Stop the raid before it lands.Undo the nuke if it does.
Sentinel watches every structural change on your server — joins, roles, channels, webhooks, permissions — scores them against a multi-signal risk engine, and acts in seconds. Every decision is explained, every action is reversible.
No Administrator permission required · Free tier available · Self-hostable
23
Protected event types
30+
Risk signals evaluated
< 2s
Median detection latency
Automatic
Configuration snapshots
Capabilities
Everything a public community needs to stay standing
Each layer is independently configurable, and each one records why it did what it did.
Multi-signal raid detection
Join rate, account age distribution, username clustering, avatar patterns, invite attribution and rejoin behaviour — combined, not checked one at a time.
Anti-nuke that Administrators cannot bypass
By default, holding Administrator does not exempt anyone. Only an explicit whitelist entry does. That is the whole point.
Explainable risk scoring
Every incident records which signals fired, how many points each contributed, and why the resulting action was chosen.
Five lockdown levels
From monitor-only to a full text and voice lockout. The original permissions of every channel are saved first, so unlocking restores exactly what changed.
Snapshots and guided restore
Scheduled configuration snapshots, a reviewable diff, and a restore plan you confirm before anything is applied.
Verification gate
Quarantine new members behind a button, a CAPTCHA or a web OAuth check, with single-use tokens and automatic expiry.
Complete audit trail
Every configuration change, punishment and lockdown is recorded with the actor, the diff and a request id. Secrets never appear in it.
API and signed webhooks
Scoped API keys and HMAC-signed outgoing webhooks with retries, replay protection and a delivery log.
Anti-raid
A raid is a pattern, not a number
Rate limits alone punish legitimate growth and miss slow raids. Sentinel evaluates the shape of the wave.
- Join rate measured over a sliding window, not a fixed bucket an attacker can straddle.
- Account-age distribution across the wave, not just the individual account.
- Username clustering that folds homoglyphs and digit runs, so "user_1839" and "usеr_2044" group together.
- Invite attribution: which invite the wave arrived through, and whether one invite is responsible.
- Rejoin cycling, prior incidents on this server, and cross-server reputation.
Anti-nuke
The compromised moderator problem
Most damage comes from a real staff account, not an outsider. Protection that trusts permissions cannot help there.
- Per-event-type limits: channel deletions, role changes, webhook creation, mass bans, permission grants.
- Accumulated risk across event types, so staying under every individual limit still trips the threshold.
- Escalation on repeat offences inside a configurable window.
- Automatic removal of dangerous roles before the actor can continue.
- Audit-log correlation with retries, so the actor is identified even when Discord is slow.
FiveM
Built around how FiveM communities actually operate
Server status, player counts and identifier management, treated as first-class features rather than an afterthought.
- Live server status with player counts, latency and a self-updating Discord embed.
- Downtime alerts after a configurable number of consecutive failed checks.
- Identifier management for license, license2, Steam, Xbox Live, Microsoft Live and FiveM IDs.
- Sensitive identifiers are stored hashed for matching and encrypted for authorised disclosure — never in the clear.
- Local, community and operator-reviewed global blacklists, with evidence, expiry and appeals.
Realtime
See it while it is happening
The dashboard streams live events over SSE. No refreshing during an incident.
- Live incident feed, join activity and automatic actions as they are taken.
- Security score with the exact factors that produced it.
- Incident timeline with the audit-log correlation and every attempted action, including failures.
- Export any incident to JSON or CSV for a post-mortem.
- Health endpoints and Prometheus-shaped metrics for your own monitoring.
Dashboard
A security console, not a settings page
Dark by default, responsive down to a phone, and every control wired to a real endpoint.
Security score
92
2 factors to improve
Open incidents
1
1 investigating
Blocked attacks (30d)
47
+12 vs previous
Protection
Active
Anti-raid + anti-nuke
Recent security events
Mass join raid — 74 accounts in 45 seconds
Banned 74 accounts
Compromised moderator deleted 9 channels
Roles stripped, lockdown
Administrator granted to a non-whitelisted role
Permission reverted
Severity, last 30 days
Getting started
Protected in about four minutes
Sensible defaults on install, so a server is never left unprotected while it is being configured.
- 01
Invite the bot
Grant the permissions it needs — Administrator is deliberately not among them.
- 02
Run /setup
Default protection is applied immediately and the bot reports any missing permission.
- 03
Review in monitor mode
Optionally run detection-only for a day to see what would have been actioned on your server.
- 04
Tune and go live
Adjust thresholds from the dashboard, set your whitelist, and enable enforcement.
FAQ
Questions worth asking before you install a security bot
Does the bot need Administrator?
No, and it should not have it. The invite link requests only the specific permissions each protection needs: viewing the audit log, managing roles and channels, moderating members, and reading invites. /setup reports exactly which permission is missing and what stops working without it.
Can a server Administrator bypass protection?
Not by default. Holding Discord Administrator grants no exemption — only an explicit whitelist entry does, and the server owner only if owner bypass is left enabled. This is deliberate: granting yourself Administrator is the first move after compromising a staff account.
What happens to a false positive?
Every incident records the signals and points that produced it, so you can see exactly why. Mark it as a false positive and the reason is stored with the incident. Monitor-only mode lets you validate your thresholds without any member being punished.
Can it really undo a nuke?
It can restore channels, categories, roles, permission overwrites and most server settings from a snapshot, after you review the plan. It cannot restore message history in a deleted channel — Discord does not expose that to any bot, and we do not claim otherwise.
Where is my data stored?
In your own PostgreSQL and Redis when self-hosted. Sensitive identifiers are hashed for matching and encrypted at rest; Discord OAuth tokens are encrypted and never sent to the browser. Audit logs never contain secrets.
Does it work with a sharded bot?
Yes. Sharding is configurable (auto, fixed or an explicit shard list), all counters and locks are distributed through Redis, and every protective action is idempotent, so a redelivered gateway event cannot punish somebody twice.
Every server gets raided eventually. Be configured before it happens.
Install in minutes, run in monitor mode for a day, then switch enforcement on with thresholds you have actually seen work on your server.