Auditreach

auditreach

Install • What it does • Getting started • Commands • Security • FAQ

Research Reddit and YouTube from your AI agent using only official APIs, your own keys, and a log that proves exactly what you queried and why it was allowed.

Install

auditreach ships as two independent, equally first-class packages: an npm package (this repo, JavaScript/TypeScript) and a PyPI package (python/, Python). Both implement the same hash-chain algorithm and BYOK model against the same official Reddit/YouTube APIs. Pick whichever fits your toolchain, or install both.

npm:

npx auditreach-cli search --platform reddit --query "your query"

Or install it globally:

npm install -g auditreach-cli

auditreach search --platform reddit --query "your query"

pip:

pip install auditreach-cli

auditreach search --platform reddit --query "your query"

See python/README.md for Python-specific usage, including this distribution's added env-var BYOK credential path (useful for headless CI/agent sandboxes) -- the npm package stores credentials in the OS keychain only.

Building from source works the same way, if you want to read or modify the code first:

git clone https://github.com/RudrenduPaul/auditreach.git

cd auditreach npm install npm run build node dist/cli.js search --platform reddit --query "your query"

What it does

node dist/cli.js search --platform reddit --query "agent memory poisoning" --subreddit MachineLearning

AuditReach -- Official-API Research CLI Platform: Reddit | Auth: OAuth script-app grant, read-only, public-subreddit scope

Fetching... (official API, rate-limit aware) ✓ 14 results returned (Reddit API Terms -- public content, official API, read-only script-app credentials)

RESULTS (14) [1] "How are people testing for memory poisoning in long-running agents?" u/some_researcher · 2026-07-05T14:22:00.000Z https://reddit.com/r/MachineLearning/comments/... ...

Audit log entry written: ar_2026-07-12_9f3c2a Consent basis: Reddit API Terms -- public content, official API, read-only script-app credentials Full results: ./auditreach-results-2026-07-12.json Full audit trail: ./auditreach.log.jsonl

Every entry in auditreach.log.jsonl is hash-chained -- each entry's hash is computed from its own content, and the next entry references it. Editing, deleting, or reordering an entry breaks the chain:

$ node dist/cli.js verify-log Verifying ./auditreach.log.jsonl... ✓ Chain intact: 14 entries, no gaps, no tampering detected.

after someone hand-edits a line in the log file:

$ node dist/cli.js verify-log Verifying ./auditreach.log.jsonl... ✗ Chain broken at entry 3 (ar_2026-07-12_9f3c2a): entry ar_2026-07-12_9f3c2a hash does not match its own content -- entry was edited after being written

How it compares

Numbers measured directly against each repo's public GitHub metadata and, for the dependency comparison, against snoowrap's own published package.json as of this writing -- reproducible by anyone with gh api repos/ / .

We started building auditreach's Reddit client on top of snoowrap, the most-used Reddit API wrapper in the Node ecosystem. Installing it pulls in request, request-promise, form-data, and har-validator -- a dependency chain that currently carries 2 CRITICAL, 2 HIGH, and 5 moderate severity advisories (9 total, per npm audit), none of which snoowrap can fix because the project has been archived since 2023. We rewrote the Reddit client as a direct fetch-based OAuth2 client against Reddit's own documented REST endpoints instead: same functionality, none of those CVEs, zero extra runtime dependencies for that client. See Security for auditreach's own current npm audit status.

Why auditreach exists

A consultancy we talked to had an AI research agent pulling social sentiment for a client report. It worked well until the client's legal team asked, in writing, what authority the data collection was under. The honest answer was "a browser cookie session," because the tool they were using authenticates by importing a logged-in session and scraping as if it were a real user. That works. It is also not an answer you can put in a compliance memo, and it is the exact pattern Reddit sued Anthropic and SerpApi over in 2025, and the same pattern that got Pushshift's public API access shut down by Reddit back in 2024.

Agent-Reach is not a bad tool. It has real traction (65k+ stars) because cookie-based scraping genuinely covers more ground than any official API does today, at zero API cost. But "covers more ground" and "an agency's client can pass a compliance review" are two different bars, and nothing was built specifically to clear the second one.

auditreach is the CLI we wished existed instead. It talks to Reddit and YouTube only through their official, documented APIs, using your own API keys -- never a shared pool -- and every single query writes a hash-chained entry to a local audit log: which platform, which endpoint, which scope, and a plain-language line explaining the consent/ToS basis for that specific call. No cookie import. No session-token reuse. No code path that could even pretend to be a logged-in human.

We are not trying to out-cover Agent-Reach's six platforms. auditreach is narrower on purpose, for the buyer who structurally can't use a cookie-based tool at all.

Getting started

1. Install: see Install above -- npx auditreach-cli, npm install -g auditreach-cli, or clone and build from source.

2. Set up credentials for the platform you want to search (BYO-key -- your own, never ours):

node dist/cli.js auth --platform reddit

Prompts for Client ID, Client secret, username, password.

Create a script-app at https://www.reddit.com/prefs/apps first.

node dist/cli.js auth --platform youtube

Prompts for an API key.

Create one at https://console.cloud.google.com/apis/credentials

All credentials are stored in your OS keychain (@napi-rs/keyring), never in a config file, never transmitted anywhere except the platform's own official auth endpoint. Once credentials are set, verify them without running a real search:

node dist/cli.js auth --platform reddit --verify

3. Search:

node dist/cli.js search --platform reddit --query "your query" --subreddit some_subreddit node dist/cli.js search --platform youtube --query "your query" --channel @SomeChannel

Honest note on setup time: getting your own API credentials from Reddit and Google takes a few minutes the first time -- this is slower than Agent-Reach's cookie-import flow (which just reuses a browser session you already have) by design. BYOK means the setup cost is real, not hidden.

Commands

auditreach has four subcommands. Every flag below is pulled directly from the CLI's own --help output, not from memory of what it used to support.

auditreach search

Search a platform using its official API only.

node dist/cli.js search --platform reddit --query "agent memory poisoning" --subreddit MachineLearning --max-results 50 node dist/cli.js search --platform reddit --query "agent memory poisoning" --json | jq '.results | length'

auditreach auth

Set up, verify, or clear BYOK credentials for a platform (stored in your OS keychain).

| --platform | reddit \| youtube (required)