Arachne Discord MCP (SolanceLab/arachne-discord-mcp) is an MCP server listed on the M8ven Trust Index. It scores 54 out of 100, grade D. It declares 34 tools. No publisher has claimed this listing.

Caution

54/100

Arachne Discord MCP

Item: Arachne Discord MCP
Rating: 54
Author: M8ven

Multi-tenant Discord MCP server that lets multiple AI entities share one bot, each with unique identity and permissions.

→ SolanceLab/arachne-discord-mcp · listed on glama

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every push why connect →

Who stands behind it

SolanceLab

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

⚡ Connect GitHub for Live Monitored

Install from

Glamanot scored here

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings

🚨

Secret credentials may flow to a network call

1 flow detected: DISCORD_BOT_TOKEN. We can’t prove the destination matches the brand the credential belongs to.

⚠️

Known vulnerabilities in dependencies: 4 high

Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.

🔐

You'll be asked for 3 credentials: DISCORD_BOT_TOKEN, DISCORD_CLIENT_SECRET, JWT_SECRET

These are read from process.env at runtime. Make sure you trust where they’ll be sent.

// tools this server exposes34 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

read_messages

Read recent messages from the queue for subscribed channels. Messages are held for 15 minutes after they arrive. Use addressed_only to filter for messages directed at you (trigger words or @mentions). Use unread_only to get only messages you haven't seen yet.

send_message

Send a message to a Discord channel as this entity (with your name and avatar). To mention users use <@USER_ID>, roles use <@&ROLE_ID>, channels use <#CHANNEL_ID>.

add_reaction

Add a reaction emoji to a message.

remove_reaction

Remove the bot's reaction from a message.

list_channels

List Discord channels this entity can access.

get_entity_info

Get information about this entity — identity, description, platform, partner, servers, and channels. Call this at the start of a session to understand who you are.

introduce

Post a rich namecard embed in a channel introducing this entity. Shows name, description, platform, and partner. Use this when joining a new channel or when someone asks who you are.

get_channel_history

Fetch recent message history from a Discord channel (live from Discord API, not from queue). Use this to catch up on messages from before you connected.

leave_server

Remove this entity from a server. Deletes the entity role and stops receiving messages from that server. This action is irreversible without admin re-adding.

send_dm

Send a direct message to a Discord user. The user must share a server with this entity. Note: the DM comes from the Arachne bot, not this entity's webhook persona.

send_file

Send a file attachment to a Discord channel as this entity (with your name and avatar).

create_channel

Create a new channel in a Discord server.

set_channel_topic

Set the topic of a text channel.

rename_channel

Rename a Discord channel.

delete_channel

Delete a Discord channel. DANGEROUS — this action is irreversible.

create_category

Create a new category in a Discord server.

move_channel

Move a channel to a different category or position.

get_reactions

Get all reactions on a message, including which users reacted.

create_poll

Create a poll in a Discord channel. Note: polls are sent as the bot, not the entity webhook persona.

edit_message

Edit a webhook message sent by this entity. Can only edit messages originally sent by this entity's webhook.

delete_message

Delete a message from a Discord channel. Can delete own webhook messages or others if the bot has MANAGE_MESSAGES permission.

pin_message

Pin a message in a Discord channel.

unpin_message

Unpin a message in a Discord channel.

create_thread

Create a new thread in a Discord channel, optionally from an existing message.

create_forum_post

Create a new post in a forum channel.

list_forum_threads

List threads in a forum channel.

fetch_attachment

Get attachment metadata (filename, size, content_type) and CDN URLs from a message. Returns URLs only — does not download or return file contents. To read the actual file, your substrate must fetch the URL separately.

timeout_user

Timeout (mute) a user in a server for a specified duration.

assign_role

Assign a role to a user in a server.

remove_role

Remove a role from a user in a server.

search_messages

Search messages in a channel with various filters. At least one filter (keyword, author_id, before, after, has_attachment) is required.

list_members

List members of a Discord server.

get_user_info

Get detailed information about a user in a server.

list_roles

List all roles in a Discord server.

// known CVEs in dependencies4 high2 low

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highmulter@2.0.2GHSA-5528-5vmv-3xc2

Multer Vulnerable to Denial of Service via Uncontrolled Recursion

highmulter@2.0.2GHSA-72gw-mp4g-v24j

Multer vulnerable to Denial of Service via deeply nested field names

highmulter@2.0.2GHSA-v52c-386h-88mc

Multer vulnerable to Denial of Service via resource exhaustion

highmulter@2.0.2GHSA-xf7r-hgr6-v32p

Multer vulnerable to Denial of Service via incomplete cleanup

lowmulter@2.0.2GHSA-3p4h-7m6x-2hcm

Multer vulnerable to Denial of Service via incomplete cleanup of aborted uploads

Depend on this server? Get alerted when its CVEs change.Watch this server free →

// environment variables

To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.

configAVATAR_BASE_URL

configBASE_URLNo Public URL (default: http://localhost:3000)

configDASHBOARD_URLNo Dashboard URL (default: http://localhost:5173)

configDATA_DIRNo Directory for SQLite DB + avatars (default: .)

configDB_PATH

🔐 secretDISCORD_BOT_TOKENYes Bot token from Discord Developer Portal

configDISCORD_CLIENT_IDYes OAuth2 Application ID

🔐 secretDISCORD_CLIENT_SECRETYes OAuth2 Client Secret

🔐 secretJWT_SECRETYes Random 64-char hex (openssl rand -hex 32)

configMCP_PORT

configOPERATOR_DISCORD_IDSYes Comma-separated Discord user IDs for operator access

// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

34/34 tools missing one or more hints — read_messages (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); send_message (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); add_reaction (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +31 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

Tool inputs are validated

32/34 tool handlers declare input schemas (94%)

Declare an inputSchema with zod/joi/yup on every tool definition.

Tool handlers catch errors

32/34 tool handlers wrap calls in try/catch (94%)

Wrap each tool handler body in try/catch and return a structured error response.

Tests exist

No test files found

Add tests that exercise each declared tool.

Shell command execution

24 child_process calls — runs shell commands

Prefer library functions over shell-outs. If you must shell out, ensure all inputs are properly escaped.

Production dependencies are patched

0 critical, 4 high severity in production deps — multer@2.0.2 (high), multer@2.0.2 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail

The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.

// improvement guidance — verified publishers only

We have 7 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.

// embed badge in your README

[![M8ven Verified](https://m8ven.ai/badge/mcp/solancelab/arachne-discord-mcp?variant=verified)](https://m8ven.ai/mcp/solancelab/arachne-discord-mcp)

Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.

commit: af627d4b0fb9fd903b8f3bc213465d4e434196fa

code hash: 33e8530f170f02163d34f41c90f673185e0c59db3d25006fc16eb25232fc28c8

view raw JSON →

Check MCPs from inside your assistant

Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check

check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern

How to add it →Free · no account needed · works in any MCP client