Capability catalog

React to messages with emoji.

Low-impact, but still a write surface — customers may want to know if your plugin will be reacting on their server.

Update messages your plugin (or anyone the bot can edit) previously posted.

Edits change the visible state of a server without a new notification. Declaring it lets customers anticipate that your plugin will modify in-place rather than only post-and-forget.

Post new messages into channels the bot can see.

Messages are the most visible thing a plugin can do. Customers want to know upfront that your plugin will post in their server — surprise messages are a top reason plugins get uninstalled.

Reply to slash commands, button clicks, and modal submissions.

Interactions are how users invoke your plugin directly. If your manifest declares slash_commands, this capability is auto-added — Discord requires every slash command to respond.

Read and write a private per-server key-value store (up to 10K keys, 64KB per value).

Customers granting your plugin storage means it can keep data about their server forever. Declaring it lets them see, at install time, that your plugin will persist data — and lets them cleanly revoke it on uninstall.

Remove messages from a channel.

Message deletion is irreversible. Auto-moderation plugins legitimately need this; declaring it makes customers consciously trust your plugin not to delete things it shouldn't.

Create, execute and delete channel webhooks.

Webhooks post with an arbitrary display identity, which is useful for bridges and feeds but worth a conscious grant — customers should know a plugin can speak with faces other than its own.

Fetch members, channels, roles, and recent messages from the server.

Reading member lists and message history is privacy-sensitive — even read-only access lets your plugin build profiles. Declaring it makes the data access explicit at install time.

Receive the full text of messages in your message_create / message_edit handlers.

Message content is the most privacy-sensitive event field — most plugins genuinely don't need it (they react to commands, joins, reactions, etc.). Declaring it makes a clear privacy statement to customers, and Discord requires it as a separate intent.

Unlocks data in event payloads rather than a method.

Make HTTP calls to specifically declared external domains through the platform proxy.

Network egress is the biggest sandbox risk — a compromised plugin could exfiltrate data. The proxy enforces your declared domain list strictly, so customers know exactly which third parties their server's data may reach.

Read and write encrypted secrets (API keys, tokens) via ctx.secrets — values are AES-GCM-encrypted at rest and never visible in plugin stdout, KV, or logs.

Encrypted secrets let your plugin authenticate to third parties without leaking credentials through git, KV, or logs. Customers granting this know your plugin will store small encrypted values; the platform's master key is the only way to decrypt them.

Read and write rows in a private per-plugin Postgres schema (auto-created, no DBA needed).

SQL is powerful enough that misuse can leak customer data or degrade other plugins. Requires staff review on first version with this capability so we can sanity-check your queries are bounded.

Permanently bar members from the server.

Bans are the strongest punishment a plugin can dispense — they're effectively permanent unless reversed. Customers grant this only to plugins they fully trust. Be conservative about when to invoke it.

Remove members from the server (they can rejoin via invite).

Kicks affect real users. Customers expect plugins with this capability to use it judiciously — describe the exact trigger conditions in your plugin description.

Create, edit, or delete channels in the server.

Channel management can permanently destroy data (deleted channels can't be restored). Customers will see this in the consent screen and likely want a clear explanation in your plugin description — be specific about which channels your plugin will touch.

Add or remove roles from members.

Roles control what users can see and do. A buggy plugin with this capability can lock customers out of their own server — declare it so customers know to test in a staging server first.

Put members into Discord 'timeout' (temporary message/voice mute).

Timeouts affect real people's experience in the server. Required separately from ban/kick because some auto-mod plugins want timeout-only with no escalation.

Open and maintain a persistent two-way connection to a declared external host, and optionally authenticate it with a stored secret.

A persistent, bidirectional, authenticated channel is a much larger trust grant than a one-shot HTTP call — it is the natural target for a compromised plugin. The platform holds the socket and enforces SSRF checks for the whole life of the connection. Destinations are either declared up front (staff-reviewed) or approved at setup by a server admin for their own server (e.g. a game-server IP) — the customer always controls where their data goes. Secrets are only injected to the precise domain they are bound to. Reviewed before publish.