Overview

BonkerBot is a Discord scam filter. It checks what a message links to, what it says, and what's written inside any images attached to it, then weighs that against a global reputation score the account carries between servers.

It is not an anti-nuke or anti-raid bot. It has no CAPTCHA gate, no server backup, and no protection against a rogue administrator. If those are your problem, you want a different tool — Why BonkerBot lays out exactly which one, and where BonkerBot loses.

Set it up

1. Add BonkerBot to your server.
2. Run /setup-server run. It walks you through the mod review channel, moderator roles, and which detection modules to enable.
3. That's it. Adjust anything later with /botconfig, or leave the defaults alone — they're chosen to be conservative.

If you'd rather not read a command list, don't: run /help in your server and it renders one for you.

How detection actually works

A message is checked by several independent modules in parallel — text patterns, link and typosquat analysis, image OCR, perceptual image hashing, join-spam and duplicate-post signals. Each returns a bounded confidence contribution, conventionally capped at 0.6.

Two rules govern what happens next:

Corroboration. No single module can push a message over an action threshold on its own. Crossing the line always requires at least one other independent signal agreeing. This is the structural difference from a keyword-score bot, where enough points from one weak source looks identical to real evidence.

Evidence before priors. Evidence is intrinsic to the message. A prior is extrinsic — who posted it, how new the account is, where they came from. Priors may only sharpen evidence that already exists, up to a bounded ceiling. With zero intrinsic evidence the score is zero, no matter how many priors fire.

That second rule is why "new account posted 14 seconds after joining" is not, by itself, treated as a scam.

Above the threshold, the pipeline creates a report, clusters it with similar recent reports into a campaign, posts a mod review embed for a human to confirm or dismiss, and — if the server has enabled auto-actions and the confidence clears the configured bar — acts. Every action carries an undo button and writes an audit log row.

Below the threshold, the message is dropped in memory. Nothing is stored. What the bot can see covers that in mechanical detail, including images, DMs, and where processing happens.

Karma, the global trust score

Every user has a score from 0.0 to 10.0, defaulting to 5.0, shared across every BonkerBot-enabled server.

• Automated drops are velocity-capped at −3.0 per 24 hours.
• Non-system gains are capped at +1.0 per 24 hours.
• Scores recover passively at 0.1 per month, up to a ceiling of 7.0.
• Being flagged in three or more independent servers carries an extra penalty.

Servers set their own thresholds against that score for warn, mute, kick, and ban. Users check their own with /karma; moderators can check anyone's.

This is a shared-fate design and that cuts both ways: the third server a scammer hits already knows what the first two learned, but a mistake in one server propagates too. Velocity caps, the corroboration requirement, /appeal, and undo buttons exist because of that tradeoff, not in spite of it.

Only the bot we operate writes to this network. A self-hosted instance keeps its own local scores and is not connected — see How the project is split for why.

What happens to your data

Short version: Discord user IDs, trust scores and their history, and the content of messages that were actually flagged or reported. Confirmed scam images are kept as perceptual hashes, not as images. No usernames, no member lists, no server names. Nothing is sold or shared, and no message content is sent to any third-party API.

Any user can export or delete everything held under their ID with /privacy.

The privacy policy is the authoritative version, and the terms of service cover the rest.

Where to go next

• What the bot can see — the honest, mechanical answer to "is this thing spying on me".
• How the project is split — what's public, what's private, and what you can contribute.
• Why BonkerBot — honest comparison against Wick, Lum, Beemo, Security Bot and native AutoMod, including where BonkerBot is worse.
• Command reference — everything you can run.
• Training guide — teaching the bot new scam patterns.
• Self-hosting — running your own instance.