Reddit MCP Server: why it is not safe to use

What we found

Our review did not find hidden instructions, hardcoded secrets, undisclosed external destinations, or signs of obfuscation. Network use appears consistent with the stated Reddit API integration, and the repo documents optional localhost serving.

The reason this skill did not pass cleanly is narrower. In the inspected code and docs, the skill exposes write actions including `delete_post` and `delete_comment`, which are permanent actions, and we did not see an evident built-in confirmation step before those deletions. We also found that the skill reads Reddit credentials from environment variables and can access the authenticated user’s account data, including saved items that the repo docs describe as private.

What to do instead

Use this skill only with a Reddit account you intend to grant access to, and review exactly which credentials and scopes you provide. Prefer read-only use where possible, and avoid enabling write actions unless you have an external approval step for destructive operations. If you need deletion features, add a clear confirmation or human review checkpoint before any irreversible action runs.