# Enable Discord pack + allowlist

The extension can be installed while Discord is still **off**. TabBot’s header then reads `DISCORD · OFF` or `ORIGIN · BLOCKED`. Login will fail until both switches are right.

## Steps

1. Open **BridgeSwarm Settings** (extension menu).
2. Turn on **Enable Discord**. `surface` / `status` still work while this is off; `construct` and `login` do not.
3. Under **Capability origins**, add the origin you actually use:
   - Official site: `https://tab-bot.rest`
   - Vite dev: `http://127.0.0.1:5173`
   - `npm start` (Express): `http://127.0.0.1:2589`
   - Defaults in BridgeSwarm often only include the examples server on port **4173**. That is not TabBot.
4. Under **Agent always-approve**, add the **same origin** if you want the Studio / `/agent` harness to skip host-tool permission prompts (shell, writes). `always-approve` is only honored for origins on that list. TabBot still auto-permits individual prompts as a fallback; stdio MCP still requires a trusted origin.
5. Refresh TabBot. The header should read **HOST · DISCORD · OK**.

There is no “allow all origins” mode. If you self-host TabBot on another origin (HTTPS on a LAN name, a preview port), that origin must be listed too.

## What the header colors mean

| Badge | Meaning |
| --- | --- |
| HOST · DISCORD · OK | Probe succeeded. You can launch a runner. |
| HOST · MISSING | Extension not in this tab. |
| DISCORD · OFF | Pack disabled in Settings. |
| ORIGIN · BLOCKED | This origin is not on the allowlist. |
| HOST · DOWN | Native host is not running. |

The install gate on Studio copies the exact origin string to paste. Use that, not a guess.

## Security note

Any origin on the allowlist can talk to Discord **as you**, for clients the host will construct. Treat allowlisting like handing over a privileged API. Do not allowlist random websites.