Skip to content
Claude Discord Bot

Security

The bot runs an AI agent that takes instructions from Discord messages and can execute commands. Treat it like giving shell access to everyone on the allow list.

What it can do

Section titled “What it can do”
  • Run any command as node, and as root via passwordless sudo.
  • Read the Claude credentials and GH_TOKEN from its environment. In bridge mode DISCORD_BOT_TOKEN is removed from the sessions’ environment, but with sudo a session could still read it from the bridge process, so treat this as a speed bump, not a boundary.
  • Push to any repository GH_TOKEN can write to.
  • Reach the network.

Recommendations

Section titled “Recommendations”
  • Keep the allow list short. Only trusted people in DISCORD_ALLOWED_USERS / DISCORD_CHANNEL_USERS. Bridge mode ignores DMs; in plugin mode use DISCORD_DM_POLICY=disabled (or allowlist) and DISCORD_ACCESS_MODE=static.
  • Approvals are per user. Only allowed users can press the Allow/Deny buttons the bridge posts, and an unanswered prompt is denied.
  • Keep DISCORD_REQUIRE_MENTION=true so ordinary channel chatter is not treated as instructions.
  • Scope GH_TOKEN. Use a fine-grained token limited to the repositories the bot needs, with an expiry date.
  • Prefer auto permission mode over bypassPermissions. In auto mode risky actions are checked before they run.
  • Remove sudo if you don’t need it. Delete the /etc/sudoers.d/node line from the Dockerfile and rebuild; install required tools in the image instead.
  • Never commit .env. It is in .gitignore. Rotate any token that leaks.
  • Resource limits (mem_limit: 4g, cpus: 2) stop a runaway process from taking down the host. Keep them.
  • Access changes come from the operator. The plugin will not change access.json because a Discord message asks it to; do it through env vars or /discord:access in the terminal.