redditapis-mcp 0.5.1 → 0.5.3

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 0.5.2 (2026-09-06)
+
+### Added
+
+- **`reddit_post_visibility`.** Is a post still publicly visible, or did it quietly stop being so? A removed Reddit post still returns when you fetch it by id, with its title and score, so asking the post does not answer the question. This fetches the post and then one page of its author's submitted listing and compares them, returning a verdict of `live`, `not_visible` or `undecidable` with a plain-language reason and a `confident` flag. It never says WHY a post is not visible: a moderator removal, an admin removal, a spam filter and an author who has hidden their post history are indistinguishable from outside, and only one of them is a removal. `undecidable` is a real answer, not a failure. Two upstream calls, billed as one request at $0.004.
+
 ## 0.5.1 (2026-09-06)
 
 ### Fixed

package/README.md

@@ -139,6 +139,7 @@ A few conventions across the catalog:
 
 | Tool | Endpoint | What it does |
 |---|---|---|
+| `reddit_post_visibility` | `GET /api/reddit/post/{id}/visibility` | Is a post still publicly visible, or did it quietly stop being so? Fetches the post and one page of its author's listing and compares. Returns `live`, `not_visible` or `undecidable` with a reason, and never claims to know WHY. Two upstream calls, $0.004. |
 | `reddit_post` | `GET /api/reddit/post/{id}` | A single post by its base-36 `id` (no `t3_` prefix): title, author, score, text, permalink, subreddit, url. |
 | `reddit_post_comments` | `GET /api/reddit/comments` | A post plus its full threaded comment tree, fetched by `permalink`. |
 | `reddit_by_id` | `GET /api/reddit/by_id/{fullnames}` | Bulk-hydrate up to 100 posts in one call from a comma-separated list of `t3_` fullnames. |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "redditapis-mcp",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "mcpName": "io.github.redditapis/redditapis-mcp",
   "description": "Official MCP server for redditapis.com. Search Reddit posts, comments, communities, users and media; read subreddits, comment trees, top posts and profiles; create and manage monitors and webhooks. Native tools for Claude, Cursor and any MCP client.",
   "repository": {
@@ -26,7 +26,7 @@
   "scripts": {
     "start": "node src/index.js",
     "check": "node --check src/index.js && node --check src/tools.js && node --check src/feedback.js",
-    "test": "node test/tools.test.mjs && node test/feedback.test.mjs && node test/index-lasterror.test.mjs",
+    "test": "node test/tools.test.mjs && node test/feedback.test.mjs && node test/index-lasterror.test.mjs && node test/scannable-without-key.test.mjs",
     "prepublishOnly": "node scripts/prepublish-tenant-check.mjs"
   },
   "dependencies": {

package/src/index.js

@@ -39,11 +39,25 @@ const REQUEST_TIMEOUT_MS = Number(process.env.REDDITAPIS_TIMEOUT_MS || 30000);
 // User-Agent and MCP server handshake understated its own version for months.
 const { version: VERSION } = createRequire(import.meta.url)("../package.json");
 
+// WARN AND CONTINUE, NEVER exit. A registry scanner spawns the server and calls
+// tools/list to enumerate what it offers, and tools/list is the DISCOVERY step
+// in the MCP spec: it comes before tool selection and before any invocation, so
+// it needs no credential. Exiting here answers that scan with nothing.
+//
+// This is not a hypothesis. Measured 2026-09-06 by speaking raw MCP stdio to
+// the published redditapis-mcp@0.5.2 with an empty env: initialize was never
+// answered and tools/list returned nothing, because this line fired first. A
+// scanner that behaves this way reports the server as uninspectable rather than
+// as having no tools, so the listing carries no catalog at all.
+//
+// NOT a security relaxation. This is a stdio server: whoever spawns it already
+// has local execution, so there is no unauthenticated party to expose anything
+// to. A real tool CALL with no key still fails clearly, at the point of the
+// call, exactly as it already does for a WRONG key (see the 401 branch below).
 if (!API_KEY) {
   console.error(
-    "[reddit-mcp] Missing REDDITAPIS_KEY. Get a key at https://www.redditapis.com and set it in your MCP client config.",
+    "[reddit-mcp] Missing REDDITAPIS_KEY. Get a key at https://www.redditapis.com and set it in your MCP client config. Tools are registered but every call will fail until it is set.",
   );
-  process.exit(1);
 }
 
 // The last tool call that failed, so a feedback draft can carry the endpoint,
@@ -90,6 +104,20 @@ export function hintFor(status, path) {
 }
 
 async function callEndpoint(pathTemplate, args, method = "GET", tool = null) {
+  // The credential check MOVED HERE from startup, so listing tools needs no key
+  // and calling one still cannot silently proceed without it. Without this the
+  // relaxation above would send an Authorization header reading "Bearer
+  // undefined" and the caller would read a 401 about an INVALID key when the
+  // real answer is that no key was ever set.
+  if (!API_KEY) {
+    return {
+      isError: true,
+      content: [{
+        type: "text",
+        text: "Missing REDDITAPIS_KEY (no API key is set; get one at https://www.redditapis.com and set it in your MCP client config).",
+      }],
+    };
+  }
   const { path, rest: pathRest } = buildPath(pathTemplate, args);
   // A tool that declares `sessionHeaders` has its Reddit session args lifted
   // out of the query and onto headers. For every other tool this is the

package/src/tools.js

@@ -290,6 +290,21 @@ export const TOOLS = [
       sort_type: z.enum(["score", "num_comments", "created"]).optional().describe("Re-sort the filtered page (descending) by this field."),
     },
   },
+  {
+    name: "reddit_post_visibility",
+    path: "/api/reddit/post/:id/visibility",
+    description:
+      "Is a post still publicly visible, or did it quietly stop being so? A removed Reddit post still " +
+      "returns when you fetch it by id, so asking the post does not answer this. This fetches the post " +
+      "and then one page of its author's submitted listing and compares them. Returns a verdict of live, " +
+      "not_visible or undecidable, a plain-language reason, and a confident flag. It deliberately never " +
+      "says WHY a post is not visible: a moderator removal, an admin removal, a spam filter and an author " +
+      "who has hidden their history are indistinguishable from outside. undecidable is a real answer, not " +
+      "a failure. Two upstream calls, billed as one $0.004 dual read.",
+    shape: {
+      id: z.string().min(1).describe("Reddit post id, base36, with or without the t3_ prefix"),
+    },
+  },
   {
     name: "reddit_post_comments",
     path: "/api/reddit/comments",