Introducing TCG Online: One Plugin, One Ruleset, Cards You Earn

TCG Online is our own card game for Old School RuneScape, played through RuneLite. Play the game you already play — levels, quests, diaries, bosses — and the credits pile up on their own. Spend them on packs, build a collection of close to 7,000 cards drawn from Old School's items and NPCs, and trade your duplicates with other players in game. If you want the game to bite back, CardMan mode locks every item until you have pulled its card.

cards to collect

~7,000

credits a pack

1,000

cards a pack

5

It is one plugin, not a bundle

The collection, pack opening, the item lock and trading all live in one plugin. That is not tidiness for its own sake — they are one ruleset. Two plugins sharing an item lock is two plugins disagreeing about what you have unlocked, and the loser of that argument is always the player staring at a greyed-out sword they definitely own the card for. Nothing else needs installing, nothing else is read, and if you uninstall every other plugin on your client TCG Online behaves identically.

It does check, once on login, whether something else you have enabled covers the same ground — two item locks fighting over the same right-click menu reads as this plugin being broken. It only warns. Nothing is disabled and nothing is changed: which plugins you run is your call.

Credits are earned by playing

There is nothing to grind for the card game, and nothing to buy. Credits are the only currency, packs are the only thing they buy, and every one of them comes out of the account you were already training. Here is the whole list:

So your balance moves while you are doing something else entirely — which is why the credit counter sits at the top of the screen and the pack orb lights up green the moment you can afford to open one. A reward nobody notices is not a reward, so a level, a quest or a diary tier pulls the plugin's next report forward within seconds rather than waiting for its scheduled beat.

The bit that surprises people

Levels you already had do not pay. Your first report tells the server where your skills are and pays nothing for them — you earn from that point on. A maxed account that links gets the 3,000 welcome grant and then very little from levelling, while a fresh account earns 550 a level all the way up.

That is exactly why the other sources exist. A finished account still has a quest log, a diary tab and a boss log: quests and diaries are backpaid in full on that first report, once each, so a completionist banks a great deal the moment they link. Boss kills sit in between — your count when the server first sees it is the starting line, and you are paid for kills from there, in whole blocks of ten, read from Jagex's own hiscores rather than from your client.

Packs and gem tiers

A pack is 1,000 credits and holds five cards. Opening one is its own little ceremony — the pack fills the screen, the pulls land face down, and you turn each one over yourself. Every card sits on one of seven gem tiers, and the tier is a hand-made judgement rather than a formula over prices and stat totals. It has to be: an earlier version computed it, and cheerfully put the Infernal cape below the Abyssal whip.

The tier roll, the card pick, the price and the payouts are all decided by the server. The plugin asks and draws; it never decides what you got. That is what makes a Zenyte pull mean the same thing on every account.

Trading, in game, with actual rules

Right-click another player → Trade Cards. A trade window opens on the game canvas for both of you, and the rules are deliberately narrow:

• Duplicates only. You can only put up a card you hold two or more of, so no trade can ever cost you an unlock.
• Both sides accept, then it settles. One copy of every offered card moves between the two collections in a single transaction, re-validated as it goes.
• Any change resets both accepts. The classic swap-it-at-the-last-second trick has nothing to work with.
• Modes only trade with their own. CardMan trades with CardMan, Normal with Normal — two economies with different rules cannot quietly feed each other.
• You can see who is playing. A badge marks other TCG Online players near you, so you know who you can trade with. Turn Show me as online off and you disappear from it — which also stops anyone right-clicking you into a trade.

Two modes, chosen once

Each character picks a mode, and it cannot be changed afterwards. That is the point — a run means something because it could not be undone halfway.

• Normal. Unrestricted play. Collect, open, trade, and Old School behaves exactly as it always did.
• CardMan. The community Cardcore challenge, built in: an item is only yours to use once you have pulled its card. Items you have no card for are greyed out with a padlock and cannot be worn, eaten or used, and an NPC you have no card for cannot be talked to — no quest start, no shop, no slayer task.

CardMan never touches skilling. Picking things up, banking, dropping and every skill are always allowed, so you can play normally and earn your way into your own gear. It requires an ironman account — any of the six types — and a completely fresh one: every skill at 1, Hitpoints at 10. Train anything at all and CardMan is no longer available on that character. Both are checked by the server, not by the plugin, so there is nothing to talk your client into.

The rules are kept by the server

Every rule worth breaking is enforced where you cannot reach it. The economy is server-side: price, tier roll, card pick and every credit grant. The unlocked item set is computed server-side and sent to the plugin, so the lock is not something a client decides for itself. Trades settle in one server-side transaction that re-checks the duplicates rule as it commits. Every request that touches a collection names its character and the server resolves the binding it holds — which is what stops an alt being handed your main's collection, whatever a modified client claims.

The same logic runs on levels: credits are paid against what the server has already banked for that character, and gains that arrive faster than a person can plausibly play are held for a human to look at rather than paid out. A moderated system with a person in the loop is not a cryptographic guarantee, and we would rather say so than pretend otherwise.

Linking never sees your password

The plugin pairs with your account through a device handshake — the same shape as the OAuth 2.0 Device Authorization Grant that TVs and consoles use:

1. 1Click Link account in the plugin's side panel.
2. 2The plugin gets a short code plus a private device secret it keeps to itself.
3. 3The panel shows the code and opens this site, where you sign in and confirm it.
4. 4Confirming is what authorises the link — someone who glimpsed the code would also have to be signed in as you.
5. 5The plugin is handed a token and stores it. You can revoke it per device from the panel or your profile at any time.

You never type a RuneScape name anywhere. The plugin reports the character you actually logged in as, which is also why an in-game rename is picked up by itself. Before you link an account, nothing at all leaves your client; after it, what leaves is the character you are on, its levels and XP, finished quests and diary tiers — the basis for your credits — plus the cards you own and the trades you make. Nothing is sent from seasonal, beta or tournament worlds.

The website is the other half

The plugin and this site are the same project, so everything you do in game has somewhere to live:

• The card catalogue — every card, by gem tier, with what it unlocks.
• Quests and minigames — which cards each one actually needs, which is the difference between a CardMan plan and a wasted evening.
• Highscores — collection and level boards, filling as players arrive.
• Forums — including a place for CardMan runs.
• The marketplace — for lining up a trade before you stand next to each other.

TCG Online is BSD 2-Clause licensed and open to read, top to bottom. If something is unclear, unfair or simply broken, tell us in the forums — the rules above are the ones we think are right today, and several of them exist because someone said so.