reddit-mcp-buddy 1.1.14 → 1.2.1

package/README.md

@@ -2,7 +2,16 @@
 
 ### Reddit Browser for Claude Desktop and AI Assistants
 
-A [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that enables Claude Desktop and other AI assistants to browse Reddit, search posts, and analyze user activity. Clean, fast, and actually works - browse subreddits with no API keys; add free Reddit credentials for search, comments, user analysis, and full metrics.
+A [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server for browsing Reddit, searching posts, and analyzing user activity. It needs existing approved Reddit API credentials. Version 1.2.0 added optional posting and commenting with per-process caps and a client-dependent confirmation flow. See [Posting](#posting-v120).
+
+> **Reddit is closing the access this server uses.** Only people who already hold approved Reddit API credentials can use it.
+>
+> - **2026-10-31:** Reddit stopped accepting new requests for public API access ([migration post](https://www.reddit.com/r/redditdev/comments/1wubcvf/moving_data_api_apps_to_the_developer_platform/)).
+> - **2026-11-13:** Reddit ends RSS feed support ([changelog, October 8, 2026](https://support.reddithelp.com/hc/en-us/articles/54353370049684-Changelog-October-8-2026)). RSS was the only thing this server could read without credentials, so from this date every call without credentials returns an error saying credentials are needed.
+> - **2027-01-12:** Reddit starts closing API access for apps whose owners have not registered them at [developers.reddit.com/app-registration](https://developers.reddit.com/app-registration) or answered Reddit's outreach ([migration post](https://www.reddit.com/r/redditdev/comments/1wubcvf/moving_data_api_apps_to_the_developer_platform/)).
+> - **March 2027:** Reddit ends the remaining public API access ([migration post](https://www.reddit.com/r/redditdev/comments/1wubcvf/moving_data_api_apps_to_the_developer_platform/)).
+>
+> This project cannot grant API access or register your app for you.
 
 [![npm version](https://img.shields.io/npm/v/reddit-mcp-buddy.svg)](https://www.npmjs.com/package/reddit-mcp-buddy)
 [![npm downloads](https://img.shields.io/npm/dm/reddit-mcp-buddy.svg)](https://www.npmjs.com/package/reddit-mcp-buddy)
@@ -25,7 +34,8 @@ A [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that en
 - [Quick Start](#quick-start-30-seconds)
 - [What can it do?](#what-can-it-do)
 - [Available Tools](#available-tools)
-- [Authentication](#authentication-optional)
+- [Authentication](#authentication)
+- [Posting (v1.2.0)](#posting-v120)
 - [Installation Options](#installation-options)
   - [Global Install](#global-install)
   - [From Source](#from-source)
@@ -39,12 +49,13 @@ A [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that en
 
 ## What makes Reddit MCP Buddy different?
 
-- **🚀 Zero setup** - Browse subreddits instantly, no Reddit API registration needed (search, comments, user analysis, and engagement metrics need free credentials)
-- **⚡ Up to 10x more requests** - Three-tier authentication system (10/60/100 requests per minute)
+- **🔑 Built for existing API access** - Uses your approved Reddit app's credentials through Reddit's OAuth API
+- **✍️ Opt-in posting (v1.2.0)** - Create posts and comments with a client-dependent confirmation flow, per-process caps, and duplicate suppression
+- **⚡ Local rate limits** - Configured caps of 10/60/100 requests per minute; Reddit applies its own limits
 - **🎯 Clean data** - No fake "sentiment analysis" or made-up metrics
 - **🧠 LLM-optimized** - Built specifically for AI assistants like Claude
 - **📦 TypeScript** - Fully typed, reliable, and maintainable
-- **✅ Proven rate limits** - Thoroughly tested authentication tiers with verification tools
+- **✅ Rate-limit testing** - Verification tools for the server's local authentication tiers
 
 ## Quick Start (30 seconds)
 
@@ -52,18 +63,22 @@ A [Model Context Protocol (MCP)](https://modelcontextprotocol.io) server that en
 
 1. **Download**: [reddit-mcp-buddy.mcpb](https://github.com/karanb192/reddit-mcp-buddy/releases/latest/download/reddit-mcp-buddy.mcpb)
 2. **Install**: Open the downloaded file
-3. **Done!** Reddit tools are now available in Claude
+3. **Add credentials**: Enter your approved Reddit app's client ID and secret in the extension settings (see [Authentication](#authentication))
 
 ### For Claude Desktop - NPM Method (Alternative)
 
-Add this to your `claude_desktop_config.json`:
+Add this to your `claude_desktop_config.json`, with your approved app's credentials (see [Authentication](#authentication)):
 
 ```json
 {
   "mcpServers": {
     "reddit": {
       "command": "npx",
-      "args": ["-y", "reddit-mcp-buddy"]
+      "args": ["-y", "reddit-mcp-buddy"],
+      "env": {
+        "REDDIT_CLIENT_ID": "your_client_id",
+        "REDDIT_CLIENT_SECRET": "your_client_secret"
+      }
     }
   }
 }
@@ -74,12 +89,14 @@ Add this to your `claude_desktop_config.json`:
 Run this command to add the MCP server (user scope):
 
 ```bash
-claude mcp add --transport stdio reddit-mcp-buddy -s user -- npx -y reddit-mcp-buddy
+claude mcp add --transport stdio reddit-mcp-buddy -s user \
+  -e REDDIT_CLIENT_ID=your_client_id -e REDDIT_CLIENT_SECRET=your_client_secret \
+  -- npx -y reddit-mcp-buddy
 ```
 
 ### For Other MCP Clients
 
-Use the NPM method: `npx -y reddit-mcp-buddy`
+Run `npx -y reddit-mcp-buddy` with `REDDIT_CLIENT_ID` and `REDDIT_CLIENT_SECRET` set in its environment.
 
 ## What can it do?
 
@@ -90,6 +107,7 @@ Ask your AI assistant to:
 - 💬 **"Get comments from this Reddit post"** - Fetch post with full comment threads
 - 👤 **"Analyze user spez"** - Get user history, karma, and activity
 - 📚 **"Explain Reddit karma"** - Understand Reddit terminology
+- ✍️ **"Post this to r/test"** - Draft, check the sub's rules, and submit after you confirm (opt-in, see [Posting](#posting-v120))
 
 ## Available Tools
 
@@ -105,7 +123,7 @@ Browse posts from any subreddit with sorting options.
 - Include subreddit info: Optional flag for subreddit metadata (requires credentials)
 ```
 
-> **No credentials?** Results are served from Reddit's public RSS feed (`data_source: "rss"`): `score`, `num_comments`, `upvote_ratio`, and `nsfw` come back `null`, and the `include_nsfw` filter can't be applied. Add credentials ([Authentication](#authentication-optional)) for full data via the API.
+> **No credentials?** Until 2026-11-13, results come from Reddit's RSS feed (`data_source: "rss"`): `score`, `num_comments`, `upvote_ratio`, and `nsfw` come back `null`, and the `include_nsfw` filter can't be applied. Reddit ends RSS support on 2026-11-13 ([changelog](https://support.reddithelp.com/hc/en-us/articles/54353370049684-Changelog-October-8-2026)); from then on browsing needs credentials too ([Authentication](#authentication)).
 
 ### `search_reddit`
 Search across Reddit or specific subreddits.
@@ -145,25 +163,30 @@ Get explanations of Reddit terms.
 - Terms: karma, cake day, AMA, ELI5, etc.
 ```
 
-## Authentication (Optional)
+### Write tools (opt-in)
+
+`create_post`, `add_comment`, and `subreddit_rules` only appear when you enable posting; read-only installs see exactly the five tools above. Details in [Posting (v1.2.0)](#posting-v120).
+
+## Authentication
 
-Want more requests? Add Reddit credentials to your Claude Desktop config:
+Every tool that reads Reddit needs credentials for a Reddit app whose API access Reddit has already approved. Only `reddit_explain`, which works offline, runs without them.
+
+### Who can use this server
+
+- **You already hold approved Reddit API access:** use your app's credentials below.
+- **You do not:** Reddit stopped accepting new requests for public API access on 2026-10-31 ([migration post](https://www.reddit.com/r/redditdev/comments/1wubcvf/moving_data_api_apps_to_the_developer_platform/)), so there is no way to get credentials for this server now. This project cannot grant access, and it does not provide shared API keys or a third-party OAuth service.
+- **Keep your access past 2027-01-12:** Reddit starts closing API access on that date for apps whose owners have not registered them at [developers.reddit.com/app-registration](https://developers.reddit.com/app-registration) or answered Reddit's outreach ([migration post](https://www.reddit.com/r/redditdev/comments/1wubcvf/moving_data_api_apps_to_the_developer_platform/)). Registration is done by each app's owner; this project cannot do it for you.
+
+Without credentials, `browse_subreddit` reads Reddit's RSS feeds only until 2026-11-13, when Reddit ends RSS support ([changelog](https://support.reddithelp.com/hc/en-us/articles/54353370049684-Changelog-October-8-2026)). From then on every Reddit tool returns an error that says credentials are needed.
 
 ### Setup Steps
 
-1. **Go to** https://www.reddit.com/prefs/apps
-2. **Click** "Create App" or "Create Another App"
-3. **Fill out the form:**
-   - **Name**: Any name (e.g., "reddit-mcp-buddy")
-   - **App type**: Select **"script"** (CRITICAL for 100 rpm!)
-   - **Description**: Optional
-   - **About URL**: Leave blank
-   - **Redirect URI**: `http://localhost:8080` (required but unused)
-4. **Click** "Create app"
-5. **Find your credentials:**
-   - **Client ID**: The string under "personal use script"
+1. **Open** https://www.reddit.com/prefs/apps and select your approved app.
+2. **Check the app type:** **"script"** supports password-grant authentication, **"web app"** supports OAuth consent with a refresh token (see below), and app-only mode works with both.
+3. **Find your credentials:**
+   - **Client ID**: The string beneath the app's name and type
    - **Client Secret**: The secret string
-6. **Update your Claude Desktop config:**
+4. **Update your Claude Desktop config:**
 
 ```json
 {
@@ -182,27 +205,112 @@ Want more requests? Add Reddit credentials to your Claude Desktop config:
 }
 ```
 
+### Web apps with OAuth consent
+
+An approved web app can authenticate a user without their Reddit password. `--oauth` runs Reddit's [authorization-code flow](https://github.com/reddit-archive/reddit/wiki/OAuth2#authorization) once and prints a refresh token.
+
+1. **Register the redirect URI.** On [Reddit app preferences](https://www.reddit.com/prefs/apps), the web app's redirect URI must be a loopback address with a port, such as `http://localhost:8080`.
+2. **Run the consent command** on the machine where your browser is signed in to Reddit:
+
+   ```bash
+   npx -y reddit-mcp-buddy --oauth
+   ```
+
+   It prompts for the web app's client ID and secret, or reads `REDDIT_CLIENT_ID` and `REDDIT_CLIENT_SECRET` from the environment. It requests `identity`, `read`, and `history`, which the read-only tools need. Add `--write` to also request `submit` and `flair` for [posting](#posting-v120). Pass `--redirect-uri http://localhost:<port>` if you registered a different port.
+3. **Open the printed link and click Allow.** Reddit redirects back to a temporary local server that only listens on your machine. It checks the random `state` value, exchanges the one-time code, and confirms the account with `/api/v1/me`. It waits up to 5 minutes and never posts.
+4. **Copy the token into your config.** It prints `REDDIT_REFRESH_TOKEN=...`. To keep it off the screen, add `--out ~/reddit-token.env`, a path outside any repository. If that file already exists, the command stops before asking for consent. If writing fails after consent, it prints the token instead. On macOS and Linux the file is readable only by you.
+
+Set these variables in the server's environment:
+
+```json
+{
+  "REDDIT_CLIENT_ID": "your_client_id",
+  "REDDIT_CLIENT_SECRET": "your_client_secret",
+  "REDDIT_REFRESH_TOKEN": "your_refresh_token"
+}
+```
+
+Leave `REDDIT_PASSWORD` unset when using a refresh token. Setting both is rejected at startup. The server exchanges the refresh token for access tokens as needed and does not write environment credentials to `auth.json`. Refresh tokens loaded from that file are not used; configure this mode through the environment.
+
+Treat a refresh token like a password. Keep it outside version control and revoke access in [Reddit app preferences](https://www.reddit.com/prefs/apps) when it is no longer needed. OAuth consent does not grant Reddit API approval or extend the approved use case.
+
 ### Three-Tier Authentication System
 
-Reddit MCP Buddy supports three authentication levels, each with different rate limits:
+Reddit MCP Buddy enforces these local caps. They are not Reddit API quotas or guaranteed throughput:
 
-| Mode | Rate Limit | Required Credentials | Best For |
+| Mode | Local Cap | Required Credentials | Best For |
 |------|------------|---------------------|----------|
-| **Anonymous** | 10 req/min* | None | Testing, light usage |
+| **No credentials** | 10 req/min* | None | Ends 2026-11-13 |
 | **App-Only** | 60 req/min | Client ID + Secret | Regular browsing |
-| **Authenticated** | 100 req/min | All 4 credentials | Heavy usage, automation |
+| **Authenticated** | 100 req/min | Client ID + Secret, plus refresh token or username/password | Heavy usage, automation |
 
-*\*Server-side cap. Anonymous requests are served from Reddit's logged-out RSS feed, which applies its own stricter per-IP throttle (often one uncached request per 25-60 seconds). The 15-minute cache and automatic retries absorb much of this, but sustained anonymous browsing is effectively slower than 10 req/min.*
+*\*Until 2026-11-13 only. Requests without credentials are served from Reddit's logged-out RSS feed, which applies its own stricter per-IP throttle.*
 
 #### How It Works:
-- **Anonymous Mode**: Default mode, no setup required. Only `browse_subreddit` (plus the offline `reddit_explain`) works: Reddit blocks the logged-out JSON API, so browse results come from Reddit's public RSS feed (`data_source: "rss"`) with engagement metrics and NSFW flags as `null`. The remaining tools require credentials.
+- **No credentials**: Until 2026-11-13, only `browse_subreddit` (from Reddit's RSS feed, with engagement metrics and NSFW flags as `null`) and the offline `reddit_explain` work. After Reddit ends RSS support that day, every Reddit tool returns an error that says credentials are needed.
 - **App-Only Mode**: Uses OAuth2 client credentials grant (works with both script and web apps)
-- **Authenticated Mode**: Uses OAuth2 password grant (requires script app type)
+- **Authenticated Mode**: Uses OAuth2 refresh-token authentication for an authorized web app, or password grant for a script app
 
 **Important Notes**:
-- Script apps support BOTH app-only (60 rpm) and authenticated (100 rpm) modes
-- Web apps only support app-only mode (60 rpm maximum)
-- For 100 requests/minute, you MUST use a script app with username + password
+- Client credentials select app-only mode; a refresh token or username/password selects user authentication.
+- A refresh token carries the scopes granted during consent. Missing scopes can prevent individual tools from working.
+- User authentication changes this server's local cap; it does not grant a larger quota from Reddit.
+
+## Posting (v1.2.0)
+
+Since v1.2.0 the server can post for you. Three tools, all opt-in:
+
+- **`create_post`** - Submit a text or link post to one subreddit. Checks mechanical rules (title limits, flair required, link vs text allowed) and supports `validate_only: true` as a dry run. Confirmation depends on the client's capabilities as described below.
+- **`add_comment`** - Comment on a post or reply to a specific comment (by id or URL), with the same confirmation flow.
+- **`subreddit_rules`** - Read-only. Fetches a sub's rules, posting requirements, capability flags, and flair choices in one cached call, so drafts fit the sub before anything is submitted.
+
+The intended workflow: `subreddit_rules` first, then `create_post` with `validate_only: true`, review the full draft and options with the user, then submit the identical payload.
+
+### Enabling posting
+
+Add `REDDIT_BUDDY_WRITE` next to your existing credentials:
+
+```json
+{
+  "mcpServers": {
+    "reddit": {
+      "command": "npx",
+      "args": ["-y", "reddit-mcp-buddy"],
+      "env": {
+        "REDDIT_CLIENT_ID": "your_client_id",
+        "REDDIT_CLIENT_SECRET": "your_client_secret",
+        "REDDIT_USERNAME": "your_username",
+        "REDDIT_PASSWORD": "your_password",
+        "REDDIT_BUDDY_WRITE": "true"
+      }
+    }
+  }
+}
+```
+
+Claude Desktop extension users: flip the **Enable posting tools** toggle in the extension settings instead. It maps to the same `REDDIT_BUDDY_WRITE` variable.
+
+Alternatively, replace `REDDIT_PASSWORD` with `REDDIT_REFRESH_TOKEN` from the [web-app consent flow](#web-apps-with-oauth-consent); `npx -y reddit-mcp-buddy --oauth --write` requests the posting scopes. Posting requires the granted scopes `identity`, `read`, `submit`, and `flair`. Add `history` if you also use `user_analysis`. `REDDIT_USERNAME` is optional with a refresh token; when provided, it must match the account returned by Reddit.
+
+Credentials must come from environment variables (or extension config fields, which become environment variables). The interactive `--auth` file setup does not enable posting. Startup verifies the account through Reddit and checks granted scopes. If any requirement is missing, the server logs the reason and keeps posting tools disabled.
+
+### The safety model, in plain words
+
+Posting uses your account. The server enforces registration, rate limits, and duplicate checks; human approval also depends on the client:
+
+- **Off by default.** Without `REDDIT_BUDDY_WRITE`, the write tools do not exist: read-only installs see exactly the same 5 tools as before, and pay zero extra context.
+- **stdio only.** The HTTP transport has no authentication, so write tools refuse to register there. No process on your machine or network can turn the HTTP endpoint into a posting proxy.
+- **Confirmation depends on the client.** Clients supporting [MCP elicitation](https://modelcontextprotocol.io/specification/latest) get a confirmation prompt with the target, account, content preview, full content length, and post options. The prompt requires an explicit acceptance. Previews can be truncated, so review the full draft in your client first. Without elicitation, the server requires a preview or successful dry run followed by the identical payload within 15 minutes. It cannot verify that a human approved that repeat: approval depends on the client's tool prompt and the model following instructions. Only enable posting in a client whose approval behavior you trust.
+- **Hourly caps you cannot raise.** At most 5 posts/hour, 30 comments/hour, and 15 seconds between writes, enforced in the server. Environment variables can tighten these, never loosen them. Honest limit: the caps live in the server process (a restart resets the hour, parallel sessions have separate caps, and a fork of this open-source code can remove them). They exist to make casual abuse pointless, not to stop a determined operator.
+- **Duplicate suppression.** Retrying an identical submit within 15 minutes returns the original post instead of posting twice, including the same content re-drafted for the same sub. Posting the same content to a different subreddit is allowed, with a warning naming the earlier post.
+- **Verified after submit.** Reddit happily returns "success" for posts AutoModerator removes seconds later. The server re-checks after submitting and reports `status: "filtered"` with a warning when that happens, instead of telling you it went live.
+- **Conspicuous logging.** Every allowed write is logged to stderr with the kind, the target (subreddit when known), and the acting user.
+
+### Know the trade-off before enabling
+
+Reddit's password grant returns a token with **full account scope**. An OAuth refresh token carries the permissions granted during consent. These permissions apply across the account, not just one subreddit. With posting off, the server uses the credentials for reads; enabling posting lets it submit posts and comments. Keep passwords and refresh tokens out of version control and off shared machines.
+
+Also worth knowing: Reddit applies its own account-level posting throttles on top of everything above, based on account age and karma. If Reddit says "try again in N minutes", the server surfaces the wait instead of hammering.
 
 ## Privacy & Data Handling
 
@@ -230,7 +338,7 @@ Reddit MCP Buddy is designed with privacy and transparency in mind. Here's how y
 - **Local Processing**: All data processing happens locally on your machine
 
 ### Security Notes
-- **Read-Only Operations**: All tools are read-only - the server never posts, comments, or modifies any Reddit content
+- **Read-Only by Default**: Posting requires explicit opt-in. Review the [client-dependent confirmation flow](#the-safety-model-in-plain-words) before enabling it.
 - **Credential Safety**:
   - OAuth tokens are refreshed automatically and kept in memory; only `--auth` CLI setups also cache the token in `~/.reddit-mcp-buddy/auth.json` (file mode 600)
   - Client secrets are treated as sensitive and never logged
@@ -282,6 +390,26 @@ npx -y reddit-mcp-buddy --auth
 
 This will prompt you for Reddit app credentials and save them locally. **Note: This does NOT work with Claude Desktop** - use environment variables in your Claude config instead.
 
+### Private sandbox posting test
+
+Build the checkout, then print the proposed test without making any requests:
+
+```bash
+npm run build
+REDDIT_TEST_SUBREDDIT=your_private_sub node tests/live-write.mjs
+```
+
+The live run requires an approved app, `REDDIT_CLIENT_ID` and `REDDIT_CLIENT_SECRET`, plus either `REDDIT_REFRESH_TOKEN` or the script-app `REDDIT_USERNAME`/`REDDIT_PASSWORD` pair. The account must moderate the private test subreddit. OAuth validation requires all six scopes: `identity`, `read`, `submit`, `flair`, `history` for recovery, and `edit` for cleanup. The harness checks these before connecting any posting client. Keep credentials outside the repository. On Node versions supporting `--env-file`, a local environment file can supply them:
+
+```bash
+RUN_WRITE_TESTS=1 REDDIT_TEST_SUBREDDIT=your_private_sub \
+  node --env-file=/path/to/private.env tests/live-write.mjs --run
+```
+
+This command performs real writes. It starts actual stdio MCP connections, declines one post request, accepts one test post, and tests comment preview followed by an identical submission from a client without elicitation. The harness supplies the confirmation responses automatically; running it authorizes these test actions. It creates one post and one comment, verifies their content, then attempts deletion of both even after a failure.
+
+The unique marker and any cleanup failures are printed for manual inspection. Lost responses trigger a search of the test user's newest posts and comments; an unresolved outcome or unverified deletion fails the run. Cleanup cannot be guaranteed if the process is killed or Reddit is unavailable. Ordinary unit tests use an offline API fixture, and normal integration runs skip posting unless explicitly enabled.
+
 ### Testing with HTTP Mode
 
 To test the server directly in your terminal:
@@ -313,20 +441,31 @@ npm link
 ```
 
 ### Using Docker
+
+The Docker image and CI workflows use Node.js 26. To build and run the image:
+
 ```bash
 git clone https://github.com/karanb192/reddit-mcp-buddy.git
 cd reddit-mcp-buddy
-docker build -t reddit-mcp-buddy .
-docker run -it reddit-mcp-buddy
+docker build --pull -t reddit-mcp-buddy .
+docker run -it -e REDDIT_CLIENT_ID=your_client_id -e REDDIT_CLIENT_SECRET=your_client_secret reddit-mcp-buddy
+```
+
+Run the container smoke test with Docker, curl, and jq installed:
+
+```bash
+bash tests/test-docker.sh reddit-mcp-buddy
 ```
 
+The test checks container health, MCP initialization, tool discovery, and shutdown without Reddit credentials.
+
 ### Claude Desktop Extension
 
 For one-click installation in Claude Desktop, download the pre-built extension:
 
 **📦 [Download reddit-mcp-buddy.mcpb](https://github.com/karanb192/reddit-mcp-buddy/releases/latest/download/reddit-mcp-buddy.mcpb)**
 
-**Installation:** Simply open the downloaded `.mcpb` file - Claude Desktop will automatically install the extension and the Reddit tools will be immediately available.
+**Installation:** Open the downloaded `.mcpb` file and Claude Desktop installs the extension. Then enter your approved Reddit app's credentials in the extension settings (see [Authentication](#authentication)).
 
 #### Build from Source (Optional)
 
@@ -343,10 +482,9 @@ cd reddit-mcp-buddy
 
 | Feature | Reddit MCP Buddy | Other MCP Tools |
 |---------|-------------|----------------|
-| **Zero Setup** | ✅ Browse instantly; free keys unlock the rest | ❌ Keys required for everything |
-| **Max Rate Limit** | ✅ 100 req/min proven | ❓ Unverified claims |
+| **Credentials** | Existing approved Reddit API access required | Varies by server |
 | **Language** | TypeScript/Node.js | Python (most) |
-| **Tools Count** | 5 (focused) | 8-10 (redundant) |
+| **Tools Count** | 5 read + 3 opt-in write | 8-10 (redundant) |
 | **Fake Metrics** | ✅ Real data only | ❌ "Sentiment scores" |
 | **Search** | ✅ Full search | Limited or none |
 | **Caching** | ✅ Smart caching | Usually none |
@@ -357,17 +495,16 @@ cd reddit-mcp-buddy
 
 | Mode | Requests/Minute | Cache TTL | Setup Required |
 |------|----------------|-----------|----------------|
-| Anonymous | 10 | 15 min | None |
+| No credentials (until 2026-11-13) | 10 | 15 min | None |
 | App-only | 60 | 5 min | Client ID + Secret |
 | Authenticated | 100 | 5 min | All credentials |
 
-*Cache TTL applies to subreddit listings. Post details (10 min), search results (10 min), and user profiles (15 min) use fixed TTLs in all modes. Anonymous throughput is additionally bounded by Reddit's own per-IP RSS throttle, which is stricter than 10/min for uncached requests.*
+*Cache TTL applies to subreddit listings. Post details (10 min), search results (10 min), and user profiles (15 min) use fixed TTLs in all modes.*
 
 ## Why Reddit MCP Buddy?
 
 ### What others do wrong:
 - ❌ **Fake metrics** - "sentiment scores" that are just keyword counting
-- ❌ **Complex setup** - Requiring API keys just to start
 - ❌ **Bloated responses** - Returning 100+ fields of Reddit's raw API
 - ❌ **Poor LLM integration** - Confusing parameters and unclear descriptions
 
@@ -415,11 +552,18 @@ cd reddit-mcp-buddy
 
 ### Common Issues
 
+**"Reddit ended logged-out RSS access on 2026-11-13"**
+- The server has no credentials, and Reddit no longer serves the RSS feeds it used without them ([changelog](https://support.reddithelp.com/hc/en-us/articles/54353370049684-Changelog-October-8-2026)). The subreddit, post, or user you asked for is not the problem
+- Add your approved app's credentials (see [Authentication](#authentication)). Reddit stopped accepting new API access requests on 2026-10-31, so this only helps people who already hold access
+
+**"Cannot create an app" or "API approval required"**
+- Reddit stopped accepting new requests for public API access on 2026-10-31 ([migration post](https://www.reddit.com/r/redditdev/comments/1wubcvf/moving_data_api_apps_to_the_developer_platform/)); this project cannot approve an app or remove Reddit's restrictions
+- Use credentials only for an app and use case Reddit has approved
+
 **"Can't achieve 100 requests/minute"**
-- Ensure your app type is **"script"** not "web" or "installed"
-- Script apps created by one account can only authenticate as that same account
-- Run `npm run test:rate-limit:auth` to verify (requires cloning the repo)
-- If still failing, create a new script app while logged into the authenticating account
+- The 10/60/100 tiers are this server's local caps, not guaranteed throughput from Reddit
+- Respect Reddit's rate-limit responses; adding account credentials does not increase Reddit's granted quota
+- Run `npm run test:rate-limit:app` or `npm run test:rate-limit:auth` to inspect the corresponding local mode (requires cloning the repo)
 
 **"Command not found" error**
 ```bash
@@ -432,15 +576,20 @@ $(npm prefix -g)/bin/reddit-mcp-buddy
 ```
 
 **Browsing works but search / comments / user analysis fail**
-- Without credentials only `browse_subreddit` (served from Reddit's public RSS feed, no scores or comment counts) and the offline `reddit_explain` work
-- Anonymous browsing can also hit Reddit's own RSS rate limit (HTTP 429); the server retries automatically, but sustained throttling can still fail
-- Solution: Add Reddit credentials (see [Authentication](#authentication-optional))
+- Without credentials, only `browse_subreddit` (from Reddit's RSS feed, until 2026-11-13) and the offline `reddit_explain` work
+- Solution: Add your approved app's credentials (see [Authentication](#authentication))
 
 **Rate limit errors**
-- Without auth: 10 requests/minute server cap, and Reddit's own RSS feed throttles harder per IP (the server retries automatically)
-- With app credentials only: 60 requests/minute
-- With full authentication: 100 requests/minute
-- Solution: Add Reddit credentials (see [Authentication](#authentication-optional))
+- Local caps: 60 requests/minute with app credentials and 100 with full authentication (10 without credentials, until 2026-11-13)
+- Reddit applies its own API limits; the server retries transient failures, but sustained throttling can still fail
+- Reduce request frequency and respect Reddit's rate-limit responses
+- If an error says `Retry in Ns`, wait that long before retrying. The server returns long upstream waits immediately instead of sleeping through the client's request timeout.
+
+**Write tools don't show up**
+- All of these must hold: `REDDIT_BUDDY_WRITE=true`, client credentials plus a refresh token or username/password via environment variables, stdio transport, a verified user identity, and granted `identity`/`read`/`submit`/`flair` scopes
+- The startup log (stderr) names exactly which condition failed
+- `--auth` file setups cannot write: the password is never saved, so restarts fall back to app-only tokens. Move credentials into your MCP client config's `env` block
+- HTTP mode never registers write tools, by design (the HTTP endpoint has no authentication)
 
 **"Subreddit not found"**
 - Check spelling (case-insensitive)
@@ -457,10 +606,11 @@ $(npm prefix -g)/bin/reddit-mcp-buddy
 #### Authentication Variables
 | Variable | Description | Required | Rate Limit |
 |----------|-------------|----------|------------|
-| `REDDIT_CLIENT_ID` | Reddit app client ID | No | 60 req/min (with secret) |
-| `REDDIT_CLIENT_SECRET` | Reddit app secret | No | 60 req/min (with ID) |
-| `REDDIT_USERNAME` | Reddit account username | No | 100 req/min (with all 4) |
-| `REDDIT_PASSWORD` | Reddit account password | No | 100 req/min (with all 4) |
+| `REDDIT_CLIENT_ID` | Reddit app client ID | Yes (from 2026-11-13) | Local cap: 60 req/min (with secret) |
+| `REDDIT_CLIENT_SECRET` | Reddit app secret | Yes (from 2026-11-13) | Local cap: 60 req/min (with ID) |
+| `REDDIT_USERNAME` | Reddit account username | No | Local cap: 100 req/min (with all 4) |
+| `REDDIT_PASSWORD` | Reddit account password | No | Local cap: 100 req/min (with all 4) |
+| `REDDIT_REFRESH_TOKEN` | OAuth refresh token; leave password unset | No | Local cap: 100 req/min with client ID + secret |
 | `REDDIT_USER_AGENT` | Custom user agent string (applies when credentials are configured) | No | - |
 
 #### Server Configuration
@@ -473,8 +623,47 @@ $(npm prefix -g)/bin/reddit-mcp-buddy
 | `REDDIT_BUDDY_ALLOWED_HOSTS` | Comma-separated `host:port` values accepted in the Host header (DNS-rebinding protection) | loopback values when bound to localhost |
 | `REDDIT_BUDDY_NO_CACHE` | Disable caching (always fetch fresh) | `false` |
 
+#### Posting (v1.2.0)
+| Variable | Description | Default |
+|----------|-------------|---------|
+| `REDDIT_BUDDY_WRITE` | Register the [posting tools](#posting-v120); requires env user credentials, verified identity and scopes, and stdio | `false` |
+| `REDDIT_BUDDY_MAX_POSTS_PER_HOUR` | Posts per hour; only values from 1 to 4 are honored (0 and invalid values are ignored) | `5` |
+| `REDDIT_BUDDY_MAX_COMMENTS_PER_HOUR` | Comments per hour; only values from 1 to 29 are honored (0 and invalid values are ignored) | `30` |
+| `REDDIT_BUDDY_MIN_WRITE_INTERVAL_S` | Seconds between writes; only values ABOVE 15 are honored | `15` |
+
+The three rate-floor variables can only tighten the built-in caps. Setting them looser than the defaults does nothing, on purpose, and 0 does not mean "pause posting": it falls back to the default cap.
+
 > **HTTP mode has no authentication.** It binds to localhost so only your machine can reach it, and rejects Host headers outside the loopback set. Setting `REDDIT_BUDDY_HOST=0.0.0.0` exposes it to your whole network - only do that on a trusted network (e.g. inside Docker, which sets it deliberately). On a non-loopback bind the Host check is off by default, since clients legitimately arrive with a container IP or service name; set `REDDIT_BUDDY_ALLOWED_HOSTS` to restrict it. Browser requests are rejected unless their origin is listed in `REDDIT_BUDDY_ALLOWED_ORIGINS`; non-browser clients like Postman are unaffected.
 
+### HTTP and HTTPS Proxies
+
+On Node 22.21.0+ in the 22.x line, or Node 24 and newer, enable Node's built-in proxy support before starting the server. The project's Node 26 Docker image supports this. Check `node --version` first: unsupported versions can ignore these settings and connect directly. Node currently marks this feature as under active development.
+
+```json
+{
+  "mcpServers": {
+    "reddit": {
+      "command": "npx",
+      "args": ["-y", "reddit-mcp-buddy"],
+      "env": {
+        "NODE_USE_ENV_PROXY": "1",
+        "HTTP_PROXY": "http://proxy.example.com:8080",
+        "HTTPS_PROXY": "http://proxy.example.com:8080",
+        "NO_PROXY": "localhost,127.0.0.1"
+      }
+    }
+  }
+}
+```
+
+`HTTP_PROXY` routes HTTP requests; `HTTPS_PROXY` routes HTTPS requests, including Reddit API and RSS calls. `NO_PROXY` excludes matching hosts. Export these variables in your shell for CLI use, or pass them with Docker's `-e` options. Set them in the process environment before startup; the server does not load a project `.env` file automatically.
+
+Inside Docker, `localhost` refers to the container. On Docker Desktop, use `host.docker.internal` to reach a proxy running on the host.
+
+Proxy authentication can be included in the proxy URL as `http://username:password@proxy.example.com:8080`. Treat that value as a credential and redact it from shared logs and configuration. For a network that uses a private certificate authority, use `NODE_EXTRA_CA_CERTS` with your organization's PEM certificate file instead of disabling TLS verification.
+
+See [Node's proxy and certificate configuration guide](https://nodejs.org/learn/http/enterprise-network-configuration). Proxy support routes network traffic; it does not grant Reddit API approval or bypass Reddit's access rules.
+
 ## Technical Details
 
 ### Smart Caching System
@@ -482,7 +671,7 @@ $(npm prefix -g)/bin/reddit-mcp-buddy
 Reddit MCP Buddy includes intelligent caching to improve performance and reduce API calls:
 
 - **Memory Safe**: Hard limit of 50MB - won't affect your system performance
-- **Per-Content TTLs**: Post details (10min), user profiles (15min), search results (10min); subreddit listings use the mode default (15min anonymous, 5min with credentials)
+- **Per-Content TTLs**: Post details (10min), user profiles (15min), search results (10min); subreddit listings use the mode default (5min with credentials)
 - **LRU Eviction**: Automatically removes least-used data when approaching limits
 - **Hit Tracking**: Optimizes cache based on actual usage patterns
 
@@ -511,15 +700,12 @@ npm run test:rate-limit:anon  # Test anonymous mode (10 rpm)
 npm run test:rate-limit:app   # Test app-only mode (60 rpm)
 npm run test:rate-limit:auth  # Test authenticated mode (100 rpm)
 
-# Lint
-npm run lint
-
 # Type check
 npm run typecheck
 ```
 
 ### Requirements
-- Node.js >= 18.0.0
+- Node.js >= 20.0.0
 - npm or yarn
 - TypeScript 5.5+
 
@@ -572,4 +758,4 @@ MIT - Use it however you want!
 
 Made with ❤️ for the MCP community. No venture capital, no tracking, just a good MCP server.
 
-Built by [Karan Bansal](https://karanbansal.in) (Head of AI at ArmorCode). I write about Claude Code, MCP, and production agentic AI at [karanbansal.in/blog](https://karanbansal.in/blog/).
+Built by [Karan Bansal](https://karanbansal.in) (Head of AI at ArmorCode). I write about Claude Code, MCP, and production agentic AI at [karanbansal.in/blog](https://karanbansal.in/blog/).