X API MCP (xmcp)
X API FastMCP Server
A local FastMCP server turns the X platform OpenAPI spec into tools: searching and publishing posts, messages, lists and bookmarks
- 864 ★ on the repository
- Last commit
Broad access
Why this level
- The agent publishes and deletes posts, likes, follows and sends messages as the account: write tools are on until an allowlist is set
- The app key, secret and token sit in `.env`, and debug flags can print user tokens
- The server listens on local port 8000 and any MCP client connected to it gets every enabled tool
Install
- Works in
Manual install
python server.pyStarts the server. The client connects to `http://127.0.0.1:8000/mcp`. A browser opens on start for OAuth1 consent.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The agent publishes and deletes posts, likes, follows and sends messages as the account: write tools are on until an allowlist is set
- The app key, secret and token sit in `.env`, and debug flags can print user tokens
- The server listens on local port 8000 and any MCP client connected to it gets every enabled tool
This is third-party code. Review the repository files before installing.
What it does
The server from the X Developer Platform organization is a small Python script, `server.py`, built on the FastMCP library. On start it downloads the OpenAPI spec from `https://api.twitter.com/2/openapi.json`, drops streaming and webhook operations and turns the rest into MCP tools. The documentation lists 119 names: `searchPostsRecent`, `getUsersByUsername`, `createPosts`, `deletePosts`, `likePost`, `followUser`, `sendChatMessage`, `createDirectMessagesByConversationId`, lists, bookmarks, post analytics, spaces, news and more. It needs tokens of an app on the X Developer Platform: `X_OAUTH_CONSUMER_KEY`, `X_OAUTH_CONSUMER_SECRET` and `X_BEARER_TOKEN`. On start the server opens OAuth1 consent in a browser and waits for the reply at the local address `http://127.0.0.1:8976/oauth/callback`, which you have to register in the app. User tokens live only in process memory. The MCP endpoint is available at `http://127.0.0.1:8000/mcp`. The tool set can be narrowed: the `X_API_TOOL_ALLOWLIST` variable takes comma-separated names, for example `getUsersByUsername,createPosts,searchPostsRecent`. The filter applies at startup, so restart the server after a change. The repository also has an optional test client, `test_grok_mcp.py`, which connects the Grok model to the server through the `XAI_API_KEY` key.
Who it is for. For developers and analysts with an app on the X Developer Platform who want to give an agent access to an account's posts, messages and lists.
Good fit when
- An agent needs to search fresh posts with `searchPostsRecent` and read profiles through `getUsersByUsername`
- You need post and account metrics: the list includes `getPostsAnalytics`, `getMediaAnalytics` and `getInsights28Hr`
- An agent should publish posts, like and follow, but only from an allowlist: `X_API_TOOL_ALLOWLIST` keeps the tools you need
- You need to manage account lists and bookmarks: there are `createLists`, `addListsMember`, `createUsersBookmark` and the reverse operations
- The integration has to be tested on the Grok model: the repository ships the `test_grok_mcp.py` client
Not a fit when
- You have no app on the X Developer Platform: without app tokens the server will not start
- You need streaming data and webhooks: the server excludes every operation with `/stream` and `/webhooks`
- You need read-only work with minimal access: by default the server also exposes write tools, which you have to remove with the `X_API_TOOL_ALLOWLIST` list
- You need clarity about code rights: the repository has no license file
Example request
Find the latest posts mentioning Claude Code and show the top by likes, publish nothingMCP
- Transport
- http
- Authentication
- OAuth
Environment variables
X_OAUTH_CONSUMER_KEYrequired- App key from the X Developer Platform.
X_OAUTH_CONSUMER_SECRETrequired, secret- App secret.
X_BEARER_TOKENrequired, secret- App bearer token, required even when signing in through OAuth1.
X_API_TOOL_ALLOWLIST- Comma-separated tool names to load.
Limitations
- The author did not specify a license, rights to use and copy are undefined, check with the author.
- The documentation lists three required values: the app key and secret plus `X_BEARER_TOKEN`. The last one is needed even if you sign in through OAuth1.
- On start the server opens a browser for OAuth1 consent and waits 300 seconds by default (`X_OAUTH_CALLBACK_TIMEOUT`); without consent the tools acting for the user are unavailable.
- Debug is on by default (`X_API_DEBUG=1`). The `X_OAUTH_PRINT_TOKENS` and `X_OAUTH_PRINT_AUTH_HEADER` flags print tokens and authorization headers, so turn them on only for diagnostics.
- The `generate_authtoken.py` script for an OAuth2 token is described in the documentation but is missing from the repository tree.
- For a remote client the documentation suggests an ngrok tunnel and does not describe how the server address is protected.
How to disable. Stop the `python server.py` process and remove the server entry from the MCP client config. Delete or clear the `.env` file with the app keys. App permissions can be revoked in the X Developer Platform console.
FAQ
Where do the server's tools come from?
From the OpenAPI spec that the server downloads on every start from `https://api.twitter.com/2/openapi.json`. Operations with `/stream`, `/webhooks` and the `Stream` and `Webhooks` tags are excluded. The tool set follows the current spec, so the list in the documentation may lag behind.
How do I keep only safe read tools?
Set `X_API_TOOL_ALLOWLIST` in `.env` with names, for example `getUsersByUsername,searchPostsRecent`, and restart the server. While the list is empty all tools load, including `createPosts` and `deletePosts`.
What do I have to register in the X app?
A callback address of the form `http://<X_OAUTH_CALLBACK_HOST>:<X_OAUTH_CALLBACK_PORT><X_OAUTH_CALLBACK_PATH>`. By default that is `http://127.0.0.1:8976/oauth/callback`.
Where are user tokens stored?
Only in the memory of the server process while it runs. OAuth1 tokens are not written to disk. For OAuth2 you can put `X_OAUTH_ACCESS_TOKEN` into `.env` by hand.
How do I connect a remote client?
The documentation suggests forwarding the local port through a tunnel, for example `ngrok http 8000`, and using the public address that ends in `/mcp`. Before you do that, note that the documentation does not describe protection for this address.
Discussion
No questions or reviews yet.
Related
MCP serversMCP server of the OpenPost social scheduler: an agent reviews the calendar and accounts, drafts, schedules and publishes posts and triages comments
Self-hosted MCP server for xiaohongshu: publish notes and videos, search, read feeds, comment, like and favorite from an agent
Instagram MCP
instagram-mcp
An MCP server for the Instagram Graph API: the agent publishes posts, carousels and reels, replies to comments and reads business account analytics
MCP autoposting for Telegram, VK and TenChat
Customer MCP Autoposting
An MCP server publishes one text at once to Telegram, VKontakte (group and personal wall) and TenChat with a single publish_all call
Telegram API MCP
telegram-api-mcp
MCP server for the Telegram Bot API: messages, channels, forums, payments and long posts from a bot, with Telegram rate limits built in
The official remote MCP server of Metricool: the agent publishes posts, reads social analytics and runs ad campaigns
Comparison with similar tools
Entries that share the main search query, and how they differ.
| Entry | Official | Authentication | Repository stars | Main difference |
|---|---|---|---|---|
| X API MCP (xmcp) (this entry) | yes | OAuth | 864 | |
| x-research | no | 1,242 | a skill with a Bun command for searching posts, threads and profiles through the X API, with a cache and cost estimate; xmcp exposes the whole API as MCP tools, including writes | |
| Agent Reach | no | 100,672 | reads and searches Twitter, Reddit, YouTube and other networks without paid APIs; xmcp works with X only and through the official API |
README in short
The documentation covers prerequisites, a local setup with a table of environment variables, registering the callback address, starting the server and connecting a client. It continues with tool filtering, how the OAuth1 start works, the full list of tool names to copy into the allowlist, getting an OAuth2 token, the Grok test client and notes on exclusions. The repository has five files: the server itself, the test client, the dependency list, a `.env` sample and the documentation. There are no tests.