How does the blacklist.json work? Do I add players or morphs? Ideally I'd like to disable some morphs that are too strong for our server like bats, ghasts, and blazes.

I described how to blacklist morphs in the Wiki. I hope this is documented enough 😃

If you have any questions, let me know. I'll also going to add a page about how to configure morphs using morphs.json.