
Company News
Socket Joins New OpenJS Program to Fund Node.js Security Work
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.
threadfox-lite
Advanced tools
Read a subreddit's rules and check whether a Reddit post is still up, from Claude Code, Codex or any MCP client. Free tools from ThreadFox.
Free, read-only Reddit tools for Claude Desktop, Claude Code, Codex and any MCP client, plus a reddit-rules-first agent skill.
subreddit_rules: a subreddit's rules, size and description, with the self-promotion rules flagged. Call it before writing a post.find_communities: subreddits about a topic ("bakery marketing", "indie games"), each with its self-promotion rules flagged and whether it mentions a promo thread.account_check: a Reddit account's age, karma and standing, and whether its recent posts are removed or hidden from search (the practical sign of a spam filter or shadowban).post_status: whether a post is still live, removed by moderators or deleted, with score and comments. Check at 1, 6 and 24 hours.threadfox_full_kit: what the full ThreadFox kit adds (finding conversations where people ask for what you sell, posting from your own Chrome, replies, an outcome ledger, a 12-module course).Reads only, through your own signed-in Chrome. Reddit now sends every signed-out request, including its public JSON, to a login page, so ThreadFox Lite reads the way you do: in your Chrome, signed in as you, one small read at a time. It never posts, votes or changes anything, and needs no Reddit API keys. One-time setup: Microsoft's Playwright Extension in the Chrome where you are signed in to Reddit. Node.js is fetched for you if you don't have it (the official build from nodejs.org into ~/.threadfox/runtime, checked against its published SHA-256; nothing installed system-wide). It stays light on your computer: one Reddit read at a time across every ThreadFox app on the machine, and its Chrome connection closes after 10 idle minutes and never leaves background processes behind. The first read asks you to pick a tab in Chrome.
Claude Code plugin (the tools and the skill together):
/plugin marketplace add amflimited/threadfox-lite
/plugin install threadfox-lite@threadfox
Claude Code, the MCP server only:
claude mcp add threadfox-lite -- uvx threadfox-lite
Claude Desktop: download the .mcpb file from the latest release and open it; if Windows asks which app should open it, choose Claude. Claude Desktop sets up Python for it by itself.
Codex (~/.codex/config.toml):
[mcp_servers.threadfox-lite]
command = "uvx"
args = ["threadfox-lite"]
Any other MCP client: run uvx threadfox-lite (the package is on PyPI).
Bought ThreadFox on MCP Marketplace? Set MCP_LICENSE_KEY to your key, ask your AI to run threadfox_full_kit, or go straight to https://threadfox.vip/redeem.
skills/reddit-rules-first/SKILL.md works on its own in any agent that reads skills: rules first, one post per community, disclose, check what stayed up. Install it anywhere with npx skills add amflimited/threadfox-lite.
Also listed in the official MCP Registry as io.github.amflimited/threadfox-lite.
Made by AMF Indiana, the team behind ThreadFox (https://threadfox.vip). Built from our own run: 978,227 recorded views from two days of posts (Sept 20-21 UTC), with no ad spend. Not affiliated with Reddit, OpenAI or Anthropic. MIT licence.
FAQs
Read a subreddit's rules and check whether a Reddit post is still up, from Claude Code, Codex or any MCP client. Free tools from ThreadFox.
We found that threadfox-lite demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Company News
Socket is joining the OpenJS Security Stewardship Program to fund Node.js vulnerability research, maintainer remediation, and security releases.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.