Correct, client_only doesn’t work in a very useful or expected way. Every mod the server has running, including client_only mods, is forced to be enabled on clients joining. This includes the debug_tools mod. If you have these mods, the server will force-enable them if you had them disabled. The only thing client_only works for is the client having extra mods that the server doesn’t have.