GuildControl MCP

GuildControl MCP is a local stdio connector for a Discord bot you create, install, and control. It combines broad typed Discord coverage with a strict non-secret policy, bounded privacy-aware results, reviewed writes, and content-free operational evidence.

The safest useful start

Create an owner-managed bot, grant only the read permission selected by a preset, verify one guild, and complete one host-side channel inventory. Write workflows remain off until you deliberately add one.

npx guildctl

The host-first guide carries the Application ID, exact guild, least-privilege install, token custody, verified policy, real stdio smoke test, selected host handoff, and first read as one fail-closed flow. It changes no host configuration and keeps the token out of its policy, report, guide, and arguments.

What makes the boundary different

You keep custody

The project does not operate a shared bot, hosted relay, or token store. The token stays in a caller-owned secret source and out of the non-secret policy file.

Policy narrows discovery

Explicit read modes, typed exact-ID groups, notification and thread choices, feature scope, and toolsets decide which capabilities the MCP host can discover. Unconfigured authority is absent from the callable surface.

Writes are reviewed workflows

Mutating operations start from exact intent, prepare fresh keyed evidence internally, require signed request state and interactive approval, replan, coordinate durably, and read back the exact outcome where Discord permits it.

Evidence excludes Discord content

Activity records preserve identifiers, hashes, timestamps, numeric parameters, outcomes, and sanitized errors without persisting messages, names, topics, URLs, embeds, or profiles.

From install to verified outcome

1. CreateMake a Discord application and bot you control
2. GuideRun npx guildctl and choose the MCP host first
3. ConfirmInstall the minimum grant and type the exact guild ID
4. ProveVerify identity, policy, installation, and the real stdio path
5. UseOpen the private host handoff and complete the first read

Choose the depth you need

Choose an outcomeFind the shortest safe route for setup, reads, reviewed writes, recovery, or verification.

Switch from another Discord MCPMap every audited source tool into a supported, reviewed, or deliberately excluded outcome before changing either deployment.

Take the verified product tourWalk from release inspection through scope, a first read, reviewed change, and ambiguity recovery using exact negotiated contract evidence.

Connect your MCP hostImport the deterministic MCPB or generate digest-bound host projections without placing a credential in static configuration.

Understand the safety modelSee how policy, planning, approval, coordination, readback, and evidence fit together.

Review every safety tradeoffSee the threat, usability cost, retained controls, residual risk, and recovery rationale behind each restriction.

Read the privacy policySee what the connector reads, returns, retains, exports, and leaves under operator control.

Compare the fieldInspect the dated head-to-head matrix, rubric, release sources, and evidence behind every lead.

Browse the complete referenceNavigate the canonical capability documentation as searchable task-sized pages.

Inspect the exact contractOpen the credential-free explorer generated from the production MCP registrations.

Honest boundaries

This is self-hosted local software, not a managed service. Discord permissions, role hierarchy, channel overwrites, intents, rate limits, API availability, and the MCP host's approval behavior remain real external constraints. Start with the fit and boundaries guide when evaluating custody or compatibility, and use the troubleshooting ladder when setup fails.