Minecraft Server Management Protocol vs RCON (26.3)

You want a Discord bot, a web page or a script to talk to your Minecraft server. For years the answer was RCON. Since Java 1.21.9 the vanilla dedicated server has a second way in, the Minecraft Server Management Protocol, and 26.3 ships version 3.1.0 of it. This reference puts the two side by side: the server.properties keys, the security defaults, what each one can and cannot do, and which one fits what you are building. Everything below comes from Mojang's changelogs and the Minecraft Wiki, checked on 3 November 2026.

Quick answer: RCON sends any console command as plain text over TCP port 25575, protected by one unencrypted password, and it only answers what you ask. The Minecraft Server Management Protocol is JSON-RPC over a WebSocket with TLS on by default and a 40-character secret, and it pushes events such as player joins to your tool. It only offers Mojang's fixed methods (players, allowlist, bans, operators, server settings, game rules, save and stop), so it cannot run /give or /tp. Use the protocol for a bot that lists players, manages the allowlist or reacts to joins. Keep RCON for tools that need arbitrary commands. Both are off by default, and neither belongs on the open internet without protection.

RCON vs the Management Protocol at a glance

A fresh 26.3 server.properties still contains enable-rcon, rcon.port and rcon.password, so RCON is not going away yet. Mojang's 26.4 snapshot changelogs up to snapshot 7 (3 November 2026) list no change to either one. Both are Java Edition only: a Bedrock Dedicated Server has neither set of keys.

What the Management Protocol can and cannot do

Every method sits in the minecraft namespace:

• minecraft:players lists online players and kicks them, with an optional kick message.
• minecraft:allowlist, minecraft:bans, minecraft:ip_bans and minecraft:operators read, add, remove, set or clear each list. Our whitelist guide shows the allowlist calls a bot needs.
• minecraft:server has /status, /save, /stop and /system_message, which sends a message to chat or the action bar for all players or chosen ones.
• minecraft:serversettings reads and sets live settings such as the MOTD, max players, difficulty, default game mode, view and simulation distance, idle timeout, whether the allowlist is on and enforced, and hide_online_players.
• minecraft:gamerules lists every game rule with its value and updates one.

Notifications arrive without a request: minecraft:notification/players/joined and /left, server started, stopping, saving and saved, changes to the allowlist, bans and operators, game rule updates, and since 3.1.0 four world/upgrade_* notifications when the server upgrades a world on startup. Set status-heartbeat-interval to a number of seconds and the server also sends a status heartbeat with the online players and the version.

To see the methods your own server offers, send {"jsonrpc":"2.0","method":"rpc.discover","id":1}. The reply is the full schema of the running server.

What it cannot do: neither Mojang's list of method groups nor the wiki's method tables include a method that runs a console command, and no notification carries player chat. For /give, /tp or a plugin's own commands you still need RCON or the console. A Discord chat bridge still needs a plugin such as DiscordSRV. Mojang does allow custom namespaces, so a mod can add its own methods and events.

The version matters if you write a tool. 1.21.11 moved to 2.0.0: it added browser logins and changed game rule values from strings to booleans or integers. 26.2 moved to 3.0.0: the management server now starts before the world loads, and only rpc.discover and the status heartbeat work until the server is up. Other calls get an error during that time. 26.3 added the world upgrade notifications as 3.1.0. Mojang also removed "some log lines that server software might look out for" in 26.3 and points to this protocol instead, which is why a log-reading bot is worth moving now. Our 26.3 update guide covers the rest of that release.

Turn on the Management Protocol in server.properties

Stop the server and set these keys:

management-server-enabled=true
management-server-host=localhost
management-server-port=25585
management-server-secret=
management-server-tls-enabled=true
management-server-tls-keystore=management.p12
status-heartbeat-interval=30

• Port: the default 0 picks a random port on every start, so set a fixed free port. 25585 is only an example.
• Secret: leave it empty and the server generates one and writes it into server.properties. If you set your own, it must be exactly 40 letters and digits (A to Z, a to z, 0 to 9). Requests without it get 401 Unauthorized.
• Host: localhost means only programs on the same machine can connect. For a bot that runs elsewhere, set the address it connects to (0.0.0.0 listens on every address), and keep TLS on.
• TLS: on by default, and Mojang's changelog says a dedicated server "won't start when TLS is enabled and no keystore is provided". If you only switched the protocol on and the server now refuses to start, this is why.

Make a PKCS12 keystore with keytool, which comes with Java, in the server folder:

keytool -genkeypair -alias management -keyalg RSA -keysize 2048 -storetype PKCS12 -keystore management.p12 -validity 3650

It asks for a password and some name fields. Give the server that password through the environment variable MINECRAFT_MANAGEMENT_TLS_KEYSTORE_PASSWORD, the JVM argument -Dmanagement.tls.keystore.password=, or the key management-server-tls-keystore-password (checked in that order). The first two keep it out of server.properties.

If the only client is a bot on the same machine and the host stays localhost, you can set management-server-tls-enabled=false instead, because that traffic never leaves the machine. management-server-allowed-origins only matters for a tool that runs in a web browser and logs in through the Sec-WebSocket-Protocol header. It is empty by default, which switches that kind of login off.

Test it with a few lines of Python

This uses the websockets library (pip install websockets, version 17.4 on 3 November 2026). Put in your secret and port:

import asyncio
import json
import ssl

from websockets.asyncio.client import connect

SECRET = "your 40-character management-server-secret"
URI = "wss://127.0.0.1:25585"

# keytool made a self-signed certificate, so this test skips verification.
# Only do that for a connection that stays on this machine or inside an SSH tunnel.
tls = ssl.create_default_context()
tls.check_hostname = False
tls.verify_mode = ssl.CERT_NONE


async def main():
    headers = {"Authorization": f"Bearer {SECRET}"}
    async with connect(URI, additional_headers=headers, ssl=tls) as ws:
        await ws.send(json.dumps({"jsonrpc": "2.0", "id": 1, "method": "minecraft:players"}))
        async for message in ws:
            print(message)


asyncio.run(main())

You get a reply with "id":1 and the players online, then one line for every join, leave and heartbeat until you press Ctrl+C. With TLS off, use ws:// and remove ssl=tls. A wrong secret fails the connection with HTTP 401.

Turn on RCON, and keep it private

enable-rcon=true
rcon.port=25575
rcon.password=use-a-long-random-password
broadcast-rcon-to-ops=false

With an empty rcon.password, RCON does not start at all. broadcast-rcon-to-ops is true by default and sends the output of every RCON command to the operators who are online, which gets noisy once a bot polls every few seconds.

The wiki is blunt about the risk: RCON "is not encrypted", everything sent "(including the rcon password) can be intercepted", and you should ideally only connect from localhost. server.properties has no host setting of its own for RCON, so keep port 25575 closed in your firewall. If you run the server on your own VPS, reach RCON through an SSH tunnel instead (ssh -L 25575:127.0.0.1:25575 you@your-server) and connect to 127.0.0.1 on your own computer. Our security guide covers the firewall side.

A quick test with mcrcon (latest release 0.7.2):

export MCRCON_PASS='your rcon.password'
mcrcon -H 127.0.0.1 -P 25575 "list"

Passing the password through the environment variable instead of -p keeps it out of the process list that other users on the machine can see. Two quirks matter for bots: the wiki notes there is "no way of detecting unknown commands", and long output comes in several 4,096-byte packets with no clean end marker, so parse replies with care.

Both secrets sit in plain text in server.properties, so anyone who can read your server files can read them. On Space-Node's Minecraft hosting, every plan includes three port allocations: the game port plus two more that you add yourself in the panel. A port you add there can be reached from the internet just like the game port, so it suits the management server with TLS on. If you give one to RCON instead, use a long random password.

Which one should your bot or panel use?

• Whitelist form or Discord whitelist bot: the Management Protocol. Adding and removing players is one call, and you never send a raw command.
• Join and leave messages, online count: the Management Protocol. Joins and leaves are pushed, and the heartbeat gives the player list. With RCON you poll list.
• Startup progress on a status page: the Management Protocol, 3.0.0 or later, which answers while the world loads and reports world upgrades since 3.1.0.
• /give, /tp, /execute or plugin commands: RCON, or the console in your panel.
• Chat between Discord and Minecraft: neither; use a plugin or mod built for it.

Mojang and the wiki document the protocol for the vanilla server. If you run Paper or a modded server, start it once on 1.21.9 or newer and check that the management-server- keys appear in server.properties before you build on them. Our server.properties guide explains the settings you are most likely to change.

FAQ

Is the Minecraft Server Management Protocol replacing RCON?

Not so far. 26.3 still writes the RCON keys into a new server.properties, and the 26.4 snapshots up to snapshot 7 do not remove them. Mojang does point tools that read the log to the new protocol.

Can I run commands through the Management Protocol?

Not arbitrary ones. You get Mojang's fixed methods for players, lists, settings, game rules, saving and stopping. For any other command, use RCON or the console.

What port does the Management Protocol use?

None by default: management-server-port=0 picks a random free port each time the server starts. Set a fixed port so your bot can find it.

Why won't my server start after I enabled the Management Protocol?

TLS is on by default and needs a keystore. Set management-server-tls-keystore to a PKCS12 file made with keytool, or set management-server-tls-enabled=false if only local programs connect.

Is it safe to open RCON to the internet?

No. RCON is unencrypted, so the password and every command can be read on the way. Keep the port closed and use localhost or an SSH tunnel.

Does Bedrock have RCON or the Management Protocol?

No. The wiki marks both as Java Edition only, and the Bedrock Dedicated Server's server.properties has neither set of keys.

Sources

All opened on 3 November 2026:

• Minecraft Wiki: Minecraft Server Management Protocol, RCON, server.properties
• Mojang changelogs: Java Edition 1.21.9, 1.21.11, 26.2, 26.3, 26.4 Snapshot 7
• Mojang: version manifest
• JSON-RPC 2.0 specification
• websockets: asyncio client reference, PyPI
• mcrcon README and releases
• MC-SMP, the example Python client the wiki links