Reddit (prmichaelsen) MCP Server
@prmichaelsen/reddit-mcp
npm
v0.1.1
Published by @prmichaelsen — no publish provenance and no public repository, so the publisher could not be verified and the source cannot be independently located.
MCP server wrapping the Reddit API for AI agents
The grade answers one question — how safe is this server for you to adopt — so it is computed in two auditable stages. Nothing below is an opinion or an LLM's guess; every line is a real term the deterministic engine applied, and the same input always yields the same number.
1. Threat score — 100 − 0 = 100. What the published surface and source actually contain:
The deterministic scan raised no scored threat in the surface it inspected — the threat score stayed at 100. Capability observations and advisory notes are recorded but never lower it.
2. Client adoption risk — 100 − 8 = 92. Three small, subtract-only factors that reflect your risk in adopting it — a clean scan proves less on a powerful, unverified or barely-inspectable package, so the grade says so plainly:
| Points | Adoption-risk factor |
|---|---|
| −6 | capability blast radius (high) — client exposure if the model is manipulated |
| −2 | publisher verification (unlinked) — no provenance/repo link, but the shipped source was fully read |
Capability observations and info notes are shown under Findings but never scored.
Open any row's finding below for the file, line and evidence behind a deduction.
Findings 6
high Dynamic code execution in server code (dist/factory.js)MTC-SRC-001
In the server's implementation (`dist/factory.js:2942`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); const v
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/factory.js
high Dynamic code execution in server code (dist/index.js)MTC-SRC-001
In the server's implementation (`dist/index.js:2942`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); const v
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/index.js
high Dynamic code execution in server code (dist/server.js)MTC-SRC-001
In the server's implementation (`dist/server.js:2942`): Evaluating strings as code is the most direct RCE primitive; if any tool input reaches it, the server executes attacker-chosen code. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); const v
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/server.js
high Shell/command execution in server code (esbuild.build.js)MTC-SRC-002
In the server's implementation (`esbuild.build.js:2`): Spawning a shell/process is command-execution capability; with unsanitized tool input it is command injection / RCE. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: port { execSync } from "child_process"; await build({ entryPoints: ["src/index.ts", "src/server.ts", "src/factory.ts"
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server esbuild.build.js
medium Hardcoded egress to an external endpoint (dist/index.js)MTC-SRC-003
In the server's implementation (`dist/index.js:31711`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const response = await fetch( "https://www.reddit.com/api/v1/access_token", { method: "POST",
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server dist/index.js
medium Hardcoded egress to an external endpoint (src/auth/oauth.ts)MTC-SRC-003
In the server's implementation (`src/auth/oauth.ts:27`): A hardcoded outbound call to a fixed external host inside server code is a classic exfiltration/telemetry channel — especially paired with reads of local data. This is read from the code itself — not from the tool description — so a poisoned server cannot hide it behind honest-looking metadata.
Evidence: const response = await fetch( "https://www.reddit.com/api/v1/access_token", { method: "POST",
Fix: Review this call path: confirm it never receives unsanitized tool input, constrain it, or remove it. Treat a server whose code reaches these sinks as high-capability regardless of what its tools claim.
Location: server src/auth/oauth.ts
Tools 88
Each tool and what it can reach — statically extracted from the published source.
reddit_read_messageingests untrusted inputreddit_unread_messageingests untrusted inputreddit_approveno sensitive capabilityreddit_bannedno sensitive capabilityreddit_block_userno sensitive capabilityreddit_commentno sensitive capabilityreddit_comments_threadno sensitive capabilityreddit_composeno sensitive capabilityreddit_contributorsno sensitive capabilityreddit_del_msgno sensitive capability
Show 78 more tools ↓
reddit_deleteno sensitive capabilityreddit_distinguishno sensitive capabilityreddit_duplicatesno sensitive capabilityreddit_editno sensitive capabilityreddit_editedno sensitive capabilityreddit_hideno sensitive capabilityreddit_ignore_reportsno sensitive capabilityreddit_inboxno sensitive capabilityreddit_infono sensitive capabilityreddit_link_flairno sensitive capabilityreddit_listings_bestno sensitive capabilityreddit_listings_controversialno sensitive capabilityreddit_listings_hotno sensitive capabilityreddit_listings_newno sensitive capabilityreddit_listings_risingno sensitive capabilityreddit_listings_topno sensitive capabilityreddit_lockno sensitive capabilityreddit_mark_nsfwno sensitive capabilityreddit_meno sensitive capabilityreddit_me_blockedno sensitive capabilityreddit_me_friendsno sensitive capabilityreddit_me_karmano sensitive capabilityreddit_me_prefsno sensitive capabilityreddit_me_prefs_updateno sensitive capabilityreddit_me_trophiesno sensitive capabilityreddit_moderatorsno sensitive capabilityreddit_modlogno sensitive capabilityreddit_modqueueno sensitive capabilityreddit_more_childrenno sensitive capabilityreddit_multi_add_subno sensitive capabilityreddit_multi_createno sensitive capabilityreddit_multi_deleteno sensitive capabilityreddit_multi_getno sensitive capabilityreddit_multi_mineno sensitive capabilityreddit_multi_remove_subno sensitive capabilityreddit_multi_updateno sensitive capabilityreddit_mutedno sensitive capabilityreddit_removeno sensitive capabilityreddit_reportno sensitive capabilityreddit_reportsno sensitive capabilityreddit_saveno sensitive capabilityreddit_searchno sensitive capabilityreddit_search_subredditno sensitive capabilityreddit_select_flairno sensitive capabilityreddit_sentno sensitive capabilityreddit_spamno sensitive capabilityreddit_spoilerno sensitive capabilityreddit_submitno sensitive capabilityreddit_subreddit_aboutno sensitive capabilityreddit_subreddit_rulesno sensitive capabilityreddit_subreddits_mineno sensitive capabilityreddit_subreddits_newno sensitive capabilityreddit_subreddits_popularno sensitive capabilityreddit_subreddits_searchno sensitive capabilityreddit_subscribeno sensitive capabilityreddit_unhideno sensitive capabilityreddit_unignore_reportsno sensitive capabilityreddit_unlockno sensitive capabilityreddit_unmark_nsfwno sensitive capabilityreddit_unreadno sensitive capabilityreddit_unsaveno sensitive capabilityreddit_unspoilerno sensitive capabilityreddit_unsubscribeno sensitive capabilityreddit_user_aboutno sensitive capabilityreddit_user_commentsno sensitive capabilityreddit_user_downvotedno sensitive capabilityreddit_user_flairno sensitive capabilityreddit_user_overviewno sensitive capabilityreddit_user_savedno sensitive capabilityreddit_user_submittedno sensitive capabilityreddit_user_trophiesno sensitive capabilityreddit_user_upvotedno sensitive capabilityreddit_voteno sensitive capabilityreddit_wiki_editno sensitive capabilityreddit_wiki_pageno sensitive capabilityreddit_wiki_page_revisionsno sensitive capabilityreddit_wiki_pagesno sensitive capabilityreddit_wiki_revisionsno sensitive capability
What this scan could not see
- Tools were statically extracted from the published source (88 recovered), not enumerated from a running server. Tool-poisoning, Unicode-smuggling, capability and toxic-flow analysis ran on this inferred surface, but a mis-parsed registration could be missed or mis-attributed, so tool-derived findings are capped below “confirmed”. To grade the real runtime surface, scan the running server: --command "npx -y <package>".
Versions 1
Scan history per published version. The engine is deterministic — the same version always yields the same score, so a changed score means the package itself changed.
| Version | Score | Findings | Engine | Scanned |
|---|---|---|---|---|
v0.1.1 latest |
A 92/100 | 6 | 1.13.0 | 2026-09-07 |
Embed this score
Show this server's live Trust Score in your README, docs or website. The badge is served straight from the registry and updates automatically after every rescan — no API key needed. It links back to this page, so anyone who sees the grade can also read the findings behind it instead of taking a number on faith.
Verify this score yourself
The score above is reproducible: the same package version always yields the same result. Run it locally or over the free API — no account, no LLM, fully deterministic.
npx mcptrustchecker scan @prmichaelsen/reddit-mcp --onlineOther implementations of Reddit 15
Independent packages implementing the same tool, scanned with the same engine. Compare all 16 side by side →
A Model Context Protocol (MCP) server for Reddit with full read AND write operations - create posts, reply, edit, and delete content.
Reddit MCP Server via Apify
MCP server for Reddit API - Access Reddit data through a unified API interface with TOON format for 90%+ token savings
Reddit MCP — public Reddit data via JSON endpoints (no auth required)
Read-only Reddit MCP server for Claude Code and other MCP clients
Reddit API tools and examples
More in Marketing & Social
Official Abyssfall game info, newsletter double opt-in, and merch reservation tools.
AdCritter ads platform: docs, API reference, app scaffolding, and white-label integration.
Google AdSense MCP Server - Monitor earnings, reports, and account health via Claude/AI
Operational empathy for technical founders + PE/VC operators navigating high-stakes B2B interactions. 28 MCP tools + CLI: ICP scoring, persona simulation, battlecards, deal classification, prospect discovery, investor matching, founder wellness, plus mark
MCP server for Bing Webmaster Tools — SEO site management, URL submission, sitemaps, stats, keywords
MCP (Model Context Protocol) server that helps AI agents use Primer Brand (@primer/react-brand) correctly when building GitHub marketing and landing pages.