orygn/discord-mcp repository overview

⁠Discord MCP

Discord server management MCP for AI agents. Formerly Omnicord.

discord-mcp is an MCP server that gives your AI assistant operational control of a Discord server: day to day chat, moderation, and administration, up to building out an entire community server from a one paragraph brief. It runs against your own Discord bot, so it acts with the permissions you granted and nothing more. There is no LLM inside it and no cloud service behind it.

Source, documentation, and issues: https://github.com/OrygnsCode/discord-mcp⁠

⁠Running the image

This image runs the Streamable HTTP transport. It binds beyond loopback, so it requires an auth token and exits with a clear message without one. The bot token never lives in the image; both secrets arrive through the environment at runtime.

docker run -d -p 3414:3414 \
  -e DISCORD_TOKEN=your-bot-token \
  -e DISCORD_MCP_HTTP_TOKEN=a-long-random-secret \
  orygn/discord-mcp

Optionally set DISCORD_MCP_GUILD to a default server id so tools can omit the server parameter.

For the local stdio transport, which is what most desktop MCP clients use, install from npm instead:

npx @orygn/discord-mcp init

The setup wizard takes the token with input hidden, verifies it against Discord, checks the privileged intent toggles, generates an invite link at the permission level you pick, and writes the client configuration for you.

⁠Nothing destructive happens without you

Every action that deletes, bans, kicks, prunes, or otherwise causes irreversible change runs through a confirmation gate. The first call changes nothing: it returns a preview of exactly what would happen plus a single use token bound to that exact action, and only a second call carrying that token executes. In apps that can show one, the confirmation is a dialog the AI cannot answer for you. The gate is enforced by the server rather than by the model's judgment, and it cannot be turned off by the AI.

⁠Security defaults

• Runs as a non root user, with the container health check wired to the health endpoint.
• Refuses to start on a non loopback bind without DISCORD_MCP_HTTP_TOKEN, so a bot cannot be exposed by accident.
• Bearer tokens are compared in constant time, browser origins are rejected unless allowlisted, and the Host header is validated to close DNS rebinding.
• The token is never logged, never returned in a tool result, and never accepted as a tool argument.

The engineering detail is in SECURITY.md⁠, with a plain language overview in the security whitepaper⁠.

⁠Tags

orygn/discord-mcp:latest tracks the newest release. Every release is also published under its own version tag, so a deployment can pin one.

⁠Coming from Omnicord

Releases up to 1.4.1 were published as orygn/omnicord, and that image stays at 1.4.1. The OMNICORD_* setting names keep working through 2.x.

⁠License

Apache-2.0. Versions up to 1.4.1 are under the Elastic License 2.0.