Modded Rust: Oxide, uMod, and the plugin ecosystem

Vanilla Rust is brutal, slow, and balanced exactly the way Facepunch wants it. The second you join a server with /kit working in chat, you have left vanilla behind and entered the world of Oxide / uMod, the modding framework that has powered the community server scene for over a decade.

1. What Oxide / uMod actually is

Oxide is an open-source modding framework that hooks into the Rust dedicated server, exposes game events to plugin authors as C# hooks, and ships with a built-in permission system. It started life around 2013 as a Lua-based mod by a developer named Thomas, was open-sourced and rewritten in C# as Oxide 2, expanded to support Hurtworld, 7 Days to Die, Reign of Kings and others, then rebranded to uMod to reflect its multi-game ambitions.

In practice, the community never fully adopted the new name. Most server admins, plugin authors, and hosting panels still call it "Oxide," the binaries are still Oxide.Rust.dll, and uMod.org itself acknowledges the dual naming. As of 2026, Oxide (uMod) is still the dominant Rust modding framework, though Carbon has emerged as a faster, Oxide-compatible alternative over the last two years.

A vanilla Facepunch server has none of this. No /kit, no /tpa, no admin permission groups beyond ownerid/moderatorid. If a server has chat commands with slashes, it is running Oxide or Carbon.

2. How to tell a server is modded

Before you join, look for these signals in the server browser:

• Browser tags like modded, 2x, 5x, pve, roleplay, softcore. Facepunch's tagging system lets owners flag wipe schedule and game mode.
• Server description mentioning gather rates, kits, shops, clans, or any custom command.
• Gather rates above x1 in the title (2x, 5x, 10x, Bloody).
• Group limits baked into the name (Solo/Duo/Trio Only).

Once in-game, dead giveaways include shop NPCs at outpost or bandit camp that aren't there in vanilla, Kit signs near spawn, /info or /help chat hints on join, and a colored chat tag in front of admin names (BetterChat).

3. Installing Oxide (server-admin POV)

The workflow is identical across every host:

1. Stop the server.
2. Download Oxide.Rust from umod.org (or use your host's mod-manager one-click install).
3. Extract into the server root so RustDedicated_Data/Managed/Oxide.Rust.dll lands beside the vanilla DLLs.
4. Start the server once. Oxide generates the oxide/ directory tree: oxide/plugins/, oxide/config/, oxide/data/, oxide/lang/, oxide/logs/.
5. Drop .cs plugin files into oxide/plugins/. Plugins hot-reload as soon as they hit the folder, no restart needed for most.
6. Dependencies (other plugins a plugin requires) auto-load if they're present; missing ones print a warning in console.

Critical gotcha: every forced Facepunch update overwrites the Oxide files. You must reinstall Oxide on top of the freshly patched server every first Thursday, or plugins silently fail to load.

4. The top community plugins

These are the workhorses you will see on roughly every modded server in 2026:

5. Permission groups

Oxide ships with two default groups: default (everyone) and admin (auto-applied to anyone in ownerid or moderatorid). You build the rest.

oxide.group add vip
oxide.group add vip "VIP" 1
oxide.grant group vip kits.use
oxide.grant group vip backpacks.use.medium
oxide.usergroup add 7656119xxxxxxxxxx vip

Common command shapes:

• oxide.group add create a group
• oxide.grant group give a permission to a group
• oxide.grant user give a permission to one player
• oxide.usergroup add put a player into a group
• oxide.revoke ... mirror of grant, removes
• oxide.show groups / oxide.show group vip inspect

Groups support parent-child inheritance, so vip can inherit default and vip+ can inherit vip. Most public servers run a tier ladder: default < vip < vip+ < mod < admin.

6. Common modded server types

7. Risks of running modded

• Broken plugins can wipe your server. A misbehaving storage or save plugin has corrupted save files in the past. Always back up server.sav before adding anything new.
• Patch day pain. Facepunch's first-Thursday force-wipe routinely breaks the Oxide harmony hooks. Popular plugins are usually patched within hours; niche plugins can take 24-72 hours.
• The Oxide reinstall trap. Every update wipes Oxide files. If you forget the reinstall step, your server boots into vanilla mode and players lose their kits/homes.
• Version mismatches. A plugin built for last month's API can crash this month's server. Watch the umod.org plugin page for the green "compatible" tag.
• Untrusted plugins. Only download from umod.org, Lone.Design, or Codefling. Random Discord uploads have shipped backdoors.

Best practice on patch day: wait one to two hours after the Facepunch push before updating Oxide, let plugin authors catch up, and disable anything that won't load rather than trying to patch it yourself.

8. What modded feels like to a player

The vibe shift is immediate:

• You spawn, type /kit starter, get a hatchet and bag.
• Wood comes in at 50-500 per swing instead of 25.
• Chat is colored and noisy with kill feeds and join messages.
• /tpa lets you teleport to a friend (with a cooldown and combat-block).
• /home base warps you back after a farm run.
• /trade opens a secure trade window so nobody runs off with your stuff.
• /shop opens a GUI to buy components, kits, or vehicles for in-game currency.
• Heli, cargo, and chinook events fire every 30-60 minutes instead of randomly.

Progression that takes a vanilla player a week takes a 5x player an evening.

9. Pro tips

• Vanilla Facepunch Official preserves the balance the developers designed. Everything else is a flavor.
• Modded is the gateway-friendly entry point. Faster gear, more forgiving, but it dilutes the survival edge that makes Rust Rust.
• Always read the rules. Modded servers vary wildly. Some allow team-up cross-clan, some ban it. Some allow base griefing, some don't. The rules are usually posted at /info.
• Check the wipe schedule before committing. A 5x server that wipes weekly is a very different time investment than a 2x biweekly.
• Solo on a Trio server is brutal. If you're solo, filter for solo or solo-duo explicitly.
• For admins: pick a small plugin stack and stick to it. Forty plugins is forty things that can break next Thursday.

10. Sources

• uMod official site and plugin index — https://umod.org/
• uMod history page — https://umod.org/history
• Corrosion Hour, uMod (Oxide) Permissions Guide — https://www.corrosionhour.com/umod-permissions-guide/
• Corrosion Hour, Install uMod (Oxide) plugins to a RUST server — https://www.corrosionhour.com/install-umod-plugins-rust-server/
• Corrosion Hour, RUST Server Browser Tags List — https://www.corrosionhour.com/rust-server-browser-tags-list/
• Corrosion Hour, RUST NTeleportation Plugin — https://www.corrosionhour.com/rust-nteleportation-plugin/
• Facepunch Wiki, Oxide — https://wiki.facepunch.com/rust/Oxide
• Facepunch Wiki, Server Browser Tags — https://wiki.facepunch.com/rust/server-browser-tags
• Nodecraft, Installing Plugins on a Rust uMod/Oxide Server — https://nodecraft.com/support/games/rust/installing-plugins-on-a-rust-umod-oxide-server
• Nodecraft, uMod/Oxide Permissions System — https://nodecraft.com/support/games/rust/umod-oxide-permissions-system
• LOW.MS, Top Rust Oxide Plugins for Your Server in 2026 — https://low.ms/blog/top-rust-oxide-plugins
• LOW.MS, Rust May 2026 Wipe Server Admin Guide — https://low.ms/blog/rust-may-2026-upgrade-hard-raid-harder-update
• GGServers, Rust Modding: Carbon vs. Oxide (uMod) — https://ggservers.com/knowledgebase/article/rust-modding-carbon-vs-oxide-umod/
• Vykix, Carbon vs. Oxide (uMod) 2026 Showdown — https://www.vykix.com/blog/carbon-vs-oxide-the-2026-showdown/
• RustPVE, Ultimate Rust PVE Plugin Guide 2026 — https://rustpve.com/blog/best-rust-pve-plugins

Want more? Admin Commands

11. Oxide vs. Carbon — the 2026 framework choice

For most of Rust's history, Oxide (rebranded uMod) was the only modding framework. Since 2023, Carbon has become a serious competitor, and by 2026 a server admin genuinely chooses between them. Understanding the difference matters because it affects which plugins load and how fast the server runs.

The practical verdict for 2026: Carbon's headline advantage is how quickly it becomes playable again after the first-Thursday force wipe — a server that wants to be live the moment Rust updates often runs Carbon. Oxide remains the safe default because it is the framework plugin authors test against. The two are mutually exclusive: you install one or the other, never both. Crucially, the plugins are largely the same files; the framework is just the engine that loads them. A player joining a modded server cannot usually tell which framework is running, and does not need to.

12. Managing plugins from the console

Whether you are on Oxide or Carbon, plugin management happens through a small set of console commands. These require admin/owner authorization.

The single most useful habit is the edit-then-reload loop: change a plugin's config JSON, run oxide.reload PluginName, and the new settings apply instantly with zero downtime. The whole server does not need to restart for a config tweak. Carbon mirrors all of these with the c. prefix (c.reload, c.plugins).

13. The essential plugin shortlist by server role

Hundreds of plugins exist, but a well-run server uses a tight, purposeful set. Bloat causes lag and update fragility. Here is the field-tested core for each common server type.

Vanilla+ (light touch, keeps Rust's feel)

• Vanish — admins toggle fully invisible. Mandatory on any moderated server for anti-cheat spectating.
• NoEscape — blocks teleport/recycle/respawn shenanigans while a player is in combat or raid-blocked.
• Kits — a small starter kit (tools, a little food) to soften the fresh-spawn grind without breaking balance.
• EntityCleanup — automatically removes leftover/abandoned entities to keep the map performant.
• ServerInfo — an in-game rules and info panel players open from chat.

PvE (no player damage, progression-focused)

• TruePVE — the foundation: disables player-vs-player damage while leaving NPCs and the environment lethal.
• ZoneManager — defines areas with custom rules (a PvP arena inside a PvE map, safe-trade zones).
• ServerRewards or Economics — an in-game currency so players have goals beyond raiding.
• Kits — heavier ranked kits as a progression reward.
• Vanish — still needed for admin oversight.

The pattern to notice: every healthy stack starts with Vanish for moderation, then adds exactly what the server concept requires and nothing else. A server advertising fifty plugins is usually a server that breaks every force wipe.

14. The permission system in depth

Oxide's permission system is what lets an admin delegate power safely. Two automatic groups exist: default (every connecting player) and admin (anyone the server recognizes as admin/owner). You create more groups for tiers like VIP, moderator, or builder.

Permission strings follow a plugin.permission pattern, for example kits.starter or vanish.allow. The disciplined approach: never grant permissions to individual players, grant them to groups, then move players between groups. This means a new moderator gets correct access by joining the moderator group in one command, and demotion is equally clean. Time-limited membership (30d, 7d) is how monetized servers run VIP without a billing integration.

15. Config files, data files and language files

Every plugin generates files the first time it loads, organized predictably inside the oxide folder:

• oxide/plugins/ — the .cs plugin source files themselves. Drop a plugin here and run oxide.load.
• oxide/config/ — one JSON file per plugin holding its settings. This is what you edit to tune a plugin, then reload.
• oxide/data/ — persistent data the plugin stores (player records, kit cooldowns, zone definitions). Do not hand-edit unless you know the schema.
• oxide/lang/ — translatable message strings, so chat output can be reworded or localized.
• oxide/logs/ — per-plugin logs, the first place to look when a plugin misbehaves.

The golden rule of config editing: JSON is unforgiving — a single missing comma or stray bracket stops the plugin loading. Always validate your JSON (any online JSON linter works) before reloading. If a plugin refuses to load after an edit, the error in oxide/logs/ almost always points to the exact line. When in doubt, delete the config file entirely; the plugin regenerates a fresh default copy on next load.

16. Surviving force-wipe day as a modded admin

The first Thursday of the month is the modded server's stress test. When Rust updates, the framework and many plugins break until they are recompiled against the new game build. A smooth wipe-day routine looks like this:

1. Do not auto-update blindly. Wait for the framework (Oxide or Carbon) to publish a build targeting the new Rust version. Carbon is usually first; Oxide can take a day.
2. Update the framework, then test-load. Run oxide.plugins (or c.plugins) and check which plugins failed to compile.
3. Update or temporarily unload broken plugins. A plugin that throws errors should be unloaded until its author ships a fix — a broken plugin can crash hooks for the whole server.
4. Back up the oxide folder before every wipe. Configs and permission data are not part of the world save; lose them and you rebuild your whole server setup by hand.
5. Re-confirm ownerid. A messy update can drop your admin authorization — verify it before opening to the public.

This is the central tax of running modded: every month you spend an hour patching. It is also why heavy plugin stacks are risky — every extra plugin is another thing that can be broken by the monthly update and another author you depend on to ship a timely fix.