How to audit a Discord bot's permissions before you install it

Step 1: get the install link, not the button

Copy the link address behind the "Add to Discord" button rather than clicking it. A real Discord install link starts with https://discord.com/oauth2/authorize and carries a client_id parameter. Discord also serves the same screen from /api/oauth2/authorize and the versioned /api/v10/oauth2/authorize.

If the host is anything other than a Discord domain, stop. That is the most common shape of a faked install link, and no permissions analysis matters after it.

1. Right-click the install button and copy the link address.
2. Confirm the host reads discord.com before anything else.
3. Paste the whole URL into the decoder - it parses locally and requests nothing.

Step 2: decode the permissions integer

The permissions parameter is a bitfield: each set bit is one permission. Decoding it turns a number nobody can read into a list you can argue with.

Check the top of the list first. If Administrator is set, nothing else in the list matters - it implies every other permission and bypasses channel overwrites, so a long list and a short one are the same grant.

Step 3: read the scopes separately

The scope parameter is not the same thing as permissions. Permissions say what the bot can do inside your server; scopes say what the app may do with your Discord account.

For a server install you expect bot and applications.commands. Scopes such as guilds.join, gdm.join, rpc or messages.read on an ordinary install link deserve an explanation before you continue.

Step 4: confirm the application ID

The client_id in the link is the application it installs. A link that looks right but carries a different ID installs a different app.

Every profile in this catalog states the application ID verified against Discord's own public application endpoint. The decoder cross-references that automatically: paste a link and it will tell you which catalogued app the ID belongs to, or that it does not know it.

Step 5: check the privileged intents, which are not in the link

Permissions are per server and appear in the link. Privileged intents are configured on the application and apply everywhere. Message Content in particular decides whether the app can read what your members type, and it is invisible at install time.

This catalog reads intents from the application flags Discord publishes, so each profile states them as an observed fact. Check the profile before you decide whether the permission list was the whole question.

Step 6: decide against an alternative, not in the abstract

A permission request only means something next to another app that does the same job. Several apps in this catalog do comparable work on materially different grants, and the comparison pages state the permission delta directly.

If the app you are auditing publishes no install parameters at all, that is itself a finding: you cannot audit the request until the authorize screen renders it. The catalog marks those apps explicitly rather than guessing.