Table of Contents
- Non-Goals
- Captcha bypass
- Follower / engagement inflation
- Scraping other communities
- Multi-account / multi-token rotation
- A moderation ML model
- Message automation that impersonates humans
- A standalone web UI / dashboard
- Callback API server hosting
- Storing tokens anywhere except config
- Cross-platform publishing
- Analytics beyond stats.get
- Auto-approving join requests by default
- Guaranteed delivery of notifications
- Compliance tooling
Non-Goals
Explicitly out of scope. If a request lands here, the answer is "no, and here is why".
Captcha bypass
VK's captcha exists to stop automation. This plugin surfaces VK_CAPTCHA_REQUIRED with the captcha_sid and, at most, asks a human through the approval channel. It will not integrate a solver, an OCR pipeline, or a third-party captcha service. Automated solving is a ToS violation and a good way to get a token permanently banned.
Follower / engagement inflation
No tool grows subscribers, likes, reposts, views or comments artificially. No tool posts on a schedule to game the algorithm beyond a normal editorial calendar. No tool buys engagement.
Scraping other communities
VK's API gives you your own community. It does not give you another community's member list, ban list, stats, or private messages. The plugin does not scrape the web UI to work around that. If you need competitive analysis, use public data through public methods.
Multi-account / multi-token rotation
One plugin instance = one community = one token pair. Running ten communities means ten profile rows, each with its own config. There is no built-in token pool, no rotation on rate limit, no per-request account switching — all of those are ban vectors.
A moderation ML model
The engine is keyword/regex/structural. No classifier, no embedding similarity, no LLM-in-the-loop moderation. Reasons: predictability, auditability, cost, and latency. If you want semantic moderation, the agent can be asked to review a batch of flagged items — that is a tool call, not an automatic action.
Message automation that impersonates humans
vk_messages_send sends as the community. There is no tool to send as a user, no tool to fake typing state, no tool to auto-reply with human-like delays designed to defeat detection. Auto-replies to a keyword are supported through the moderation engine's notify action, which is a community-level response, not impersonation.
A standalone web UI / dashboard
The plugin contributes panels and cards inside the DSH Web client. It does not ship a separate web app, a separate auth system, or a separate database. State lives in ctx.storage.
Callback API server hosting
vk_callback_manage configures Callback servers on VK's side. The plugin does not host the HTTPS endpoint, does not provide a tunnel, and does not terminate TLS. If you enable Callback, you bring the endpoint.
Storing tokens anywhere except config
No token vault, no encryption-at-rest feature, no token rotation service. Tokens come from environment variables through !!js process.env.X. If you need a secrets manager, use one outside the plugin.
Cross-platform publishing
This plugin is VK-only. It will not post to Telegram, Odnoklassniki, or anywhere else. Cross-posting belongs in a separate plugin that composes both.
Analytics beyond stats.get
No cohort analysis, no funnel building, no custom dashboards over historical data. vk_stats_get returns what VK returns for the requested period. Anything richer is the agent's job with the data it has, not the plugin's.
Auto-approving join requests by default
moderation.autoApprove exists and defaults to false. Turning it on is a deliberate, documented risk: a community that auto-approves every request is a spam target. It is not the recommended path and the wiki says so.
Guaranteed delivery of notifications
LongPoll delivery is best-effort. Events missed while the plugin is unloaded are recovered only as far as ts persistence allows. The plugin does not implement a durable event queue with replay-on-start beyond what VK's ts window provides.
Compliance tooling
No GDPR export, no data retention policy engine, no consent tracking. Those are the community operator's responsibility, not a plugin's.