redditapis-mcp 0.3.0 → 0.3.2

package/CHANGELOG.md

@@ -1,5 +1,54 @@
 # Changelog
 
+## 0.3.2
+- **Security: 10 Dependabot alerts closed (3 high, 6 moderate, 1 low)**, all in
+  transitive dependencies pulled in by `@modelcontextprotocol/sdk` (never a
+  direct dependency of this package): `hono` (SSR output cross-user
+  disclosure, ReDoS in CORS/language middleware, header handling in the proxy
+  helper), `fast-uri` (host confusion via a backslash authority delimiter),
+  `ip-address` (three separate SSRF/trust-boundary bypasses via octal,
+  IPv4-mapped, and CIDR-suffix address confusion), and `@hono/node-server`
+  (path traversal on Windows). Fixed by a clean reinstall against the
+  existing `@modelcontextprotocol/sdk: ^1.0.0` range, which already permitted
+  the patched versions; no version constraint changed, only the resolved
+  tree (SDK 1.29.0 to 1.30.0, hono to 4.13.2, fast-uri to 3.1.5, ip-address
+  to 10.5.0, @hono/node-server to 2.1.1). This server only imports the SDK's
+  stdio transport (confirmed: `src/index.js` never imports `hono` or the
+  SDK's HTTP transport), so `hono` and `@hono/node-server` never load at
+  runtime here; `fast-uri` and `ip-address` sit deeper in the SDK's own
+  dependency tree and were not individually traced. Fixed regardless, since
+  Dependabot flags them independent of reachability and a clean scan is
+  the point.
+
+## 0.3.1
+- **Fix: the server no longer exits at startup when `REDDITAPIS_KEY` is missing.**
+  A registry connectivity scanner (Smithery, Glama, the official MCP registry,
+  Claude Connectors Directory) spins up the server with no real credential to
+  enumerate `tools/list`. Exiting before the transport connects made every
+  automated scan fail outright and read as a generic connectivity error rather
+  than a missing-key error, which is most of why this listing scored low on
+  every registry's capability-quality checks. Tools now register and
+  `tools/list` responds regardless of whether a key is present; an actual tool
+  call with no key still fails clearly, at the point of the call, with the
+  same style of message the existing 401 branch already used.
+- Adds `server.json` (official MCP server manifest: description, homepage,
+  repository, npm package identifier, and the `REDDITAPIS_KEY` config field
+  with a title and description) to the repo and to the published package, so
+  registry submissions have a durable, versioned source instead of a local,
+  never-committed file.
+
+## 0.3.0
+- 4 new READ tools for the caller's own private Reddit listings (upvoted,
+  saved, hidden, gilded), each requiring the caller's own Reddit session
+  cookie obtained via `POST /api/reddit/login`.
+- Pagination docs clarified across every listing tool: `listing_status` on the
+  final page distinguishes `complete` (nothing missing) from `truncated`/
+  `unknown` (Reddit stopped serving a busy listing early), so a client no
+  longer reads a null `after` cursor as proof of a complete result set.
+- This CHANGELOG entry is retroactive; 0.3.0 published without one, along with
+  drifting one npm publish ahead of what GitHub had committed. Both are
+  corrected as part of the 0.3.1 pass.
+
 ## 0.2.0
 - **10 new monitor/webhook management tools** (task #43), the first WRITES this
   catalog has ever carried. Unlike the reddit comment/vote/DM writes this MCP

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "redditapis-mcp",
-  "version": "0.3.0",
+  "version": "0.3.2",
   "mcpName": "io.github.redditapis/redditapis-mcp",
   "description": "Official MCP server for redditapis.com, the Reddit API (subreddit listings, post + comment + community + user + media search, comment trees, top posts, user profiles) plus monitor/webhook management (create/list/update/remove a monitor, register/test/delete a webhook, read delivery history) as native tools for Claude, Cursor, and any MCP client.",
   "repository": {
@@ -18,7 +18,8 @@
     "README.md",
     "LICENSE",
     "CHANGELOG.md",
-    "smithery.yaml"
+    "smithery.yaml",
+    "server.json"
   ],
   "engines": {
     "node": ">=18"

package/server.json

@@ -0,0 +1,30 @@
+{
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
+  "name": "io.github.redditapis/redditapis-mcp",
+  "description": "Reddit API as MCP tools: search, subreddits, posts, comments, users, monitors, and webhooks.",
+  "title": "RedditAPIs",
+  "version": "0.3.2",
+  "websiteUrl": "https://www.redditapis.com",
+  "repository": {
+    "url": "https://github.com/redditapis/redditapis-mcp",
+    "source": "github"
+  },
+  "packages": [
+    {
+      "registryType": "npm",
+      "identifier": "redditapis-mcp",
+      "version": "0.3.2",
+      "transport": {
+        "type": "stdio"
+      },
+      "environmentVariables": [
+        {
+          "name": "REDDITAPIS_KEY",
+          "description": "Your redditapis.com API key. Get one at https://www.redditapis.com",
+          "isRequired": true,
+          "isSecret": true
+        }
+      ]
+    }
+  ]
+}

package/src/index.js

@@ -33,11 +33,19 @@ const REQUEST_TIMEOUT_MS = Number(process.env.REDDITAPIS_TIMEOUT_MS || 30000);
 // User-Agent and MCP server handshake understated its own version for months.
 const { version: VERSION } = createRequire(import.meta.url)("../package.json");
 
+// Lazy validation, not exit-on-boot: an MCP registry scanner (Smithery, Glama,
+// the official registry, Claude Connectors) connects the stdio transport with
+// no real credential to enumerate tools/list. Exiting here before the server
+// ever registers a tool makes that handshake fail outright and reads as a
+// generic connectivity error, not a missing-key error, on the scanner side --
+// confirmed live 2026-08-18 (Smithery: "Initialization failed... could not be
+// automatically scanned", HTTP 404). Warn and continue; a real tool CALL made
+// with no key still fails clearly, at the point of the call, same as it
+// already does for a bad key (see the 401 branch below).
 if (!API_KEY) {
   console.error(
-    "[reddit-mcp] Missing REDDITAPIS_KEY. Get a key at https://www.redditapis.com and set it in your MCP client config.",
+    "[reddit-mcp] Missing REDDITAPIS_KEY. Get a key at https://www.redditapis.com and set it in your MCP client config. Tools are registered but every call will fail until it is set.",
   );
-  process.exit(1);
 }
 
 // REST call. Resolves any {param} path placeholders from args, and for GET
@@ -46,6 +54,15 @@ if (!API_KEY) {
 // `filterSpecFields`). Forwards the API key as a Bearer token (redditapis.com
 // authenticates via `Authorization: Bearer <key>` only).
 async function callEndpoint(pathTemplate, args, method = "GET", tool = null) {
+  if (!API_KEY) {
+    return {
+      isError: true,
+      content: [{
+        type: "text",
+        text: "Missing REDDITAPIS_KEY (invalid or missing API key, get one at https://www.redditapis.com and set it in your MCP client config).",
+      }],
+    };
+  }
   const { path, rest } = buildPath(pathTemplate, args);
   const isWrite = method !== "GET";
   const q = isWrite ? "" : buildQuery(rest);