Community source release (MIT). Self-host using your own credentials. No NabuxAI production accounts or hosted-service access are included.

X MCP by Nabux

Managed multi-user MCP gateway for the official X API v2.

Production target: https://x.nabuxai.com
MCP endpoint: https://x.nabuxai.com/mcp

Why this exists when X already has XMCP

X publishes an official XMCP server that generates 200+ MCP tools from X's official OpenAPI spec. XMCP is excellent for local/single-user use, but its current implementation keeps OAuth credentials in memory and is not a hosted multi-tenant token vault.

Nabux keeps the official X API surface but adds:

• multi-user / multi-account storage

• OAuth 2.0 Authorization Code + PKCE

• encrypted access and refresh tokens

• offline.access token refresh

• owner-isolated MCP auth

• local cache/search for retrieved posts/mentions/DM events

• a controlled generic x_api_request for additional official X API v2 endpoints

Related MCP server: XMCP

MCP tools

• x_accounts

• x_profile

• x_search_recent

• x_my_posts

• x_mentions

• x_create_post

• x_delete_post

• x_like

• x_unlike

• x_follow

• x_unfollow

• x_dm_events

• x_dm_conversation

• x_send_dm

• x_search_cached_data

• x_api_request

x_api_request accepts only relative X API v2 paths and cannot call arbitrary hosts.

OAuth scopes

Default requested scopes:

tweet.read
tweet.write
users.read
offline.access
dm.read
dm.write
like.read
like.write
follows.read
follows.write
bookmark.read
bookmark.write
list.read
list.write
media.write

Reduce this list in production if your Meta-style least-privilege product tier does not need all actions.

OAuth callback:

https://x.nabuxai.com/x/callback

Data collection

Live official X API reads can be cached into the local database for MCP search. Recent-search results, mentions, owned posts and DM events are cacheable. This is API-backed collection, not cookie/session scraping.

X's DM lookup API currently exposes recent DM events rather than an unlimited personal-history archive, so the gateway should continuously ingest/call the official API if long-term retention is desired.

Coolify

Deploy branch feature/x-mcp-gateway with docker-compose.coolify.yml and route x.nabuxai.com to port 8000.

Required environment:

PUBLIC_BASE_URL=https://x.nabuxai.com
APP_SECRET_KEY=<32+ random chars>
X_CLIENT_ID=<X OAuth2 client id>
X_CLIENT_SECRET=<optional/required for confidential client configuration>
X_REDIRECT_URI=https://x.nabuxai.com/x/callback
INTERNAL_SERVICE_TOKEN=<random secret>

Access/refresh tokens are encrypted at rest. MCP bearer tokens are stored hashed.

Status

Production-shaped code; real E2E requires an X Developer app with OAuth 2.0 enabled, the exact callback URL registered, sufficient API credits/access for the endpoints used, and an authorized X account.