discord-selfbot-mcp

The primary security concern is the inherent nature of a 'selfbot', which violates Discord's Terms of Service and carries a significant risk of account termination. The setup process involves handling a Discord user token, which grants full access to the account, requiring careful management by the user. Optional integration with third-party captcha-solving services (CapSolver, CapMonster, NopeCHA) means sending captcha-related data to external APIs, which is a privacy consideration. The `download_attachment` tool allows downloading files to the local filesystem, which could be a vector for malicious files if the AI is instructed to download untrusted content to sensitive locations. The code base itself uses Zod for input validation and has a `DANGER_MODE` setting for sensitive relationship actions, indicating an attempt at internal safety, but these do not mitigate the fundamental risks of selfbotting or user-directed malicious actions.