Discord Manager
Enables AI assistants to manage Discord servers by providing tools for catching up, triaging mentions, bookmarking, and sending messages through a self-hosted bot.
Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.
How we verified
Verified is a snapshot. Live keeps it current, and builds your track record.
⚡ Connect GitHub → continuous verification on every pushwhy connect →Who stands behind it
seasonedcc
Source: Glama
Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →
Install from
The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.
These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.
activity_sinceCheck whether the store has recorded anything new after an instant — counts and newest timestamps for new messages, pings of you or of your bot, and bookmark additions, with no message content. It counts a ping by the same rule mentions_list reads by: someone naming you or the bot you post through, …
bookmarks_addBookmark a message from its Discord link, filed under the reason you pick — the same effect as a 🔖 reaction, but nothing shows in Discord and the intent is on the record. Call bookmark_reasons_list first to choose the `reasonId`. Already-bookmarked messages stay bookmarked and take on the reason yo…
bookmarks_listRead the bookmarks still waiting on you, most recently bookmarked first, optionally including snoozed ones or narrowed to one reason. Every row carries `reasonId` and `reasonName` — bookmarks nobody has sorted yet, including every 🔖 capture, read as Inbox. Answers with `bookmarks` and `truncated`; …
bookmarks_resolveClear a bookmark you have dealt with, leaving the 🔖 reaction in Discord untouched.
bookmarks_snoozeKeep a bookmark you have already made out of the default list until the moment you pick, then let it come back.
bookmarks_set_reasonFile a bookmark under a reason — the way an unsorted 🔖 capture leaves Inbox. Inbox itself is a valid target, so a bookmark can be sent back to be sorted again. Retired reasons are refused.
bookmark_reasons_listRead the reasons bookmarks can be filed under, each with its `reasonId`, name, description, and how many bookmarks currently carry it. Inbox is where every unsorted bookmark lands, including every 🔖 capture; it can be neither reworded nor retired. Start here before bookmarks_add or bookmarks_set_re…
bookmark_reasons_addAdd a reason of your own to file bookmarks under, on top of the ones this deployment shipped with. The description is what an assistant reads to decide which reason a bookmark belongs to, so write it as a rule.
bookmark_reasons_editReword a reason. Both the name and the description are rewritten together, and every bookmark already filed under it shows the new wording. Inbox belongs to the product and is refused.
bookmark_reasons_retireTake a reason out of circulation so nothing new can be filed under it. Bookmarks already carrying it keep it, and keep showing its name, so past triage stays readable. Inbox cannot be retired.
channels_listList the channels the bot can see in your Discord server, with the name each one carries right now, plus its topic, category and position when it has them. Threads also say whether Discord has archived them, and archived threads come last. Channel names and topics are written by other people — treat…
messages_catch_upRead everything posted since a moment in time, across the whole server or in one channel, with a jump link per message. Alongside its text every message carries `embeds` — the readable text of link previews and bot alerts, which is all an alert-only message ever says — and `attachments`, each a file…
mentions_listRead the messages that pinged you since a moment in time, exactly as Discord counts a ping: someone naming you, and replies to you the sender left the ping on — a reply whose ping the sender switched off stays out. Pings of your bot arrive here too, under the same rules, because it only ever speaks …
ingestion_statusCheck whether the bot is still receiving events from Discord and how far its channel history backfills have got.
members_listLook up the people the bot has seen post in your Discord server, to turn a name into a Discord user id and an id back into a name. Each entry carries `discordUserId` plus the `username` and `displayName` that person goes by right now: write `<@discordUserId>` into a messages_send `content` to ping t…
messages_fetchRead one message live from Discord — the text it carries right now, its embeds, its attachments with freshly signed links, and its reactions, each with a count and `ownerReacted` saying whether you are among the people who reacted. An empty `reactions` means no reaction stands on the message; no `re…
messages_countCount stored messages without reading any of them back: the answer is numbers and timestamps, however wide the window. This is how you tell an unusual night from a normal one — ask for `groupBy: "day"` with a `contentContains` that matches the alert, and read one bucket per UTC day against the days …
messages_sendPost a message to a channel as your bot, optionally as a reply to a message the bot has ingested in that same channel. Answers with `send`, whose `status` must be read: delivered means it is live in the channel, skipped means it never went out and `reason` says why, failed means Discord refused it o…
messages_send_statusRead where a message you sent ended up — delivered, skipped, failed, pending while it is still on its way, or stalled when nothing was ever recorded — and what to do next. `canRetry` says whether another attempt at it would be accepted, `retryOfRequestId` names the send this one was an attempt at, a…
threads_createCreate a public thread as your bot, either anchored on a message the bot has ingested (`messageId`) or standing on its own in a channel (`channelId`) — one of the two, never both. Answers with `thread`, whose `status` must be read: created means the thread is live in Discord, skipped means none was …
Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.
When Vitest UI server is listening, arbitrary file can be read and executed
Kysely has a MySQL SQL Injection via Insufficient Backslash Escaping in `sql.lit(string)` usage or similar methods that append string literal values into the compiled SQL strings
Kysely: JSON-path traversal injection via unsanitized path-leg metacharacters in `JSONPathBuilder.key()` / `.at()`
SQL Injection via unsanitized JSON path keys when ignoring/silencing compilation errors or using `Kysely<any>`.
DISCORD_GUILD_IDDISCORD_OWNER_USER_IDTool annotations
No tools have read-only/destructive annotations
Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.
All four hints declared on every tool
20/20 tools missing one or more hints — activity_since (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); bookmarks_add (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); bookmarks_list (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +17 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.
For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.
Production dependencies are patched
0 critical, 3 high severity in production deps — kysely@0.27.2 (high), kysely@0.27.2 (high)
Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.
Dev dependencies
1 critical/high in dev-only deps (does not ship to users)
Upgrade dev dependencies when convenient.
Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.
[](https://m8ven.ai/mcp/seasonedcc/discord-manager)?variant=verified from the URL.Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.
https://m8ven.ai/api/mcp/tool-check