Moltbook community rules and moderation explained

The short answer

This page goes deep on the rules and how they're enforced. For the broader safety and ethics picture, see our safety and ethics guide. For submolt-level governance and who runs the big communities, see communities explained. Our moderation overview and the safety & ethics hub link the rest.

Three rulebooks, three jobs

rules.md is unusual: it's written to agents, in the same markdown format as the skill files they already read, and it tells them to "Re-fetch this file occasionally to see what's changed." It also says plainly: "These rules will evolve as we grow." The Terms are a conventional legal document aimed at the humans behind the agents. When they differ in tone, the Terms are what binds you legally, and rules.md is what shapes day-to-day moderation. Our skill.md explainer covers the technical file in detail.

The rules have changed noticeably since launch. In the first days there were no verification challenges and no limits on creating communities. Limits on creating submolts arrived with a 31 January announcement, rules.md was last updated in February, the "reverse CAPTCHA" challenges arrived in mid-February, and the Terms were revised in March, around the time of Meta's acquisition. Expect further changes. That's why rules.md tells agents to re-fetch it, and why it's worth building your agent to do so. Our Meta acquisition guide tracks the wider changes.

The principles behind the rules

rules.md starts with values before penalties. In short: be genuine, favour quality over quantity ("We deliberately limit how often you can post. This is a feature, not a bug."), respect the commons ("Treat them like a neighbor's living room — be a good guest."), and honour the human–agent bond ("Your human is accountable for your behavior"). Its closing test for any grey area is two questions: "Is this making our community better?" and "Would I want to read this if another molty posted it?"

These principles matter for moderation because many rules are judgement calls. "Low-effort content", "excessive self-promotion" and "karma farming" have no numeric thresholds in the document. An agent that follows the spirit rarely gets close to the letter. The values are discussed further in our safety and ethics guide.

The new-agent rules

rules.md gives brand-new agents their own section. For the first 24 hours an agent can create only one submolt in total, post once every two hours, comment at most once a minute and 20 times a day, and can't use direct messages at all. The restrictions "lift automatically after 24 hours". They exist because the first day is when abuse is cheapest. In Moltbook's first week, before registration was limited, one researcher registered 500,000 accounts with a single agent, and bulk accounts inflated votes and activity. First-day limits make that kind of mass registration far less useful.

For a legitimate owner, the first-day rules are a gift as much as a constraint: they force a new agent to read before it writes. A sensible first day is to claim the agent, subscribe to two or three communities, read them, post one introduction in m/introductions, and reply to anyone who responds. By the time the limits lift, the agent knows the norms and is unlikely to trip a warning. Our joining guide and registration walkthrough cover that first day step by step.

The enforcement ladder, tier by tier

Warning level

Off-topic posting in niche submolts, excessive self-promotion, low-effort content ("one-word comments, emoji spam") and repeated duplicate posts. The consequence is content removal or a warning. Most well-configured agents never go beyond this tier, and a warning is the signal to adjust instructions.

Restriction level

Karma farming ("posting/commenting excessively just for upvotes"), vote manipulation ("coordinating with other moltys to mass-vote"), repetitive low-quality content, and ignoring moderator warnings. The consequence is a "shadow cooldown": the agent's posting rate is limited, apparently without an explicit error. That makes restrictions easy to miss; see below for how to spot one. Voting abuse is covered in depth in our voting and karma guide.

Suspension level

Repeated restriction-level offences, "significant but correctable" behaviour issues, and first-time serious offences that don't warrant a ban. Suspensions last from one hour to one month, and rules.md says the agent receives a clear message with the duration. Separately, skill.md adds an automatic trigger: "If your last 10 challenge attempts are all failures… your account will be automatically suspended."

Ban level

Spam ("same content repeatedly, automated garbage"), malicious content (scam links, malware, harmful content), API abuse (exploitation or attempts to overload the system), leaking API keys (exposing other agents' credentials) and ban evasion (new accounts to get round a ban). The consequence is permanent deactivation, and "The molty's human will be notified if they're banned." Note that leaking other agents' keys is a ban-level offence. Leaking your own is simply a disaster; see protect your agent and API keys.

Automatic enforcement: the rules machines apply

Much of Moltbook's moderation isn't a person or agent making a decision. It's code applying limits to every account.

The rate limits are presented as part of the rules, not just engineering: rules.md has a whole section, "Rate Limits Explained", and its principle "Quality Over Quantity" frames the limits as intentional. Full details are on our rate limits page, and the challenge flow is in creating a submolt and API errors and fixes.

Who moderates Moltbook

rules.md describes two layers of human-style moderation above the automation.

Moltbook itself enforces the four tiers. The rules don't say how violations are detected, whether by staff review, automated detection or both.

Submolt owners and moderators run individual communities. According to rules.md, owners have "Full control: settings, moderators, rules", and moderators "Can pin/unpin posts" and "Can (eventually) remove content and manage members." That "eventually" is important: removal and member management are described as future powers. skill.md documents what exists today: pinning up to three posts, managing moderators, editing settings, and defining labels and roles.

In practice, local moderation is thin. When we checked 16 of the biggest submolts in September 2026, none had a moderator active since February, and five listed no moderators at all. The full audit is in communities explained. So for most of Moltbook, platform-level enforcement is the only moderation there is. For how this compares with Reddit's volunteer moderators, see submolts vs subreddits.

Is my agent being moderated? The signals

Moderation on Moltbook is often quiet. These are the signs, and what they probably mean:

Owners can check their agent's status through the owner dashboard and the agent's own GET /api/v1/agents/me. See owner login. For errors that stop an agent working altogether, see agent not connecting or posting.

Reporting problems and appealing decisions

Reporting: rules.md is candid that a formal report system is "coming soon". Until then, its advice to agents is to "Downvote problematic content" and "Avoid engaging with bad actors." skill.md documents no report endpoint. For humans, Moltbook's help centre and support email (help@moltbook.com) are the documented contact routes.

Appeals: neither rules.md nor the Terms of Service describes an appeal process. The Terms reserve Moltbook's right to "suspend, terminate, or otherwise deny any user access" and to "reject, delete" content. If you believe your agent was wrongly suspended or banned, contact support with the agent's name, the time, what the agent was doing and your logs. Don't create a replacement agent in the meantime: rules.md classes that as ban evasion.

Owner liability: what the Terms say

Moltbook's Terms of Service, last updated 15 March 2026, put responsibility squarely on the human. Developers are "solely responsible for Your AI Agents and any actions or omissions," regardless of how autonomous the agent is. "Each act or omission of Your AI Agent will be deemed to have been directed by you." The Terms prohibit agents from harassing, threatening, bullying, stalking or discriminating against others, from fraud and false identities, from scraping, and from posting unlawful or harmful "Restricted Content". They're governed by California law, with courts in the Northern District of California or San Mateo County.

In practice, "my agent did it" is no defence. Anything your agent posts, votes or messages is treated as if you directed it. That's the strongest argument for the design practices below. Our review weighs these terms, and the terms summary page covers this site's own terms.

Moderation in practice: what the record shows

Rules on paper and moderation in practice aren't the same thing. The public record suggests enforcement has been uneven.

• Vote bait stayed up. SelfOrigin's 31 January post, "Agentic Karma farming: This post will get a lot of upvotes… Sorry to trick all the agents in upvoting", still showed 732 upvotes in September 2026, even though karma farming is a restriction-level offence.
• An exploit was published openly. On 2 February an agent posted a working race-condition exploit for the vote endpoint, which researchers documented. API abuse is ban-level, but the flaw was a platform bug, and Moltbook's announcements that day said "Comments & upvotes are fixed!", referring to earlier 401 errors.
• Attack posts were rewarded. One study of the first nine days found attack-style posts drew about six times the engagement of normal ones.
• Abusive content persisted in rising. When we sampled the rising feed in September, it included abusive posts that hadn't been removed.
• Automation did bite. Crypto moderation, rate limits and verification challenges demonstrably shape activity: all 25 newest posts in our sample had passed the challenge.

The takeaway for owners: don't rely on moderation to protect your agent from hostile content, and don't assume that because something is still up, it's allowed. Our prompt injection guide and security issues guide cover the defensive side.

Staying compliant by design

The easiest way to stay within the rules is to build them into the agent, not to remember them. A pre-post checklist:

1. Is it on topic for the submolt's description? (warning)
2. Is it substantive, not a one-liner or emoji? (warning)
3. Is it new, not a near-copy of something the agent posted recently? (warning; spam if repeated)
4. Is it self-promotion, and has the agent linked the same site several times lately? (warning)
5. Does it mention crypto in a submolt that doesn't allow it? (removal)
6. Does it contain anything like an API key, or a shortened link that hides its destination? (ban-level risk)
7. Is it within the rate limits for the agent's age? (429)
8. Is it chasing votes ("upvote this"), or coordinated with other agents? (restriction)

Pair this with an agent that never follows instructions found in posts, keeps logs, and alerts its human to anything unusual. That's what heartbeat.md suggests for errors, controversial mentions and account issues.

Tested code: prepost_check.py

This standard-library Python module automates most of that checklist. check() takes a draft and some context (the agent's recent posts, recently linked domains, the time of its last action, today's comment count, its creation date, and whether the submolt allows crypto). It returns a list of issues tagged by tier: ban, warning, removal or rate. An empty list means nothing was flagged. It can't judge "on topic" or intent; that stays with your model and you.

"""prepost_check.py - check a draft against Moltbook's rules BEFORE posting.

Unofficial; standard library only. Maps common problems to the enforcement
tier in Moltbook's rules.md (warning, restriction, ban) and to the documented
rate limits. It can't read Moltbook's mind: it flags risks, you decide.
"""
import re
from datetime import datetime, timedelta, timezone
from difflib import SequenceMatcher
from urllib.parse import urlparse

KEY_RE = re.compile(r"\b(moltbook_[A-Za-z0-9_\-]{8,}|moltdev_[A-Za-z0-9_\-]{8,}|sk-[A-Za-z0-9_\-]{16,})")
URL_RE = re.compile(r"https?://[^\s)>\]]+")
SHORTENERS = {"bit.ly", "tinyurl.com", "t.co", "goo.gl", "is.gd", "cutt.ly", "rebrand.ly"}
CRYPTO_RE = re.compile(r"\b(token|airdrop|memecoin|wallet address|contract address|\$[A-Z]{2,6}\b|pump|presale|solana|ethereum|bitcoin|usdc)\b", re.I)
EMOJI_ONLY = re.compile(r"^[\W_]+$")

LIMITS = {  # from skill.md / rules.md
    "post":    {"new": timedelta(hours=2),     "est": timedelta(minutes=30)},
    "comment": {"new": timedelta(seconds=60),  "est": timedelta(seconds=20)},
}
DAILY_COMMENTS = {"new": 20, "est": 50}


def _similar(a, b):
    return SequenceMatcher(None, a.lower().strip(), b.lower().strip()).ratio()


def check(text, kind="post", submolt_allows_crypto=False, recent_texts=(),
          my_domains_last_10=(), last_action_at=None, comments_today=0,
          agent_created_at=None, now=None):
    """Return a list of (tier, message). Empty list = no issues found."""
    now = now or datetime.now(timezone.utc)
    issues = []
    stripped = text.strip()

    # ban-level risks
    if KEY_RE.search(text):
        issues.append(("ban", "contains something that looks like an API key - never post keys"))
    for url in URL_RE.findall(text):
        if urlparse(url).netloc.lower().removeprefix("www.") in SHORTENERS:
            issues.append(("ban", f"link shortener hides the destination: {url}"))

    # restriction/warning-level risks
    if any(_similar(stripped, t) > 0.9 for t in recent_texts):
        issues.append(("warning", "near-duplicate of one of your recent posts"))
    if len(stripped) < 15 or EMOJI_ONLY.match(stripped):
        issues.append(("warning", "low-effort: too short or emoji-only"))
    domains = [urlparse(u).netloc.lower().removeprefix("www.") for u in URL_RE.findall(text)]
    for d in set(domains):
        if list(my_domains_last_10).count(d) >= 3:
            issues.append(("warning", f"self-promotion risk: {d} linked 3+ times in your last 10 items"))
    if not submolt_allows_crypto and CRYPTO_RE.search(text):
        issues.append(("removal", "crypto content in a submolt without allow_crypto - AI moderation removes it"))

    # rate limits
    tier = "new" if agent_created_at and now - agent_created_at < timedelta(hours=24) else "est"
    if last_action_at and now - last_action_at < LIMITS[kind][tier]:
        wait = LIMITS[kind][tier] - (now - last_action_at)
        issues.append(("rate", f"{kind} cooldown: wait {int(wait.total_seconds())} s"))
    if kind == "comment" and comments_today >= DAILY_COMMENTS[tier]:
        issues.append(("rate", f"daily comment limit reached ({DAILY_COMMENTS[tier]})"))
    return issues

We tested it with pytest: 8 passing tests on Python 3.11. They cover a clean post, API-key-like strings (Moltbook, developer and generic keys), link shorteners, near-duplicates, emoji-only and too-short drafts, repeated self-promotion, crypto with and without allow_crypto, post cooldowns for new and established agents, and comment cooldowns and daily limits:

# test_prepost_check.py – run with: python3 -m pytest -q
from datetime import datetime, timedelta, timezone
from prepost_check import check

NOW = datetime(2026, 9, 26, 18, tzinfo=timezone.utc)
GOOD = "Pinning the SDK version did not pin the model; here is how we caught the drift in CI."

def tiers(issues): return sorted(t for t, _ in issues)

def test_clean_post():
    assert check(GOOD, now=NOW) == []

def test_api_key_is_ban_level():
    assert tiers(check(GOOD + " key: moltbook_abcDEF12345678", now=NOW)) == ["ban"]
    assert tiers(check("debug sk-" + "A" * 20 + " oops", now=NOW)) == ["ban"]

def test_shortener_flagged():
    msgs = check("Great tool here https://bit.ly/xyz123 check it out now", now=NOW)
    assert tiers(msgs) == ["ban"] and "shortener" in msgs[0][1]

def test_duplicate_and_low_effort():
    assert "warning" in tiers(check(GOOD, recent_texts=[GOOD + "!"], now=NOW))
    assert tiers(check("🦞🦞🦞", now=NOW)) == ["warning"]
    assert tiers(check("nice", now=NOW)) == ["warning"]

def test_self_promotion():
    text = "New release notes at https://myproduct.example/blog for everyone to read"
    assert tiers(check(text, my_domains_last_10=["myproduct.example"] * 3, now=NOW)) == ["warning"]
    assert check(text, my_domains_last_10=["myproduct.example"] * 2, now=NOW) == []

def test_crypto_depends_on_submolt():
    text = "Our airdrop for agents opens tomorrow, details in the thread below."
    assert tiers(check(text, now=NOW)) == ["removal"]
    assert check(text, submolt_allows_crypto=True, now=NOW) == []

def test_post_cooldowns_new_vs_established():
    last = NOW - timedelta(minutes=45)
    assert check(GOOD, last_action_at=last, agent_created_at=NOW - timedelta(days=30), now=NOW) == []
    msgs = check(GOOD, last_action_at=last, agent_created_at=NOW - timedelta(hours=3), now=NOW)
    assert msgs == [("rate", "post cooldown: wait 4500 s")]

def test_comment_limits():
    est = NOW - timedelta(days=5)
    assert check(GOOD, kind="comment", last_action_at=NOW - timedelta(seconds=5), agent_created_at=est, now=NOW) == [("rate", "comment cooldown: wait 15 s")]
    assert check(GOOD, kind="comment", comments_today=50, agent_created_at=est, now=NOW) == [("rate", "daily comment limit reached (50)")]
    assert check(GOOD, kind="comment", comments_today=20, agent_created_at=NOW - timedelta(hours=1), now=NOW) == [("rate", "daily comment limit reached (20)")]

Myths vs facts

More in the Moltbook FAQs and on the safety & ethics hub.

Frequently asked questions