Critical-risk tools in Discord
16 of the 97 tools in Discord are classified as critical risk. This page profiles those tools specifically, with recommended policy actions and the attack patterns that target them.
Every operation listed below is an action PolicyLayer recommends controlling at the transport layer. Open any tool to see the full profile, risk score, and YAML policy snippet.
Tools at critical risk
-
discord_ban_memberDestructiveBan a user from the server, blocking re-entry until unbanned. Optionally bulk-deletes their recent messages. Requires the Ban Members permission, and the bot
-
discord_bulk_banDestructiveBan many users in a single call, intended for raid mitigation. SAFE BY DEFAULT: dry_run is true unless explicitly set to false, so call it first to preview the exact list of use...
-
discord_bulk_delete_messagesDestructivePermanently delete multiple recent messages in one call. IRREVERSIBLE. SAFE BY DEFAULT: dry_run is true unless explicitly set to false, so call it first to preview, then re-call...
-
discord_delete_channelDestructivePermanently delete a channel and all of its messages. IRREVERSIBLE. SAFE BY DEFAULT: dry_run is true unless explicitly set to false, so call it first to preview, then re-call wi...
-
discord_delete_dmDestructivePermanently delete a DM message previously sent by this bot. IRREVERSIBLE. The bot can only delete its own DM messages, not the recipient
-
discord_delete_forum_postDestructivePermanently delete a forum post (thread) and all its messages. IRREVERSIBLE. To merely close it without deleting, use discord_update_forum_post with archived:true. Requires the ...
-
discord_delete_inviteDestructiveRevoke an invite by its code so it can no longer be used. IRREVERSIBLE (the code is freed). Requires the Manage Channels permission (or Manage Server). The reason is recorded in...
-
discord_delete_messageDestructivePermanently delete one specific message. IRREVERSIBLE. The bot can always delete its own messages; deleting another user
-
discord_delete_roleDestructivePermanently delete a role from the server; it is automatically removed from every member who held it. IRREVERSIBLE. Requires the Manage Roles permission, and the role must be be...
-
discord_delete_scheduled_eventDestructivePermanently delete a scheduled event. IRREVERSIBLE. To cancel an event while keeping a record, use discord_edit_scheduled_event with status:
-
discord_delete_webhookDestructivePermanently delete a webhook by its ID, invalidating its token. IRREVERSIBLE — any integrations using the old token will stop working. Requires the Manage Webhooks permission.
-
discord_delete_webhook_messageDestructivePermanently delete a message that was sent through a webhook, using the webhook
-
discord_kick_memberDestructiveRemove a member from the server. They can rejoin with a new invite (unlike a ban). Requires the Kick Members permission, and the bot
-
discord_prune_membersDestructiveRemove members who have been inactive (no roles, not seen) for a number of days. SAFE BY DEFAULT: dry_run is true unless explicitly set to false, so call it first to preview the...
-
discord_remove_reactionsDestructiveRemove reactions from a message. With no emoji: removes ALL reactions. With emoji only: removes every reaction of that emoji. With emoji and user_id: removes that one user
-
discord_reset_channel_permissionsDestructiveRemove ALL permission overwrites on a channel, so only role/server-level permissions apply. Does NOT re-sync with the category — use discord_lock_channel_permissions for that. I...
Attacks that target this class
Critical-risk tools in any server share these documented attack patterns. Each links to the full case and the defensive policy.