SCP: Secret Laboratory server guide: config and plugins

The SCP: Secret Laboratory dedicated server is a free SteamCMD download (app id 996560), it has a native Linux build, it listens on one UDP port, and it runs perfectly well in 4 GB of memory for a twenty-slot server. It is also the most opinionated server in this category: you do not launch the game binary directly, you launch a wrapper called LocalAdmin; the configuration is not in the install folder but in your user profile, split into a folder per port; and the official plugin framework now ships inside the server build, which has quietly changed how every mod guide older than a year works. This covers the whole of it, in the order you will need it.

What the dedicated server is and what it can do#

The server is a headless Unity build. It runs one facility, one round at a time, restarts the round when it ends, and holds max_players people, which is 20 by default. Sixty is the practical ceiling and the documented maximum for a verified server. The game is balanced around roughly twenty to thirty-five players, and a sixty-slot server plays like a different game rather than a bigger one.

What you get out of the box, with no plugins at all:

• Remote Admin, a real permission system with named roles, badges, kick power and twenty-nine individual permission nodes.
• Bans and whitelists as plain text files, by user ID and by IP.
• A large gameplay config covering respawn waves, the warhead, decontamination, friendly fire, stamina, AFK kicking and spawn protection.
• A friendly-fire detector that will ban team-killers on its own, with four independent detectors and configurable thresholds.
• Geoblocking, rate limits, pre-authentication challenges and a report webhook for Discord.
• An idle mode that drops the tick rate to 1 when nobody is connected.

What it does not have is a Source-style RCON. Administration happens through the in-game Remote Admin panel, the LocalAdmin console on the machine, and an optional query port that is off by default. Plugins add the rest.

Requirements and resource usage#

Northwood publishes one hard number: a verified server needs at least 2 physical cores, 4 GB of memory and 20 GB of storage. That is a floor, not a recommendation, and it lines up with what a plain twenty-slot server actually uses.

• CPU: the round simulation runs on one thread, so single-core clock speed sets your tick rate and core count does not. server_tickrate defaults to 60; if the machine cannot sustain it, the server does not warn you, it just runs behind.
• Disk: the install is modest and round logs are the thing that grows. LocalAdmin will prune them for you - delete_old_round_logs and round_logs_expiration_days exist for exactly this.
• Network: light per player, and the transport is LiteNetLib over UDP. Nothing here needs a fat pipe.

The honest sizing answer: if a plugin-heavy server is slow, the plugins are almost always the reason, not the player count. What tick rate actually means explains why the number matters and what a player feels when it drops.

Installing and starting through LocalAdmin#

Anonymous SteamCMD, no account, no token:

$ steamcmd +force_install_dir /home/scpsl/server +login anonymous \    +app_update 996560 validate +quit

SteamCMD explained covers the general form. Inside the install you get the game binary - SCPSL.x86_64 on Linux, SCPSL.exe on Windows - and a wrapper, LocalAdmin or LocalAdmin.exe. You start the wrapper, not the game. LocalAdmin takes the port as its first positional argument, restarts the server when it crashes, keeps the logs, and gives you a console:

$ cd /home/scpsl/server$ ./LocalAdmin 7777

Leave the port off and it asks for one interactively, defaulting to 7777. On a first run it walks you through a configuration wizard and writes the files described below. You will also want --acceptEULA (or the environment variable ACCEPT_SCPSL_EULA=TRUE) in anything unattended, and --config <path> if you keep configuration somewhere of your own choosing.

LocalAdmin has its own commands, separate from the game's: exit, restart, forcerestart, resave, help, and p for the built-in plugin manager. It also reads config/laargs.txt for extra startup arguments, which is a tidier place for them than a start script.

Where the config files actually live#

Not in the install folder. The root is your user profile:

Under that root, config/ holds a folder per port, so one install can run several servers with completely separate settings:

config/  config_localadmin_global.txt  laargs.txt  7777/    config_gameplay.txt    config_remoteadmin.txt    config_localadmin.txt    config_sharing.txt    UserIDBans.txt    IPBans.txt    UserIDWhitelist.txt    UserIDReservedSlots.txt

There is one override worth knowing, because nearly every game panel uses it. If a file called hoster_policy.txt in the server's working directory contains the line gamedir_for_configs: true, the whole root moves to AppData/ inside the server directory instead of the user profile. That is why a guide's paths may not match what you see in a file manager, and why the answer to "where is my config" on a hosted server is usually "look for an AppData folder next to the binary". On RE:NODE you find it in the in-browser file manager or over SFTP, and the in-browser editor will syntax-highlight it.

config_sharing.txt is the other thing to know about: it decides which folder the ban, mute, whitelist and reserved-slot files are read from, so several ports can share one ban list. Per-port is only the default.

There is no `motd.txt`. The description players see in the browser comes from serverinfo_pastebin_id, which is the ID of a Pastebin paste the server fetches. That catches everybody once.

config_gameplay.txt, the settings that matter#

The syntax is key: value, one per line, and the space after the colon is required - the parser splits on a colon followed by a space, so key:value is silently ignored. That single detail causes more "my setting does nothing" reports than anything else in the file.

The file is long. These are the ones that decide what your server is:

server_name: Facility 07max_players: 20server_tickrate: 60serverinfo_pastebin_id: 7wV681fTcontact_email: admin@example.comfriendly_fire: falsefriendly_fire_multiplier: 0.4auto_round_restart_time: 10end_round_on_one_player: falserestart_after_rounds: 0online_mode: trueenable_whitelist: falseip_banning: trueafk_time: 90spawn_protect_enabled: falsespawn_protect_time: 8idle_mode_enabled: trueidle_mode_time: 5000idle_mode_tickrate: 1enable_query: false

Grouped by what they do:

A few notes that save an evening each. idle_mode_enabled: true is the setting that makes an empty server cost nothing, dropping it to one tick per second after five seconds with nobody on. The friendly-fire detector is genuinely good and genuinely aggressive - ff_detector_spawn_enabled is on by default and will ban somebody for a spawn-room accident, so read the _kills, _damage and _ban_time values before you open the doors. enable_whitelist: true plus UserIDWhitelist.txt, with one entry per line in the form 76561198071934271@steam or 274613382353518592@discord, is the simplest way to run a private server.

One correction to a lot of older guides: smart_class_picker, human_class_ratio and scp_ratio are not part of the current configuration. Class distribution is driven by team_respawn_queue, a digit string where each digit is a class slot, plus server_forced_class. If you find a config template containing the old keys, it was written for a build several major versions ago and the rest of it is probably stale too.

Remote Admin: roles, members and permissions#

config_remoteadmin.txt is where you make yourself an admin, and its format is unusual enough to be worth getting exactly right. Three parts: who is in which role, what each role looks like, and which roles hold which permission.

Members: - 76561198801452050@steam: owner - 2141379914474455080@discord: moderatorowner_badge: SERVER OWNERowner_color: redowner_cover: trueowner_hidden: falseowner_kick_power: 255owner_required_kick_power: 255Permissions: - AdminChat: [owner, moderator] - KickingAndShortTermBanning: [owner, moderator] - PlayersManagement: [owner] - ServerConsoleCommands: [owner]

The member ID takes a suffix that says which identity provider it is: @steam for a 17-digit SteamID64, @discord for a Discord snowflake, @northwood for a Northwood account. Role options are prefixed with the role name and an underscore - there is no $ syntax here, whatever an older guide says. Permissions are listed the other way round from how people expect: one line per permission node, naming every role that holds it, with a comma and a space between the role names.

kick_power and required_kick_power are the part worth thinking about. A role can only kick or ban somebody whose required_kick_power is at or below its own kick_power, which is how you stop a junior moderator banning the owner. That is the same least-privilege thinking as subusers and least privilege on the panel side, and it deserves as much care.

There are twenty-nine permission nodes. The ones you will hand out most: AdminChat, KickingAndShortTermBanning, BanningUpToDay, LongTermBanning, PlayersManagement, GameplayData, Overwatch, Noclip, ForceclassSelf, GivingItems, RoundEvents, WarheadEvents, Broadcasting. Three deserve care because they are effectively root: PermissionsManagement lets somebody rewrite this file's effect, ServerConfigs lets them change the gameplay config, and ServerConsoleCommands gives them the server console.

After editing, run reload rolesconfig rather than restarting, and check the result in game with the perm command.

The commands you will actually use#

Open Remote Admin in game with M by default. The panel is mostly buttons, with a text console at the bottom. The commands worth memorising:

oban is the one people look for and cannot find: banning somebody who has already disconnected needs the offline ban command and their ID, not the player list. cassie is the announcement system and is more fun than it is useful, though cassie plus a countdown is a civilised way to warn people before a restart.

The remaining commands and their exact arguments change between builds more than you would like. help on your own server is authoritative; a command list from a blog is not. That includes this one.

The server list, verification and your IP address#

online_mode: true connects the server to Northwood's central servers, which is what puts it in the browser. There is no API key and no game server token. What there is instead is verification, and it works differently from every other game here: verification is granted to an IPv4 address, not to an account and not to a domain name.

To apply, run !verify static or !verify dynamic in the LocalAdmin console, or email the address Northwood publishes, and expect several business days. The requirements are public and specific: near-continuous uptime, at least two physical cores and 4 GB of memory, no more than sixty slots, a properly set server_name, serverinfo_pastebin_id, contact_email and max_players, reachability from outside your own network, and staff contact details inside the pastebin info.

The consequence nobody mentions until it bites: if your server shares a public IPv4 with other servers, the address may already be verified to somebody else, and the error you get back is "Port Not Registered" with no explanation. Ask your host what address your server has and whether it is shared before you apply, not after. Domains are not accepted for verification either, so an A record is a convenience for players and nothing more.

That really is the whole port list, and it is worth saying plainly because people go hunting for a second one. The TCP port LocalAdmin uses to talk to the game process is bound to loopback on an ephemeral number and is not something you forward or configure. Game server ports explained covers why most games have more ports than this and why this one does not.

Plugins: LabAPI and EXILED#

This is the part where every guide older than about a year is wrong, so it is worth being precise.

LabAPI is Northwood's official framework and it is already installed. LabAPI.dll ships inside every dedicated server build. There is nothing to download. Plugins are DLLs dropped into folders under the same profile root as your configs:

LabAPI/plugins/global/          loaded on every portLabAPI/plugins/<port>/          loaded on that port onlyLabAPI/dependencies/global/     shared librariesLabAPI/configs/<port>/<PluginName>/*.ymlLabAPI/LabApi-<port>.yml        the loader's own config

LocalAdmin's plugin manager (p install, p list, p update) will fetch and place plugins from the official directory for you, writing into the per-port folders. The loader's own config controls which folders are searched and, importantly, LoadUnsupportedPlugins, which defaults to false and makes the loader refuse a plugin built against a different major LabAPI version. That refusal is a feature - it is the difference between a plugin not loading and a plugin loading and corrupting a round.

EXILED is the community framework, and as of version 9 it is a LabAPI plugin rather than a rival to it. Its loader DLL sits in LabAPI/plugins/global/, and it brings its own tree:

It installs with Exiled.Installer-Linux or Exiled.Installer-Win.exe, pointed at the server folder with --path, and --target-port will place it for a specific port rather than globally. Two things that older guides get wrong: EXILED 9 does not patch Assembly-CSharp.dll any more, and plugins do not go in a Plugins folder next to the configs. If a guide tells you to do either, it is describing EXILED 8 or earlier.

Because EXILED is a LabAPI plugin, the two coexist by construction - a server can load native LabAPI plugins and EXILED plugins at the same time. The trade is that a LabAPI major version bump breaks the whole EXILED stack at once rather than one plugin at a time.

Worth knowing about, all listed in the official plugin directory: CedMod for web-based moderation, bans and permissions; AdminTools for extra admin commands and logging; UncomplicatedCustomRoles for custom roles defined in YAML; SCPStats for cross-server statistics and Discord role syncing. Anything you install runs with the server's full trust, so the hygiene in keeping a modded server clean applies here more than in most games.

Updates, troubleshooting and the errors people hit#

SCP: Secret Laboratory ships a point release every month or two, SteamCMD pulls it the moment it lands, and plugins compiled against the old build stop working. If your server auto-updates, it can break in the middle of a Tuesday afternoon. The recovery order is in what to do when a mod update breaks; the short version is to keep a copy of the working plugin folder and to update plugins before, not after, you let the server restart.

A setting in `config_gameplay.txt` does nothing. You wrote key:value. It needs key: value with the space.

The server is not in the browser at all. online_mode is false, or UDP 7777 is not reachable.

The server is in the browser but nobody can find it by searching. The name. Percentage-based size tags such as <size=20%> and unusual characters stop the search matching. Retype server_name in plain text.

"Port Not Registered" during verification. The IPv4 address is already verified, usually to another server sharing it. This is a host question, not a config question.

`Method not found` or `MissingMethodException` in the log after an update. A plugin assembly built against the previous build. Update or remove it.

`DllNotFoundException` at startup. A missing system library on a minimal Linux image. Install the dependencies the server expects rather than working around it.

LocalAdmin sits at 100% CPU with nobody online. No terminal on standard input. Run it under screen or tmux.

Config files keep resetting. Two servers sharing one port folder, or the server being killed rather than stopped cleanly while it was writing.

On RE:NODE the console is the LocalAdmin console with history and tab completion, the plans include backup slots for the config and plugin folders, and the Schedules tab can run a daily restart on a cron expression - which for this game is worth having, both for memory and for picking a moment to take updates. A crash loop is noticed automatically: three restarts in an hour raises a warning and opens a ticket rather than leaving you to find out from Discord. Restart hygiene generally is in restart schedules that help.

FAQ#

How much RAM does an SCP: Secret Laboratory server need?

Four GB and two physical cores is the documented minimum for a verified server, and it is genuinely enough for a vanilla twenty-slot round. Plugins are what push it up: a heavily modded server on the same player count can want six to eight.

Does SCP: Secret Laboratory have RCON?

No. There is an optional query port, off by default, and the in-game Remote Admin panel, and the LocalAdmin console on the machine itself. Remote administration in practice means Remote Admin with a properly configured role, or a plugin such as CedMod that adds a web panel.

How do I make myself an admin?

Add your SteamID64 to the Members list in config_remoteadmin.txt as - <id>@steam: owner, define the owner_* role options, list owner in each permission node you want, then run reload rolesconfig. Check it worked with the perm command in game.

Why is my server not verified, and does it matter?

Verification is granted to an IPv4 address after a manual review, and it takes days. An unverified server still runs and still appears, but it does not get the verified marker or the trust that comes with it. The most common blocker is that the address is already verified to somebody else.

Should I use LabAPI or EXILED?

Both, in effect. LabAPI is official and already installed, so a plugin written for it is the lowest-maintenance option. EXILED has the larger back catalogue of plugins and now runs as a LabAPI plugin itself, so adding it costs you one more layer that can break on a major update.

What is the maximum player count?

Sixty for a verified server, and that is the practical ceiling generally. The default is twenty, and twenty to thirty-five is where the game is actually balanced. Raising the number does not make the facility bigger.