Is Verity Mod Safe? Source and Virus Checks

The honest answer

There is no useful yes-or-no safety label for every file called “Verity Mod.” The name is used in searches for an original horror character, maintained Java and Bedrock adaptations, older projects, same-name uploads, and reposts. Safety must be evaluated for a specific source, Project ID, release, and configuration.

This guide identifies three project pages: Verity JE by VarmiteYT, Verity BE by Utlover65, and Verity - Bedrock Edition by PnTMC. They are useful starting points, not security certificates. You can inspect their authors, file histories, versions, changelogs, and support information instead of downloading an isolated package from an unknown host.

Five checks before downloading

1. Project details: verify the title, author, Project ID, edition, and supported version. Verity JE is ID 1591438. The Bedrock projects are Verity BE ID 1574632 and Verity - Bedrock Edition ID 1575941.
2. Link path: arrive at the project page through a normal HTTPS URL. Avoid URL shorteners, ad-gated redirects, shared drives, chat attachments, and “backup” links.
3. Version fit: choose the exact game version and loader or Bedrock build. A file that cannot belong in your environment is already the wrong file, even before a security scan.
4. Local scan: use current operating-system and security tools. A clean scan lowers concern but does not prove harmless behavior; a positive detection needs investigation rather than automatic dismissal.
5. Before running: do not execute a file you suspect is malicious or whose source you cannot verify. A separate launcher profile or test world does not make that file safe.

Keep the project page open while testing. If the package name, size, date, or dependency expectations differ from the page you intended to use, stop and re-check the download history.

What a legitimate file looks like

Knowing the expected file format is one of the fastest ways to reject a fake download. It costs nothing and catches many lures before any scanner is involved.

Edition	Expected package	Where it goes	Warning signs
Java (Forge, NeoForge, or Fabric)	A single .jar file	The mods folder of a profile that uses the matching loader	.exe, .bat, .msi, .scr, or a .jar you are told to double-click as an “installer”
Bedrock	.mcaddon or .mcpack	Imported by opening it with Minecraft	A .zip asking you to disable protection, an .apk claiming to be the add-on, or a separate “unlocker” app
Modpack exports	A launcher-specific archive or profile	Imported through the launcher you use	Archives that require a password from a comment or video description

A loader installer such as Forge or Fabric is a separate tool from its own official site. It should never arrive bundled inside a file labeled “Verity Mod.” If a page claims you need a special Verity launcher, account login, or “activation key” to play, close it. None of the checked projects require any of these.

Red flags on download pages

Fake download pages often copy thumbnails and titles from popular videos. Look for these patterns, because one is enough reason to leave:

• Countdown or ad-gated links that send you through several pages before a file appears.
• “Human verification” surveys, app installs, or browser notification prompts before a download.
• Version promises the real project does not make, such as “Verity for every version,” “1.21 unofficial port,” or “Bedrock to Java converted.”
• Comments that all sound identical, are recent, and praise the file without describing gameplay.
• A different author name from the one on the project page, or no author at all.
• Requests to disable antivirus or add an exclusion “because mods are falsely flagged.”
• A password-protected archive, which can prevent security tools from checking the contents.

Legitimate project pages may show advertisements, but they show the file name, size, upload date, and game version before you download. If that information is hidden until after a file arrives, you cannot compare it with what you meant to install.

A bundled configuration worth checking

On September 16, 2026, we inspected the published Ultimate VERITY 1.20 archive, Project ID 1584643, file 8467605. Its overrides/config/verity-common.toml contained a non-empty, key-shaped value, while the client configuration’s apiKey was empty. We did not test the value or establish who owned it.

If you use that exact export, clear the bundled value before first launch and configure your own provider account. Do not try, share, or reuse someone else’s credential. If the exposed key belongs to you, revoke it through your provider. Removing a bundled value is not a security certification for the rest of the pack.

This finding concerns one inspected archive, not every Verity download or later release, and does not establish that the pack is malware. See the modpack configuration findings for the dependency and configuration comparison and the link to the exact CurseForge file page.

Project source versus “official”

“Official” can mean several things and is often used too broadly. ThatMob is the creator source associated with the Verity character and video context. The playable Java and Bedrock projects are adaptations maintained by other people. The Verity JE page states that it has explicit permission from ThatMob, while both checked Bedrock team pages list thatmobyt as an Author member. Those project-specific signals do not transfer to every fork, reupload, or old package using the name.

The clearest description is the project page published by that adaptation’s author. It tells you who owns that release and where updates are published without pretending that Java, Bedrock, and the original videos are the same thing.

Same names and reused project slugs

Search results contain several projects that should not be merged. Our July 20 record identified Verity Remake, Project ID 1587777, at the CurseForge address /minecraft/mc-mods/verity-mod. A new lookup on September 16 returned 404; that does not establish why it became unavailable. It is not the Verity JE page, whose ID is 1591438. A familiar address is not proof that the project stayed the same, and an unavailable page is not a reason to trust a replacement mirror.

Modrinth also lists a Verity Java project for Fabric 1.20.1 and a separate Verity (Horror) project for Forge 1.20.1. Their own pages support only their own files and claims; they do not show that either project is a mirror or successor of Verity JE. Likewise, Verity Pocket Edition (Be) by vexi1111_, Project ID 1596246, is separate from the two Bedrock projects described here.

This does not label those additional projects malicious. It only establishes that they are different projects. Evaluate each source, author, Project ID, loader, game version, permissions, and history independently.

Mirrors and recovered removed files

A mirror removes context. You may lose the project ID, changelog, dependency relation, moderation history, and a way to tell whether a newer file replaced an older one. A recovered file adds another uncertainty: even if the person sharing it has a genuine old package, you cannot establish that the copy is unchanged merely from its title.

Do not use a mirror because the current project does not support your preferred version. An unknown download cannot safely fill that compatibility gap. Choose a supported version, wait for a project update, or do not install.

When a project is removed, avoid assigning a reason unless the project author or platform identifies that specific project. Community threads about Verity contain conflicting stories, including security claims and creator disputes. They show that people are asking, not that one explanation is true.

Java and Bedrock carry different risks

The two editions run content in different ways, so the same safety advice applies with different emphasis.

Java mods are compiled code loaded by Forge, NeoForge, or Fabric. Once loaded, a mod runs with roughly the same access as the game process, which can include reading and writing files your user account can reach and making network connections. That is why the source matters so much for Java: a trusted loader cannot tell a helpful mod from a harmful one.

Bedrock add-ons consist of behavior packs, resource packs, and scripts that run inside Minecraft’s add-on system. That system limits what scripts can do compared with arbitrary desktop code. The bigger Bedrock risks usually sit around the add-on: fake “installer” apps, modified game clients, phishing pages that ask for a Microsoft login, and APK files that claim to unlock content. On phones and consoles, install add-ons only through the methods described on the project page and never sign in to your Microsoft account on a third-party download site.

Neither edition is “safe by default.” The edition changes which warning signs matter most, not whether verification is necessary.

Protect your Groq API key

The Java project can use Groq. A Groq API key authorizes requests under your account and should be treated like a password. Create it only in the Groq console. Enter it only in the current Verity configuration location documented by the project. This site has no field for it and no reason to receive it.

Do not paste the value into:

• a download website;
• Discord, Reddit, YouTube comments, or direct messages;
• a public support ticket;
• a screenshot or livestream;
• an unredacted log;
• a public repository or shared configuration archive.

If exposure is possible, revoke the API key first. Deleting a message later does not guarantee that the value was not copied. Create a replacement and update the local configuration. When requesting help, describe the error code and redact the key completely; showing its first or last characters is rarely necessary.

Be especially careful when sharing a modpack or a full config folder with friends. Configuration files travel with exports, and a key added for your own testing can end up in someone else’s download, as the archive above shows. Clear provider credentials before you export, zip, or upload any profile.

Understand permissions and network behavior

An AI companion can legitimately use features that deserve attention: outbound network requests, microphone access for speech, local files for configuration, and a local Ollama service. You should still understand what data leaves your computer and which permissions are active.

For Groq, prompts leave the game to reach a cloud provider. For Ollama, model inference can remain on the local machine, but the service still listens on a local address and consumes system resources. For Bedrock, the add-on uses its project’s documented connection process. Review the current project description and avoid sending private information in prompts with any setup.

What we found in PnTMC’s helper. We read the source of PnTMC’s v4.0.3 helper for Windows, Android, and iOS without running it. It contained no bundled API keys, listened only on 127.0.0.1, and contacted only Groq and FishAudio. With each message it sends Verity’s instructions, your last 12 chat messages, and game context such as your biome and what you are looking at; voice recordings are deleted after transcription. Its two Windows administrator scripts only add a Minecraft loopback exemption and remove a firewall rule. Details are in the Bedrock guide. This covers that release only; a helper from another source should be checked again.

Horror-themed dialogue may imply that Verity knows more than it does. Treat narrative text as narrative unless you have reproducible technical evidence of unexpected access. Do not dismiss a real security alert because the mod is designed to be unsettling. Stop running the suspect file, follow your security tool’s guidance, and retain the alert details for investigation.

Microphone and speech features

If a version you install offers voice input, your operating system should ask for microphone permission for Java or the Minecraft app. You can deny or revoke that permission in system settings and continue using text features where the project supports them. Granting microphone access to Minecraft applies to the whole game process, not only to Verity, so revoke it when you no longer need voice features.

What we found inside each project’s files

We opened the actual files of all three projects (Verity JE 5.7.4 and 6.0.0-beta.9, Utlover65’s 4.2.3 add-on, and PnTMC’s 4.0.0 add-on and v4.0.3 helper) and read their code and settings without running them. This is what a player should know:

Project	Where your messages go	Things worth knowing
Verity JE 5.7.4	Groq or OpenRouter with your key, or a local Ollama/LiteLLM server	The 246 MB jar is mostly an offline voice (Piper) and an offline English speech-recognition model, which is why it is so large. Can Crash is on by default and lets Verity deliberately kick you from the world as part of the story; that is a game feature, not a malware symptom.
Verity JE 6.0.0-beta.9	Your choice of Groq, OpenAI, Gemini, Mistral, OpenRouter, or local Ollama	Saves a long-term memory file (verity_memory.json) so Verity remembers you across sessions. /recoververity clear_history clears the chat history.
Utlover65 4.2.3	Through the Hive Mind relay at traye.ddns.net, a third-party server, then the add-on’s Cloudflare Worker	Your player name and recent messages pass through both. In “own key” mode your API key passes through the relay too and is stored in the world. A file in the pack automatically kicks a short, hard-coded list of player names from any world using it. See how Utlover65 connects.
PnTMC 4.0.0	Through a helper on your own device to Groq and FishAudio, using your keys	Helper listens only on 127.0.0.1; no keys bundled. See what the helper sends.

In each project’s own code, the only outside addresses were the AI, voice, and relay services in the table, plus links to the authors’ pages. That is a statement about these exact files, not a security certificate or a full audit of every bundled library: a copy from a mirror can differ, so compare the file name and size with the project page.

One practical rule follows from the table: treat any API key you give a Verity project as exposed to that project’s route. Create a separate free key for Verity, set a spending limit if your provider has one, and revoke it when you stop playing.

Scan results need context

Security tools can produce false positives, especially for uncommon archives or software that makes network requests. They can also miss new threats. Do not rely on one badge, one commenter, or one scan result. Compare multiple signals: trusted source, expected file type, digital or platform metadata where available, current scan results, runtime network behavior, and community reports that include reproducible evidence.

If a scanner flags a package, do not disable protection just to make the warning disappear. Stop, confirm that the file came from the intended project, check whether the author addresses the exact detection, and submit it to your security vendor if appropriate. An author response is useful context but not a substitute for independent analysis.

If you already ran a suspicious file

Mistakes happen, especially when a fake page looks convincing. If you opened a file that did not match the project page, act in this order:

1. Stop the game and the file. Close Minecraft and any launcher or installer the file started. Do not open the world again to “see what happens.”
2. Disconnect if something is actively wrong. Unexpected windows, browser changes, or new startup programs justify going offline while you investigate.
3. Run a full scan with your current security software and follow its quarantine and removal guidance. Keep the detection name and file path.
4. Change important passwords from a different, clean device. Start with your email account and Microsoft account, then Discord and any accounts saved in your browser. Enable two-factor authentication where available.
5. Revoke API keys for Groq or any other provider that was configured on the affected computer, and create replacements only after the system is clean.
6. Check account activity such as recent sign-ins, new devices, and authorized apps, and remove anything you do not recognize.
7. Report the page to the host or platform where you found the link so others are less likely to follow it.

Deleting the file from the mods folder is not enough if it was an executable installer, because it may have copied components elsewhere. When in doubt, ask a trusted technician or your security vendor’s support for help instead of downloading a “cleaner” recommended in a comment section.

Protect your saves when checking compatibility

A separate launcher profile and a backed-up test world help limit mod conflicts and damage to saves. They are not a security sandbox. A malicious Java mod may still access files available to the game process. Closing unrelated applications does not prevent that access.

Only proceed with a file whose source you have verified and that you have no reason to suspect is malicious. Back up the world, use a dedicated profile, and start with only the required loader, Verity, and listed dependencies. Keep the first prompts free of personal information. This checks compatibility and configuration, not whether the code is harmless.

After a successful test, add other mods gradually. Save the working version combination so future troubleshooting does not depend on memory. When updating, repeat the clean test before opening an important world.

Advice for parents and younger players

Verity is popular with younger viewers because of horror videos, and fake download pages target that audience. A short household rule set prevents most problems:

• Download mods only from the project pages linked in a trusted guide, and agree that “a link from a video comment” is not enough.
• Never enter a Microsoft, email, or Discord password on a site that offers a mod.
• Ask before installing anything that ends in .exe, or anything that asks to turn off antivirus.
• Keep API keys under an adult’s account and out of screenshots and streams.
• Remember that Verity is horror content; check whether its tone suits the player before installing.

How to judge safety claims

Project pages support author details, versions, stated features, and setup notes. Official documentation explains how Groq, Ollama, and Minecraft behave. Creator channels provide context for the original work. Reddit, Discord, and comments can reveal common confusion or symptoms, but allegations remain community reports or unconfirmed until stronger evidence appears.

That distinction matters for safety. Overconfident reassurance can lead users into risky downloads; overconfident accusations can harm people and still fail to identify a dangerous file. Exact project details and honest uncertainty are more useful than either extreme.

Quick safety checklist

• The project title, author, and Project ID match the page you intended to use.
• The file type is .jar for Java or .mcaddon/.mcpack for Bedrock.
• The game version and loader match your profile.
• No step asked you to disable security tools, log in, or complete a survey.
• A current security scan finished without unexplained detections.
• Your world is backed up and the profile contains only required mods.
• Your API key is stored only in the local configuration and is absent from any shared export.