> ## Documentation Index
> Fetch the complete documentation index at: https://docs.mira.party/llms.txt
> Use this file to discover all available pages before exploring further.

# Antinuke

> Rate-limit destructive admin actions, punish whoever trips them, and undo the damage.

Antinuke watches the audit log. When someone performs too many destructive actions inside a time window, they get punished and — where possible — the damage gets reverted.

It's aimed squarely at the threat other systems can't touch: **people who already have permissions**. A compromised admin account, a staff member who's decided to burn the place down, a bot with more scope than it should have.

## Who can configure it

Antinuke is deliberately locked tighter than everything else. Only the **server owner** and members explicitly added as **managers** can change its settings — Administrator alone isn't enough, because an attacker who gains Administrator would otherwise just turn it off.

<CodeGroup>
  ```javascript Add a manager theme={null}
  !antinuke trust @cofounder
  ```

  ```javascript See who's trusted theme={null}
  !antinuke trust list
  ```

  ```javascript Remove everyone theme={null}
  !antinuke trust clear
  ```
</CodeGroup>

Aliases for `trust`: `manager`, `mod`, `admin`.

## Modules

Each module is toggled independently and has its own threshold and window.

```javascript theme={null}
!antinuke <module> (on/off) --threshold <count> --duration <time>
```

| Module    | Aliases    | Watches for                 |
| --------- | ---------- | --------------------------- |
| `ban`     | `bans`     | Members being banned        |
| `kick`    | `kicks`    | Members being kicked        |
| `channel` | `channels` | Channels created or deleted |
| `role`    | `roles`    | Roles created or deleted    |
| `webhook` | `webhooks` | Webhooks created or deleted |
| `emoji`   | `emojis`   | Emojis created or deleted   |

| Flag          | Aliases           | Default | Range     |
| ------------- | ----------------- | ------- | --------- |
| `--threshold` | `--limit`         | `3`     | 1–12      |
| `--duration`  | `--time`, `--per` | `1h`    | up to 12h |

<CodeGroup>
  ```javascript Typical theme={null}
  !antinuke ban on --threshold 3 --duration 1h
  ```

  ```javascript Stricter theme={null}
  !antinuke channel on --threshold 2 --duration 30m
  ```

  ```javascript Turn one off theme={null}
  !antinuke emoji off
  ```
</CodeGroup>

Read a threshold as *"more than N of this, within this window, gets you punished."*

### Modules with no threshold

<AccordionGroup>
  <Accordion title="antinuke bot" icon="robot">
    ```javascript theme={null}
    !antinuke bot on
    ```

    Any bot added to the server is **immediately kicked**, and whoever added it is punished. There's no threshold — one is enough.

    This is the single highest-value toggle in the whole system. Adding a malicious bot is by far the most common way a server actually gets nuked, because it takes one click and needs no permissions of the attacker's own beyond Manage Server.

    Legitimate additions still work — whitelist yourself, then add the bot.
  </Accordion>

  <Accordion title="antinuke permissions" icon="key">
    ```javascript theme={null}
    !antinuke permissions on
    ```

    Watches for dangerous permissions being granted to a role — Administrator, Ban Members, Manage Roles, Manage Guild and similar. When one appears, the grant is **instantly reverted** and whoever made it is punished.

    This catches the subtler attack: rather than deleting anything, the attacker quietly gives `@everyone` Administrator and comes back later. Aliases: `permission`, `perms`.
  </Accordion>

  <Accordion title="antinuke webhookspam" icon="comment-dots">
    ```javascript theme={null}
    !antinuke webhookspam on --mentions 20 --everyone 1
    ```

    Detects mass-mention spam being pushed through a webhook, deletes the messages and removes the webhook. Webhooks bypass most other protections because they aren't a member, which is exactly why this exists separately.

    | Flag         | Default | Range |
    | ------------ | ------- | ----- |
    | `--mentions` | `20`    | 5–100 |
    | `--everyone` | `1`     | 0–5   |

    Aliases: `wspam`, `hookspam`, `whspam`, `mentionspam`, `spam`.
  </Accordion>
</AccordionGroup>

## Punishment

```javascript theme={null}
!antinuke punishment ban
```

| Value        | Effect                                             |
| ------------ | -------------------------------------------------- |
| `ban`        | Banned from the server                             |
| `kick`       | Removed, can rejoin                                |
| `stripstaff` | Every role with meaningful permissions is removed  |
| `jail`       | Given the jail role, loses access to every channel |

`stripstaff` is worth considering for a large staff team — it neutralises the account without the drama of a ban, and `!stripstaff restore @them` puts every role back once you've worked out what happened. `jail` needs the jail role set up first, via `!setup`.

Aliases for the command: `action`.

## Whitelisting

Two different lists, for two different things:

| List                 | What it does                                                     |
| -------------------- | ---------------------------------------------------------------- |
| `antinuke whitelist` | Exempt from **being punished**. Can perform bulk actions freely. |
| `antinuke trust`     | Can **change antinuke settings**.                                |

<CodeGroup>
  ```javascript Exempt someone theme={null}
  !antinuke whitelist @headadmin
  ```

  ```javascript See the list theme={null}
  !antinuke whitelist list
  ```

  ```javascript Clear it theme={null}
  !antinuke whitelist clear
  ```
</CodeGroup>

Aliases for `whitelist`: `exempt`, `wl`.

Whitelist sparingly. Every entry is a hole in the system, and the whole point is that a compromised admin account isn't trusted. Bots that legitimately mass-manage things — a ticket bot creating channels, a role bot doing bulk assignment — do need whitelisting or they'll trip thresholds during normal operation.

## Restoring after an attack

When a module fires, the alert includes a **restore** button. Antinuke snapshots roles and channels *before* they're deleted, so restoring recreates them with:

* The original name, colour, position and permissions
* Every member who had the role, re-assigned
* Channel category, topic and permission overwrites

Snapshots are kept for **one hour**. After that the button stops working and you're back to [backups](/setup/backups).

## Reviewing the configuration

```javascript theme={null}
!antinuke settings
```

Aliases: `config`, `cfg`, `configuration`, `overview`, `view`, `ov`. Shows every module, its threshold and window, the punishment, the manager list and the whitelist in one embed.

## Command reference

| Command                                 | Permission | Description                        |
| --------------------------------------- | ---------- | ---------------------------------- |
| `antinuke`                              | —          | Overview                           |
| `antinuke ban (on/off) [flags]`         | Manager    | Mass-ban protection                |
| `antinuke kick (on/off) [flags]`        | Manager    | Mass-kick protection               |
| `antinuke channel (on/off) [flags]`     | Manager    | Channel create/delete protection   |
| `antinuke role (on/off) [flags]`        | Manager    | Role create/delete protection      |
| `antinuke webhook (on/off) [flags]`     | Manager    | Webhook create/delete protection   |
| `antinuke emoji (on/off) [flags]`       | Manager    | Emoji create/delete protection     |
| `antinuke bot (on/off)`                 | Manager    | Auto-kick newly added bots         |
| `antinuke permissions (on/off)`         | Manager    | Revert dangerous permission grants |
| `antinuke webhookspam (on/off) [flags]` | Manager    | Webhook mention-spam cleanup       |
| `antinuke punishment <action>`          | Manager    | ban / kick / stripstaff / jail     |
| `antinuke whitelist [user]`             | Manager    | Toggle exemption from punishment   |
| `antinuke whitelist list`               | Manager    | View exempt users                  |
| `antinuke whitelist clear`              | Manager    | Clear the exemption list           |
| `antinuke trust <member>`               | Owner      | Toggle a settings manager          |
| `antinuke trust list`                   | Manager    | View managers                      |
| `antinuke trust clear`                  | Owner      | Remove all managers                |
| `antinuke settings`                     | Manager    | Full configuration overview        |

Group aliases: `antiwizz`, `an`, `aw`.