Auditreach MCP server

auditreach

<!-- mcp-name: io.github.RudrenduPaul/auditreach --> <!-- Ownership-proof string for registry.modelcontextprotocol.io publishing. Do not remove. -->

Install • What it does • Getting started • Commands • Security • FAQ

Research Reddit and YouTube from your AI agent using only official APIs, your own keys, and a log that proves exactly what you queried and why it was allowed.

Install

auditreach ships as two independent, equally first-class packages: an npm package (this repo, JavaScript/TypeScript) and a PyPI package (python/, Python). Both implement the same hash-chain algorithm and BYOK model against the same official Reddit/YouTube APIs. Pick whichever fits your toolchain, or install both.

npm:

npx auditreach-cli search --platform reddit --query "your query"

Or install it globally:

npm install -g auditreach-cli
auditreach search --platform reddit --query "your query"

pip:

pip install auditreach-cli
auditreach search --platform reddit --query "your query"

See python/README.md for Python-specific usage, including this distribution's added env-var BYOK credential path (useful for headless CI/agent sandboxes) -- the npm package stores credentials in the OS keychain only.

Building from source works the same way, if you want to read or modify the code first:

git clone https://github.com/RudrenduPaul/auditreach.git
cd auditreach
npm install
npm run build
node dist/cli.js search --platform reddit --query "your query"

What it does

node dist/cli.js search --platform reddit --query "agent memory poisoning" --subreddit MachineLearning

AuditReach -- Official-API Research CLI Platform: Reddit | Auth: OAuth script-app grant, read-only, public-subreddit scope

Fetching... (official API, rate-limit aware) ✓ 14 results returned (Reddit API Terms -- public content, official API, read-only script-app credentials)

RESULTS (14) [1] "How are people testing for memory poisoning in long-running agents?" u/some_researcher · 2026-07-05T14:22:00.000Z https://reddit.com/r/MachineLearning/comments/... ...

Audit log entry written: ar2026-07-129f3c2a Consent basis: Reddit API Terms -- public content, official API, read-only script-app credentials Full results: ./auditreach-results-2026-07-12.json Full audit trail: ./auditreach.log.jsonl

Every entry in auditreach.log.jsonl is hash-chained -- each entry's hash is computed from its own content, and the next entry references it. Editing, deleting, or reordering an entry breaks the chain:

$ node dist/cli.js verify-log Verifying ./auditreach.log.jsonl... ✓ Chain intact: 14 entries, no gaps, no tampering detected.

# after someone hand-edits a line in the log file: $ node dist/cli.js verify-log Verifying ./auditreach.log.jsonl... ✗ Chain broken at entry 3 (ar2026-07-129f3c2a): entry ar2026-07-129f3c2a hash does not match its own content -- entry was edited after being written

Shortened. The full README is on GitHub.