Auditreach

Name: Auditreach
Author: RudrenduPaul

by RudrenduPaulversion 0.2.5i★ –iRuns on your computer

Registry nameio.github.RudrenduPaul/auditreach

Install

Overview

Description from the maker (original English)

BYOK Reddit/YouTube research CLI with a tamper-evident audit log and an MCP server.

PopNx MCP’s three pillars

These three are never merged into one score: opinions, measurements and popularity are different things.

User voiceiNo reviews yetReviews open together with accounts in a later step
Our basic checksi1 of 1 passedChecked from public information; code not scanned yet
UsageiNot measured yet★ –

What you can do with it

We have not written a plain-language summary for this one yet. Below are the facts we read from the registry.

Connection: Runs on your computer
Transport: stdio
Category: Marketing & social media

Install

Pick the AI app you use, then copy the settings.

Before you install

Basic checks: 1 of 1 passed
Runs on your computer with your user’s permissions (files, network, apps).
The registry lists no key to fill in.

You need

PyPIPython’s uv installed (for the uvx command)

Which app do you use?

ClaudeClaude CodeCursorVS CodeChatGPT

Pick your app above. We remember it, so next time the button says “Install in …”.

Open Claude Desktop → Settings → Developer → Edit Config, and paste this into claude_desktop_config.json

{
  "mcpServers": {
    "auditreach": {
      "command": "uvx",
      "args": [
        "auditreach-cli",
        "auditreach",
        "mcp"
      ]
    }
  }
}

Run this in your terminal

claude mcp add auditreach -- uvx auditreach-cli auditreach mcp

Open in Cursor

Or copy the settings yourself

Paste into .cursor/mcp.json in your project, or ~/.cursor/mcp.json

{
  "mcpServers": {
    "auditreach": {
      "command": "uvx",
      "args": [
        "auditreach-cli",
        "auditreach",
        "mcp"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

Open in VS Code

Or copy the settings yourself

Paste into .vscode/mcp.json in your project

{
  "servers": {
    "auditreach": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "auditreach-cli",
        "auditreach",
        "mcp"
      ]
    }
  }
}

Your browser asks to open the app, then the app shows the settings and asks you to confirm. Key values are left empty for you to fill in.

This one runs on your computer, and ChatGPT can only connect to servers on the internet. Pick another app.

Your choice stays on this device in a cookie; no account needed.

These settings are generated from the maker’s registry entry. If the README says otherwise, follow the README.

What it can do

Runs on your computer; the tool list appears in your AI app after you install it.

Basic checksi

We check information anyone can see; we have not read the code. Checks that do not apply are left out of the count. · Checked Nov 8, 2026

✓ Pass
Maker matches the repo
The registry name was verified with the GitHub account RudrenduPaul, which owns the repo
… Not checked yet
Still maintained
We have not read this repo from GitHub yet
… Not checked yet
Has a licence
We have not read this repo from GitHub yet
– Not applicable
Endpoint responds
This one runs on your computer; there is no internet endpoint
– Not applicable
Sign-in with OAuth
Runs on your computer and uses local settings instead
… Not checked yet
No hidden instructions in tool descriptions
Runs on your computer; we can only read tool lists from internet endpoints

Compared with others in Marketing & social mediai

More stars than 0% of the other 3589 servers in this category
Published to the registry more recently than 23% of the other 3589 servers in this category
Basic checks equal to or better than 100% of the other 3589 servers in this category

Compared with every active server in this category in the registry. Stars count only when the publisher owns the repo.

Common questions

Is Auditreach safe?

It passed 1 of 1 applicable basic checks. We have not read the code. Before adding a key or token, see what access the server asks for and use a key with only the permissions you need.

What keys or codes does it need?

The registry does not list a required key, though some servers ask you to sign in on first use.

Does it run on my computer or in the cloud?

It runs on your computer. Your AI app starts it when needed, and data does not pass through the maker’s servers (unless it calls an online service itself).

Is it still maintained?

The GitHub repo last changed –, and the latest version (0.2.5) reached the registry 3 months ago.

Which apps can use it?

Apps that support MCP, such as Claude Desktop, Claude Code, Cursor and VS Code. You also need Python (uv) on your computer.

What can I use instead?

In the same category: MCP YouTube Transcript, Google Analytics MCP, BibiGPT YouTube Video Summarizer

Alternatives

Servers in the same category from other makers, sorted by stars.

Reading a card:★ GitHub starsiThree pillars: reviews · checks · usageiUpdated = latest version published to the registryi

MCP YouTube Transcript

by jkawamoto

An MCP server retrieving transcripts of YouTube videos

Runs on your computer★ 495MITUpdated 11 days ago

Install

Google Analytics MCP

by surendranb

GA4 MCP server for AI agents: schema discovery, server-side aggregation, analysis-ready defaults.

Runs on your computer★ 244MITUpdated 11 days ago

Install

BibiGPT YouTube Video Summarizer

by JimmyLv

AI video summarizer: summarize and transcribe YouTube, Bilibili, TikTok and podcast videos.

Runs in the cloud★ 137MITUpdated 11 days ago

Install

README from the maker

Open the README

Copied from the maker’s repo as written. PopNx MCP has not reviewed or endorsed it. HTML, images and scripts are removed. Links lead off this site.

auditreach

Install • What it does • Getting started • Commands • Security • FAQ

Research Reddit and YouTube from your AI agent using only official APIs, your own keys, and a log that proves exactly what you queried and why it was allowed.

Install

auditreach ships as two independent, equally first-class packages: an npm package (this repo, JavaScript/TypeScript) and a PyPI package (python/, Python). Both implement the same hash-chain algorithm and BYOK model against the same official Reddit/YouTube APIs. Pick whichever fits your toolchain, or install both.

npm:

npx auditreach-cli search --platform reddit --query "your query"

Or install it globally:

npm install -g auditreach-cli

auditreach search --platform reddit --query "your query"

pip:

pip install auditreach-cli

auditreach search --platform reddit --query "your query"

See python/README.md for Python-specific usage, including this distribution's added env-var BYOK credential path (useful for headless CI/agent sandboxes) -- the npm package stores credentials in the OS keychain only.

Building from source works the same way, if you want to read or modify the code first:

git clone https://github.com/RudrenduPaul/auditreach.git

cd auditreach npm install npm run build node dist/cli.js search --platform reddit --query "your query"

What it does

node dist/cli.js search --platform reddit --query "agent memory poisoning" --subreddit MachineLearning

AuditReach -- Official-API Research CLI Platform: Reddit | Auth: OAuth script-app grant, read-only, public-subreddit scope

Fetching... (official API, rate-limit aware) ✓ 14 results returned (Reddit API Terms -- public content, official API, read-only script-app credentials)

RESULTS (14) [1] "How are people testing for memory poisoning in long-running agents?" u/some_researcher · 2026-07-05T14:22:00.000Z https://reddit.com/r/MachineLearning/comments/... ...

Audit log entry written: ar_2026-07-12_9f3c2a Consent basis: Reddit API Terms -- public content, official API, read-only script-app credentials Full results: ./auditreach-results-2026-07-12.json Full audit trail: ./auditreach.log.jsonl

Every entry in auditreach.log.jsonl is hash-chained -- each entry's hash is computed from its own content, and the next entry references it. Editing, deleting, or reordering an entry breaks the chain:

$ node dist/cli.js verify-log Verifying ./auditreach.log.jsonl... ✓ Chain intact: 14 entries, no gaps, no tampering detected.

after someone hand-edits a line in the log file:

$ node dist/cli.js verify-log Verifying ./auditreach.log.jsonl... ✗ Chain broken at entry 3 (ar_2026-07-12_9f3c2a): entry ar_2026-07-12_9f3c2a hash does not match its own content -- entry was edited after being written

How it compares

	auditreach	Agent-Reach	snoowrap
Access model	Official API only, BYO-key	Cookie/session import, "zero API fees"	Official API, BYO-key
Platform coverage	Reddit, YouTube	Twitter, Reddit, YouTube, GitHub, Bilibili, XiaoHongShu	Reddit only
Consent/audit log	Hash-chained, per-query, local	None	None
Maintenance status	Active (this release)	Active, 65k+ stars	Archived since Feb 2023
License	Apache 2.0	MIT	MIT
Runtime deps (Reddit client)	0 -- native `fetch`	n/a (Python, browser-session based)	`request`, `request-promise`, `ws` (all deprecated)

Numbers measured directly against each repo's public GitHub metadata and, for the dependency comparison, against snoowrap's own published package.json as of this writing -- reproducible by anyone with gh api repos/ / .

We started building auditreach's Reddit client on top of snoowrap, the most-used Reddit API wrapper in the Node ecosystem. Installing it pulls in request, request-promise, form-data, and har-validator -- a dependency chain that currently carries 2 CRITICAL, 2 HIGH, and 5 moderate severity advisories (9 total, per npm audit), none of which snoowrap can fix because the project has been archived since 2023. We rewrote the Reddit client as a direct fetch-based OAuth2 client against Reddit's own documented REST endpoints instead: same functionality, none of those CVEs, zero extra runtime dependencies for that client. See Security for auditreach's own current npm audit status.

Why auditreach exists

A consultancy we talked to had an AI research agent pulling social sentiment for a client report. It worked well until the client's legal team asked, in writing, what authority the data collection was under. The honest answer was "a browser cookie session," because the tool they were using authenticates by importing a logged-in session and scraping as if it were a real user. That works. It is also not an answer you can put in a compliance memo, and it is the exact pattern Reddit sued Anthropic and SerpApi over in 2025, and the same pattern that got Pushshift's public API access shut down by Reddit back in 2024.

Agent-Reach is not a bad tool. It has real traction (65k+ stars) because cookie-based scraping genuinely covers more ground than any official API does today, at zero API cost. But "covers more ground" and "an agency's client can pass a compliance review" are two different bars, and nothing was built specifically to clear the second one.

auditreach is the CLI we wished existed instead. It talks to Reddit and YouTube only through their official, documented APIs, using your own API keys -- never a shared pool -- and every single query writes a hash-chained entry to a local audit log: which platform, which endpoint, which scope, and a plain-language line explaining the consent/ToS basis for that specific call. No cookie import. No session-token reuse. No code path that could even pretend to be a logged-in human.

We are not trying to out-cover Agent-Reach's six platforms. auditreach is narrower on purpose, for the buyer who structurally can't use a cookie-based tool at all.

Getting started

1. Install: see Install above -- npx auditreach-cli, npm install -g auditreach-cli, or clone and build from source.

2. Set up credentials for the platform you want to search (BYO-key -- your own, never ours):

node dist/cli.js auth --platform reddit

Prompts for Client ID, Client secret, username, password.

Create a script-app at https://www.reddit.com/prefs/apps first.

node dist/cli.js auth --platform youtube

Prompts for an API key.

Create one at https://console.cloud.google.com/apis/credentials

All credentials are stored in your OS keychain (@napi-rs/keyring), never in a config file, never transmitted anywhere except the platform's own official auth endpoint. Once credentials are set, verify them without running a real search:

node dist/cli.js auth --platform reddit --verify

3. Search:

node dist/cli.js search --platform reddit --query "your query" --subreddit some_subreddit node dist/cli.js search --platform youtube --query "your query" --channel @SomeChannel

Honest note on setup time: getting your own API credentials from Reddit and Google takes a few minutes the first time -- this is slower than Agent-Reach's cookie-import flow (which just reuses a browser session you already have) by design. BYOK means the setup cost is real, not hidden.

Commands

auditreach has four subcommands. Every flag below is pulled directly from the CLI's own --help output, not from memory of what it used to support.

`auditreach search`

Search a platform using its official API only.

Flag	Description
`--platform`	`reddit` \	`youtube` (required)
`--query`	search query (required)
`--subreddit`	restrict search to one subreddit (Reddit only)
`--channel`	restrict search to one channel, e.g. `@AnthropicAI` (YouTube only)
`--since`	only results published after this date, e.g. `2026-06-01` (YouTube only)
`--max-results`	maximum results to return (default: 25; platform caps: 100 Reddit / 50 YouTube)
`--before`	page results before this Reddit fullname cursor, e.g. `t3_abc123` (Reddit only)
`--after`	page results after this Reddit fullname cursor, e.g. `t3_abc123` (Reddit only)
`--output`	write full results JSON to this path
`--json`	print structured JSON to stdout instead of human-readable output, for scripts and agent callers

node dist/cli.js search --platform reddit --query "agent memory poisoning" --subreddit MachineLearning --max-results 50 node dist/cli.js search --platform reddit --query "agent memory poisoning" --json | jq '.results | length'

`auditreach auth`

Set up, verify, or clear BYOK credentials for a platform (stored in your OS keychain).

Flag	Description

| --platform | reddit \| youtube (required)

Only the beginning is shown; read the rest in the repo

Auditreach

Overview

PopNx MCP’s three pillars

What you can do with it

Install

Before you install

What it can do

Basic checksi

Maker matches the repo

Still maintained

Has a licence

Endpoint responds

Sign-in with OAuth

No hidden instructions in tool descriptions

Compared with others in Marketing & social mediai

Common questions

Alternatives

MCP YouTube Transcript

Google Analytics MCP

BibiGPT YouTube Video Summarizer

README from the maker

auditreach

Install

What it does

after someone hand-edits a line in the log file:

How it compares

Why auditreach exists

Getting started

Prompts for Client ID, Client secret, username, password.

Create a script-app at https://www.reddit.com/prefs/apps first.

Prompts for an API key.

Create one at https://console.cloud.google.com/apis/credentials

Commands

auditreach search

auditreach auth

`auditreach search`

`auditreach auth`