backdoor in the upstream jar. All network calls target axiom.moulberry.com (auth + i18n) or open the user's browser. The license JWT carries a single boolean claim (commercial) — no code, no URLs, no script — so the license channel is not an injection vector. (PHASE 7)
• Anti-audit obfuscation is present. The auth class is duplicated under a Greek-omicron-mangled package name (axiοm ≠ axiom) inside a jar-in-jar. Hostile to inspection, but not malicious. (PHASE 1)
• Privacy concerns in upstream are real. Every public-server connection sent (UUID, server hostname, server IP) to Moulberry. The mod_disabled field was a remote kill switch. Both are neutralized here. (PHASE 2)
• Two server-driven URL fetchers remain (image annotations, blueprint clipboard install). They are triggered by user action, not automatic, so they stay. (PHASE 4)

Honest caveats

A few things Ekaxiom does not do, because pretending otherwise would be dishonest:

• It is not a source fork. Axiom is closed-source. Ekaxiom is a binary patch of the official jar, applied at build time by AxiomPatcher.java. No Axiom source code is redistributed in this repository.
• It does not strip every outbound URL. The two user-triggered fetchers above remain. If you want them gone too, reports/PHASE4-patches.md describes the stricter mode.
• It is not endorsed by Moulberry. Axiom is © Moulberry under "All Rights Reserved." Use the patched jar locally; the legal terms of any redistribution are between you and Moulberry.

---

Repo layout: AxiomPatcher.java (the patcher), .forgejo/workflows/ (CI — manual + daily auto-build), reports/ (full audit, PHASE 0 → 7).