Everything lives under one slash command: /aegis. Eight subcommands cover setup, containment, recovery, and tuning — detection itself runs automatically and never needs a command.
All commands require the Moderate Members permission and work in servers only. Replies are visible just to you.
Getting set upTwo commands and you're protected. Run them again anytime — setup is safe to repeat and re-covers channels created since.
One-command onboarding. Creates the Quarantined role, applies deny overwrites across every channel, provisions Discord's native AutoMod rules as a fallback layer, and wires alerts to your mod-log channel.
home = a channel quarantined members can still see (read-only) so they can reach your mods. Defaults to the server's system channel.
Posts a sample alert to the mod-log. Confirms the bot's permissions end-to-end and shows you exactly what real alerts will look like — no waiting for an actual incident.
The dashboard: raid-mode state, phishing-blocklist size, mod-log and quarantine-role wiring, and your current pressure and raid thresholds at a glance.
Containment & recoveryAegis quarantines compromised accounts automatically — these commands are for when you spot something first, and for bringing members home after.
Manually contain a member you suspect is compromised. Their roles are snapshotted and stripped, the quarantine role is applied, and a mod-log entry is posted with a one-click Release button.
Release a member once their account is secured. Their roles are restored from the quarantine snapshot automatically, and the mod-log records who released them.
Snapshots are kept for 7 days — after that, re-assign roles manually.
Raids & the blocklistRaid mode flips on by itself when joins spike; the live blocklist tracks 44,000+ phishing domains. These commands give you the manual override.
Manually end raid mode. Join-gate timeouts stop and detectors return to normal sensitivity. (Raid mode also ends on its own once the join wave passes.)
block adds a domain to your server's local blocklist — messages containing it become a hard signal. allow whitelists a domain, overriding every blocklist entry (useful for false positives).
Allow-listing weakens protection, so it's announced in the mod-log for all mods to see.
TuningThe defaults work for most servers. If yours runs hotter or quieter than average, adjust one threshold at a time and watch the mod-log.
Change a numeric threshold for this server. Every server keeps its own config.
| Key | Controls | When it triggers |
|---|---|---|
| deleteThreshold | Pressure score that deletes the offending message | First rung of enforcement |
| quarantineThreshold | Pressure score that quarantines the member | Suspected compromised account |
| banThreshold | Pressure score that bans the account | Throwaway attacker accounts |
| raidJoinThreshold | Joins inside the window that flip raid mode | Join spike detected |
| joinWindowSeconds | Size of the join-counting window | Pairs with raidJoinThreshold |
| youngAccountDays | Account age treated as "young" at the door | Raid-mode join gating |
The support server is the fastest way to reach us — for setup help, false positives, or feature ideas. Bugs and requests are also welcome on GitHub.