Permissions, security and managing connections

Handing an AI assistant access to a business account deserves a straight answer about what it can actually do. This article gives you the full boundaries, including the things we deliberately do not allow, then shows you where to see and revoke everything you have connected.

This is the important one. Your assistant can find threads, read them and draft replies. It cannot post, comment, vote or send a DM on Reddit. A human reviews every draft and posts it from their own Reddit account.

This is not a setting you can switch on, and it is not on our roadmap. Automated posting is the fastest way to get a Reddit account banned and a brand burned, and it is exactly the behaviour subreddit moderators look for. We do not offer automated posting, upvote manipulation or multi-account comment networks.

The value is in finding the right thread and writing something genuinely good. Not in the clicking.

A connection inherits your own permissions exactly. It can see the projects your Redreach login can see, and nothing else. If a teammate connects their own assistant, theirs sees their projects.

It cannot:

Your assistant can mark a Reddit thread as replied or ignored. That is the only write it is capable of, and your AI tool asks permission the first time.

Worth knowing: that status is shared with your whole team. When your assistant marks a thread handled, it disappears from everyone's queue in the dashboard. That is the point, it stops two people writing a reply to the same thread, but it does mean the change is not private to you.

Worth being clear about, because it is easy to overlook. When your assistant fetches Redreach data, that data travels to whichever AI company you are using. Ask Claude for your mention report and the mention report goes to Anthropic. Ask ChatGPT and it goes to OpenAI.

That is how every MCP connection works, not something specific to Redreach. It is the same consideration as pasting a spreadsheet into a chat. If your organisation has rules about which data may go to which AI provider, Reddit mention data and your outreach CRM fall under those rules too.

Your assistant sees the slice of Reddit that Redreach monitors for your project: threads ranking on Google for your keywords, fresh threads matching the keywords you track, and threads where you or your competitors are mentioned.

It cannot search all of Reddit, browse a subreddit freely, or open an arbitrary thread you found somewhere else. If you paste in a Reddit link that Redreach has not indexed for your project, your assistant will tell you it cannot find it.

Want it to cover more ground? Add keywords or competitors in your Redreach settings. Monitoring picks them up and the connection sees the results automatically.

Your leads and outreach stats come from the Redreach Chrome extension, and the extension only sends data while it is open.

If you have not opened it in a while, your assistant will flag that the numbers may be out of date and suggest opening the extension to sync.

Every connection is rate limited so a runaway agent loop cannot hammer your account. Normal conversation never comes close.

If you do hit it, your assistant gets a message telling it how many seconds to wait, and it can simply try again.

In Redreach, go to Account Settings → MCP. Every AI tool you have approved appears under Connected clients & tokens at the bottom of the page, and apps you approve show up there automatically.

Revoking a row disconnects that app. It stops working within about a minute, everywhere. Nothing else is affected: your other connections keep working, and your normal dashboard login is untouched.

Worth doing when you are no longer using a tool you connected months ago, when you set something up on a computer you no longer have, or if you suspect a token ended up somewhere it should not have. If you disconnect something by accident, just connect it again.

Most tools connect through your browser and never need a token. Three situations still do:

Create one at the bottom of the Account Settings → MCP tab. For scripts, the API tab has a Create API key button that does the same thing, because an MCP token and an API key are the same credential. One works everywhere the other does.

The token starts with rr_ and goes wherever your tool asks for headers:

One token per place. Separate tokens mean you can kill exactly one thing without breaking the others.

Name them properly. "Token 1" tells you nothing in six months. "Codex on my laptop" tells you whether it is safe to delete.

Never commit one to a repository. If a token ends up in a public repo or a shared document, delete it in Redreach and create a new one. Deleting is instant and free.

Rotate when someone leaves. Tokens belong to the person who made them.

Ten tokens per account, counting both connected apps and manual tokens. If you hit the limit, delete something you no longer use. Most people never get close.

Tokens do not expire. They keep working until you delete them or your subscription lapses.

Tokens are personal. A token can only see the projects its owner can already see, which is why each person should create their own rather than sharing one.

MCP and REST API access are included on the Growth, Professional and Agency plans. If your subscription lapses or you downgrade below Growth, connections stop working until it is renewed. Your assistant will say the project has no API access rather than failing silently.

Your connections are not deleted. They start working again as soon as the plan is active.

Something not working? → Fixing a Redreach MCP connection that won't work

Building your own scripts instead? → Using the Redreach REST API