gah i messed up, i meant how is it possible on a server without npc server?

The same way it's always been possible, he's just saying that it's not secure on a non NPC Server because it's clientside instead of serverside, and can be easily changed by hacking, or NPC weapons.

The variable for Magic Points is still playermp