PHP Source Query: reading game server state over UDP from PHP

What the class does and which protocol it speaks

PHP Source Query is a PHP class built to query game servers that use the Source query protocol, which the project description also calls the Steam query protocol. That single protocol covers every Source game and every game that implements Steamworks, which is the practical reason the class exists: one implementation, dozens of titles.@@P@@The class also speaks Source RCON, the remote console protocol, which is how you run administrative commands on a server. The README is precise about the scope there: RCON works for Half-Life 1 and Source engine games, and it does not work for everything else. The interesting edge case it calls out is Minecraft, which uses the Source RCON protocol, so you can send commands to a Minecraft server through this class while the engine is set to Source.@@P@@The protocol details are not reverse engineered by this project. The README links the official Valve developer wiki pages for server queries and for the Source RCON protocol, so the class implements a documented protocol rather than a guessed one. That matters for maintenance, because when Valve changes something, there is a specification to read.@@P@@The package is published on Packagist as xpaw/php-source-query-class, and the repository holds the library in a SourceQuery directory, a Tests directory, an Examples directory and a composer.json with a lock file. Static analysis is configured for the project, with a phpstan.neon and a psalm.xml in the root, and CONTRIBUTING.md documents how to propose changes. The code is licensed under the GNU Lesser General Public License, version 2.1 or later, with the copyright held by Pavel Djundik from 2012 to 2025.

The requirements that decide whether it runs at all

Three requirements are listed, and each one has bitten somebody.@@P@@The first is a modern PHP version, which in practice means a PHP release that is still supported. The second is the one that surprises people: 64-bit PHP, or the gmp module if the build is not 64-bit. The underlying reason is in the protocol, since the Source query response carries packed integers and bit flags whose values do not fit in a 32-bit integer, so a 32-bit build without gmp cannot decode the reply correctly. The third requirement is on the server side rather than yours: your server must allow UDP connections, because the query protocol is a single UDP request and response rather than a TCP conversation.@@P@@That last point has a security dimension. A server that is firewalled against UDP will simply not answer, and the failure looks like a timeout rather than a configuration error. It is also the reason many hosting providers expose the query port separately from the game port, and why some games need the port adjusted, as the support table shows for several titles that need one added to the server port.

The API: connect, read state, disconnect

The class exposes a small set of methods, and the README lists each one with a one line description.@@P@@Connect takes the IP address, the port, a timeout and the engine, and it opens the connection to the server. The engine parameter selects the protocol variant, which is what lets the same code speak to Half-Life 1 style servers and Source engine servers, and what lets the Minecraft case work with the Source engine setting. Disconnect closes all open connections and should be called when you are done with a server, since the class holds the socket.@@P@@The three read methods are the reason most people use the class. GetInfo returns the server information as an array, which is where the map name, the player counts and the server name come from. GetPlayers returns the players on the server as an array. GetRules returns the public rules, the cvars, as an array, which is where settings like friendly fire or the number of slots appear.@@P@@There is also a Ping method, and the README attaches a warning to it: the Source engine may not answer to it. That is the kind of note that only appears in a library that has been used against many servers, and it tells you to treat a failed ping as inconclusive rather than as proof that a server is down.@@P@@The Examples directory in the repository holds three files, an Example.php for querying, an RconExample.php for the remote console path and a View.php for rendering the result, and the README points people there to work things out rather than trying to document every usage.

RCON: set a password, run a command

Remote console access is a separate pair of methods. SetRconPassword takes the password and stores it for later use with Rcon, and Rcon takes a command string and executes it on the server.@@P@@The security posture here deserves a clear statement. An RCON password is the administrative key to a game server, and the README's own note about it is minimal, so the responsibility sits with the application. Two practical points follow from the protocol itself. First, RCON is a separate connection with its own authentication step, so the password is sent to the server in the clear over the network unless the server is behind a tunnel or a VPN, and the class has no transport encryption of its own. Second, the engine parameter still matters, because a server that is not a Source engine or Half-Life 1 server will not speak this protocol at all.@@P@@The support table also records games where RCON needs a workaround. Starbound requires a call to the SetUseOldGetChallengeMethod method after connecting, which is the kind of detail that is specific to one game and would be impossible to guess. Quake Live is listed with a note that it uses the ZMQ messaging queue protocol for rcon control, which describes a different transport underneath the same idea.

The supported games table and its per-game caveats

The README publishes a table of supported games keyed by Steam AppID, with a column for query support, a column for RCON support and a notes column. The list is long and covers the games people actually run: Counter-Strike 1.6, Team Fortress 2, Left 4 Dead 2, Counter-Strike 2, Garry's Mod, Nuclear Dawn, Dino D-Day, Arma 3, Call of Duty Modern Warfare 3, DeadPoly, Starbound, Space Engineers, Unturned, 7 Days to Die, Rust, Quake Live, ARK Survival Evolved, Minecraft, Project Zomboid and Arma Reforger, plus a catch-all row for all Half-Life 1 and Half-Life 2 games and mods.@@P@@The notes column is where the real content is, because it records the exceptions. Several titles need one added to the server port to answer on the query port, which applies to Arma 3, Space Engineers and Unturned. Counter-Strike 2 needs three server settings adjusted, host_name_store 1, host_info_show 2 and host_players_show 2, without which the query returns nothing useful. Starbound needs the extra method call after connecting. Minecraft has no query support at all, only RCON. Quake Live is noted as using a different messaging protocol for its console.@@P@@The table also has a column with a question mark rather than a tick for the RCON entry on some titles, meaning the combination is not applicable or not verified, and the maintainer invites pull requests for games that support the protocols and are not yet listed. That invitation, together with the explicit warning against emailing when something does not work, sets the tone of the project: it is a reference implementation maintained in the open, with the support matrix treated as community-maintained knowledge.

How to check a server, and where this class stops

The README gives a practical test for whether a game supports the Source query protocol at all: add the server to your favourites in the Steam server browser, and if Steam can display information about the server, then the protocol is supported. That is a good sanity check before writing code, because it uses the same protocol through a client you already have.@@P@@The limits of the class are the limits of the protocol. It speaks Source query and Source RCON, so a game that exposes only a modern web API, such as a matchmaking or stats service, is out of reach, and a game with its own administrative protocol is out of reach for the console side. Because the query protocol is UDP, a server behind a firewall or a hosting provider that filters UDP will simply never answer, and the class cannot distinguish that from an offline server.@@P@@The alternative to weigh is a game-specific API client, or the Steam Web API for titles that publish their state through it. The difference in approach is direct: the Source query protocol is a UDP packet exchange with the game server itself, so it gives live state for any server you can reach on its query port, including private ones that never appear in a browser, and it needs no API key. A web API gives structured, documented data for public servers, with authentication and rate limits in exchange. For a community server list, the Source query approach is the one that covers the servers people actually want to list. The licence is the last consideration: LGPL 2.1 or later means you can use the class in a closed-source application as long as you do not modify the library itself, which is a much lighter obligation than GPL.

Editorial conclusion

PHP Source Query is worth adopting for server browsers, community lists and monitoring tools that need to talk to Source engine and Steamworks servers from PHP, and it is a good reference for the protocol. It is the wrong tool for a game without Source query support, for titles with a modern API like Steam Web API, or for administrative control where a game-specific admin protocol exists. Verify first that your server allows UDP connections, that your PHP build is 64-bit or has gmp available, and that the specific game you target behaves as the support table describes.

Frequently asked questions

Official sources

1. License: LGPL-2.1
2. Project website
3. README
4. Releases
5. xPaw/PHP-Source-Query on GitHub