# Vetox AI — capabilities reference > Six distinct AI systems, what each one does, where it sits in the moderation chain, and how they differ from the rule-based layer beneath them. - Canonical: https://discordtools.blog/blog/vetox-ai-capabilities - Published: 2026-08-30 - Author: The Index desk - Facts checked: 2026-08-30 - Sources: - vetox.io/ai — AI capability overview (https://vetox.io/ai) — checked 2026-08-30 - docs.vetox.io — AI Auto-Mod (https://docs.vetox.io/en/moderation/ai-auto-mod) — checked 2026-08-30 - docs.vetox.io — AI Server Control (https://docs.vetox.io/en/moderation/ai-server-control) — checked 2026-08-30 - docs.vetox.io — feature limits by tier (https://docs.vetox.io/en/premium/feature-limits) — checked 2026-08-30 - Publication: The Index, an independent site not affiliated with Discord Inc. --- Most Discord bots that advertise AI do one thing with it. Vetox runs AI across two purpose-built systems — **AI Auto-Moderation** and **AI Server Control** — funded by one shared token wallet, **AI Usage**, that meters both. Between them they cover ten independent content-classification categories and 182 discrete administrative tools across 27 categories. Vetox's own materials group the classification side into user-facing labels — Intelligent Auto-Mod, Toxicity Detection, the Advanced Anti-Scam Shield, Scam Pattern Recognition — and the administration side as AI Commands & Control, plus Raid Lockdown for the join-time defence described below. Mechanically, the first four are categories inside one classifier; the fifth is a separate deterministic engine; the sixth is the 182-tool agent. Worth separating them, because "does it have AI" is the wrong question and "which of these do I need" is the right one. ## AI Auto-Moderation Reads what a message _means_ rather than which words it contains. Every scanned message — and, if enabled, its images and the author's username — goes to a classifier that returns one of ten categories, a confidence score from 0–100, and (on a match) a severity label. The server's own configuration decides whether that score crosses a threshold and which action set fires. It runs alongside, not instead of, Vetox's deterministic Auto-Mod. **The ten classification categories**, each independently switched on or off with its own action set and its own confidence threshold: | Category | What it catches | Ships enabled? | | ------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------- | | Harassment | Severe or sustained targeted abuse, bullying, threats against a person, sexual harassment of an adult — a single mild put-down is explicitly excluded | Off | | Hate | Slurs, attacks or dehumanisation aimed at a protected group (race, ethnicity, religion, nationality, gender, sexuality) | Off | | Sexual content | Explicit sexual content or requests, links to adult sites — suppressed in Discord age-gated channels | Off | | Sexual content involving minors | Any sexualisation of minors — always treated as severe, and never suppressed by channel settings | **On** — the only category enabled by default | | Violence | Credible threats or graphic violence — competitive trash-talk is explicitly excluded | Off | | Self-harm | Suicide or self-harm encouragement or intent | Off | | Illicit goods | Drugs, weapon sales, other clearly illegal goods or services | Off | | Scams and phishing | Fake giveaways, crypto "doublers", fake-Nitro scams, phishing, brand impersonation — a normal link to a known site is explicitly not a scam | Off | | Profanity | Crude language or swearing not targeted at anyone | Off | | Advertising | Unsolicited self-promotion, "join my server", paid shoutouts | Off | The classifier is instructed to decode filter-evasion tactics before judging — leetspeak, Franco-Arabic transliteration, homoglyphs, zero-width characters, deliberate letter-spacing — and to work in whatever language the message is written in, which is what makes it a genuinely different tool from a keyword list rather than a bigger one. Each category fires one action or a combination from seven: **delete, warn, timeout, mute, kick, ban, alert-only.** Only three combinations are refused — kick+ban, alert-only+ban, alert-only+kick — every other combination stacks, so "delete and timeout" or "warn and mute" are both valid single settings. **Custom rules** let a server describe a policy in its own words — "no advertising other servers, but sharing a friend's stream link in #showcase is fine" — with its own action and its own confidence threshold, evaluated ahead of the ten built-in categories. Black tier carries 25 custom rules. **Escalation** turns repeated infractions into an automatic ladder: up to 20 steps, each firing at a configured infraction count (1–99) within a rolling decay window (1–30 days, default 7), with durations up to one year. A member's count resets once they age out of the window. **Trust Tiers** is the cost-control layer, off by default. A member who stays clean earns a trust score; once they cross the trusted threshold (5–1,000 points, default 50) the system samples their messages instead of scanning every one — a sample rate of 2–100 with a default of 10, meaning roughly 1 in 10 messages by default once trusted. Four safeguards keep sampling from becoming a blind spot: links, invites, `@everyone`/`@here`, five-or-more mentions, and message bursts always scan regardless of trust; the sample rate can never drop below 1-in-2; a single caught violation resets the member's trust to zero and scanning resumes at 100%; and a member with no trust history yet is scanned on every message. **Two operating modes.** `monitor` logs what the classifier would have done, with a daily digest to a log channel, and takes no action — the calibration mode every server starts in. `enforce` actually applies the configured actions. Deletion happens immediately when a rule matches; kick and ban wait for a staff confirmation button by default, so the model's most consequential calls have a human in the loop unless a server deliberately turns that off. **Administrators are never scanned**, at any confidence level, on any category. ## AI Commands & Control The administration interface, rather than a moderation layer. A permitted member @-mentions the bot and describes what they want in plain language; the agent plans the task, calls Discord API tools to carry it out, and reports back either inside a dedicated thread or as a reply, depending on the server's trigger mode. It exposes **182 tools across 27 categories**: | Category | Tools | Category | Tools | | ---------------- | ----- | ------------------------------------ | ----- | | Messaging | 20 | Emojis | 5 | | Threads | 16 | Native AutoMod rules | 5 | | Moderation | 16 | Server widget | 4 | | Channels | 13 | Polls | 4 | | Roles | 12 | Application emojis (Custom Bot only) | 4 | | Server settings | 9 | Info / lookups | 3 | | Webhooks | 8 | Safety incidents | 3 | | Members | 8 | Welcome screen | 2 | | Voice | 7 | Vanity URL | 2 | | Forums | 7 | Role-connection metadata | 2 | | Templates | 6 | Onboarding | 2 | | Stickers | 6 | Integrations | 2 | | Scheduled events | 6 | | | | Soundboard | 5 | | | | Invites | 5 | | | Concretely that covers: creating, editing, cloning, deleting, locking, unlocking, reordering and re-parenting channels; creating, editing, deleting, reordering and assigning roles, and managing permission overwrites; ban, unban, softban, kick, timeout, nickname, voice-move and voice-disconnect; sending, editing, replying to, forwarding, pinning, reacting to, purging and fetching messages, plus DMs and webhook messages; threads and forum posts and tags; scheduled events and stage instances; emojis, stickers and soundboard sounds; invites; native Discord AutoMod rules; polls; onboarding, welcome screen, widget, vanity URL, safety-incident settings, integrations and server templates. **How it stays safe on a live server** — every guardrail below is enforced in code, not by instruction alone: - **Deny-by-default access.** Only the server owner, an Administrator, or a member on an explicit allow-list may invoke it — an admin can also widen or narrow that list per role or per member. - **Per-tool permission re-check.** Every tool declares the Discord permission it needs, and that permission is checked against the _requester_, not just the bot — talking to the AI never lends it your permissions. - **Protected roles and channels.** A server marks specific roles or channels as protected; no tool call can act on a protected target, under any phrasing, even with confirmation. - **A hard ceiling on destructive scope.** No single destructive call can target more than 10 items, and there is no delete-all, ban-all or kick-all capability at any scope. - **Unconditional human confirmation.** Every destructive action — delete, ban, kick, timeout, prune and anything else flagged destructive — is queued rather than executed, and posts one card listing every queued action with a single Confirm/Cancel button pair. There is no setting to turn this off. - **Requester-only, one-shot confirmation.** Only the person who made the request can press Confirm, the batch is consumed atomically so a double-click can't run an action twice, and access is re-checked live at the moment of confirmation — revoking someone's access invalidates anything of theirs still pending. - **A cap of 25 destructive actions in a single run.** - **Channel scope.** A server can restrict the whole feature to an allow-list or deny-list of channels, so the agent never even sees activity outside its intended area. - **The model never reveals what powers it.** Vetox's AI identifies itself only as "Vetox's AI assistant" — a deterministic output filter, not just an instruction, replaces the entire reply if a vendor or model name would otherwise surface. Hard run limits: 8 agent steps per request, a 90-second run budget, one AI session in flight per user and up to four running concurrently per server. ## AI Usage — the shared token wallet Both systems draw from one pool per server, reported and topped up from a single dashboard page. - **Monthly grant:** 10,000,000 tokens on Black, refilling on a rolling 30-day window measured from the last reset — not a calendar month, so the cycle length is identical whether the subscription is billed monthly or yearly. - **Paid top-up:** $1.00 per 500,000 tokens, purchased in 1–100 unit increments (dashboard presets: 1, 5, 10, 25, 50, 100), charged through Paddle and credited once payment is confirmed. - **Spend order.** The monthly grant is drawn down first; top-up tokens are only touched once the grant is exhausted, and a purchased top-up is not reset by the 30-day window rolling over. - **What the dashboard shows:** current balance, tokens used today and this month, a usage chart across 7/14/30-day windows, the top token-consuming members, and a full request log — including, for AI Server Control, a per-tool outcome for every step of every run. - Both AI features check the same balance before running, so a server has one number to watch instead of two, and one place to buy more. ## Where AI sits relative to the rule-based layer Vetox runs rule-based Auto-Mod, Protection and Anti-Raid independently of the two AI systems above, and this layering is the important architectural point: ``` Discord AutoMod platform level, before delivery ↓ Vetox Auto-Mod rule-based: keywords, regex, link filters ↓ Vetox Protection spam, mention limits, invite filtering ↓ Vetox Anti-Raid join-rate detection and per-account screening — deterministic, no AI involved ↓ Vetox AI Auto-Mod intent, tone, trust scoring, visual scam analysis ``` Each layer catches what the one above cannot express. Deterministic rules handle the deterministic cases cheaply, for free, and on every tier; the AI layer handles what a rule cannot state, and is billed against the token wallet above. That ordering is also why the rule-based layer is not made redundant by the AI one: it is faster, free, and every message it resolves is one the AI layer never has to consider. What Vetox's own site calls **Raid Lockdown** is this same deterministic Anti-Raid engine — join-rate thresholds and the per-account Join Guard screen described in the [Anti-Raid reference](/blog/vetox-anti-raid-reference) — surfaced under the AI page because it is part of the same automated-defence story, not because a model is involved in the decision. ## Availability AI access is a single Black-tier gate (`aiAccess`, tier 3) covering AI Auto-Moderation, AI Server Control, the monthly token allowance and AI custom rules together — there is no way to buy one without the others. The gate is enforced on read requests as well as writes, so a downgraded server's stored AI history stops being viewable, not only editable. Two details worth stating plainly: - **Custom Bot does not grant AI.** It is an add-on flag alongside your tier, and every AI check reads the tier alone. **Max+ is tier 2 and has no AI access.** Only Black and Black+ do. - **AI Auto-Mod custom rules** are 25 on Black and 0 on every tier below, including Max. Everything else in the moderation stack — rule-based Auto-Mod, Protection, Moderation Tools, Logging — is available well below that gate, with Anti-Raid unlocking at Basic and the rest free on Starter. ## Commands Neither AI system has a slash command. AI Auto-Mod is silent to end users apart from an optional warning message and the staff confirmation prompt on kick/ban; AI Server Control's only interactive surface is the @-mention trigger, the session thread it opens, and the Confirm/Cancel buttons on a queued action card. ## Dashboard surface - `/server/:id/ai-auto-mod` — four tabs: General (mode, sensitivity, image/username scanning, warning message), Detection (the ten categories plus custom rules), Enforcement (escalation, decay window, confirmation requirement, channels, exemptions), and Trusted (the Trust Tiers policy and the trusted-member list). - `/server/:id/ai-control` — four tabs: General (trigger mode, private-thread setting, persona), Access (the allow-list and permission-bypass roles), Tools (all 27 categories with per-tool switches, destructive tools flagged), and Scope (channel allow/deny-list plus protected roles and channels). - `/server/:id/ai-usage` — Overview (balance, spend, the usage chart, top consumers, top-up) and Activity (the full request log). ## What connects to what AI Auto-Mod and AI Server Control are not islands. Both draw from AI Usage, and their actions flow into the same systems as manual moderation: - **AI Usage** meters every scan and every agent run against one wallet; a low balance pauses AI Auto-Mod scanning and pauses new AI Server Control runs before either would fail mid-action — both fail safe rather than degrading silently. - **Logging** records AI actions alongside human ones, so a member's history is one timeline rather than two. - **Dashboard Watcher** records configuration changes, including to AI rules. - **Access Control** governs which staff can change AI configuration at all — relevant because an AI rule or an agent allow-list entry is a higher-consequence setting than a wordlist entry. - **Moderation Tools** is where the resulting cases are reviewed and actioned. - **Native Discord AutoMod** is itself one of AI Server Control's 27 tool categories — the agent can create and edit Discord's own platform-level AutoMod rules, distinct from both Vetox Auto-Mod and AI Auto-Mod. The chain worth understanding as a whole: `Auto-Mod → AI Auto-Mod → Protection → Anti-Raid → Logging → Dashboard Watcher → Access Control`, funded where relevant by AI Usage. ## Who this is for **Communities in more than one language.** A wordlist is per-language and maintaining several is impractical. Classification that reasons about meaning rather than matching strings is the strongest single argument for the AI layer, and it runs in whichever of Vetox's 21 supported languages the server uses. **Servers targeted by scams.** Trading, crypto, NFT and giveaway-adjacent communities receive image-based scams continuously, and the visual classification pass is the only layer that reads a screenshot rather than the text around it. **Servers where tone is the problem, not vocabulary.** Communities that have outgrown wordlists because the hostility is grammatical rather than lexical. **Administrators who restructure often.** AI Server Control earns its place where server structure changes regularly — new sections, new roles, new permission schemes — rather than being set once and left alone. ## Practical use cases - A member's trust score falls over several days of escalating tone; Trust Tiers stops sampling them and every message is scanned again before an incident, not after. - A reworded "free Nitro" giveaway message is caught by the Scams and Phishing category even though the exact wording has never been seen before, because the classifier judges intent rather than matching a phrase. - A screenshot of a fake crypto-doubler is filtered on upload — the image-analysis pass catches what a text filter structurally cannot. - "Create a private #staff-lounge category visible only to the Moderator role and above, matching the permission set on #staff-chat" — a multi-step administrative task executed as one instruction. - "Delete the four leftover event channels from last month" — queued on a confirm card naming the exact four channels, executed only once the requester presses Confirm, and refused outright if any of them is on the protected list. - A server runs AI Auto-Mod in `monitor` mode for a week, reads the daily digest, adjusts per-category thresholds, then switches to `enforce` once the false-positive rate looks right. ## Related Rule-based Auto-Mod configuration sits beneath all of this, and Discord's own platform AutoMod sits beneath that. Configure upward from the free layers — each one resolves cases the layer above never has to see. See also the [Anti-Raid reference](/blog/vetox-anti-raid-reference) for the deterministic join-time engine, and the [permissions reference](/blog/discord-bot-permissions-reference) for how Discord's own role hierarchy governs what any of these actions can actually do.