tab-bot/docs/guide/enable-discord.md

Enable Discord pack + allowlist

The extension can be installed while Discord is still off. TabBot’s header then reads DISCORD · OFF or ORIGIN · BLOCKED. Login will fail until both switches are right.

Steps

1. Open BridgeSwarm Settings (extension menu).
2. Turn on Enable Discord. surface / status still work while this is off; construct and login do not.
3. Under Capability origins, add the origin you actually use:
   • Official site: https://tab-bot.rest
   • Vite dev: http://127.0.0.1:5173
   • npm start (Express): http://127.0.0.1:2589
   • Defaults in BridgeSwarm often only include the examples server on port 4173. That is not TabBot.
4. Under Agent always-approve, add the same origin if you want the Studio / /agent harness to skip host-tool permission prompts (shell, writes). always-approve is only honored for origins on that list. TabBot still auto-permits individual prompts as a fallback; stdio MCP still requires a trusted origin.
5. Refresh TabBot. The header should read HOST · DISCORD · OK.

There is no “allow all origins” mode. If you self-host TabBot on another origin (HTTPS on a LAN name, a preview port), that origin must be listed too.

What the header colors mean

Badge	Meaning
HOST · DISCORD · OK	Probe succeeded. You can launch a runner.
HOST · MISSING	Extension not in this tab.
DISCORD · OFF	Pack disabled in Settings.
ORIGIN · BLOCKED	This origin is not on the allowlist.
HOST · DOWN	Native host is not running.

The install gate on Studio copies the exact origin string to paste. Use that, not a guess.

Security note

Any origin on the allowlist can talk to Discord as you, for clients the host will construct. Treat allowlisting like handing over a privileged API. Do not allowlist random websites.