> **Community source release (MIT).** Self-host using your own credentials. No NabuxAI production accounts or hosted-service access are included.

# X MCP by Nabux

Managed multi-user MCP gateway for the official X API v2.

Production target: `https://x.nabuxai.com`  
MCP endpoint: `https://x.nabuxai.com/mcp`

## Why this exists when X already has XMCP

X publishes an official XMCP server that generates 200+ MCP tools from X's official OpenAPI spec. XMCP is excellent for local/single-user use, but its current implementation keeps OAuth credentials in memory and is not a hosted multi-tenant token vault.

Nabux keeps the official X API surface but adds:

- multi-user / multi-account storage
- OAuth 2.0 Authorization Code + PKCE
- encrypted access and refresh tokens
- `offline.access` token refresh
- owner-isolated MCP auth
- local cache/search for retrieved posts/mentions/DM events
- a controlled generic `x_api_request` for additional official X API v2 endpoints

## MCP tools

- `x_accounts`
- `x_profile`
- `x_search_recent`
- `x_my_posts`
- `x_mentions`
- `x_create_post`
- `x_delete_post`
- `x_like`
- `x_unlike`
- `x_follow`
- `x_unfollow`
- `x_dm_events`
- `x_dm_conversation`
- `x_send_dm`
- `x_search_cached_data`
- `x_api_request`

`x_api_request` accepts only relative X API v2 paths and cannot call arbitrary hosts.

## OAuth scopes

Default requested scopes:

```text
tweet.read
tweet.write
users.read
offline.access
dm.read
dm.write
like.read
like.write
follows.read
follows.write
bookmark.read
bookmark.write
list.read
list.write
media.write
```

Reduce this list in production if your Meta-style least-privilege product tier does not need all actions.

OAuth callback:

```text
https://x.nabuxai.com/x/callback
```

## Data collection

Live official X API reads can be cached into the local database for MCP search. Recent-search results, mentions, owned posts and DM events are cacheable. This is API-backed collection, not cookie/session scraping.

X's DM lookup API currently exposes recent DM events rather than an unlimited personal-history archive, so the gateway should continuously ingest/call the official API if long-term retention is desired.

## Coolify

Deploy branch `feature/x-mcp-gateway` with `docker-compose.coolify.yml` and route `x.nabuxai.com` to port 8000.

Required environment:

```text
PUBLIC_BASE_URL=https://x.nabuxai.com
APP_SECRET_KEY=<32+ random chars>
X_CLIENT_ID=<X OAuth2 client id>
X_CLIENT_SECRET=<optional/required for confidential client configuration>
X_REDIRECT_URI=https://x.nabuxai.com/x/callback
INTERNAL_SERVICE_TOKEN=<random secret>
```

Access/refresh tokens are encrypted at rest. MCP bearer tokens are stored hashed.

## Status

Production-shaped code; real E2E requires an X Developer app with OAuth 2.0 enabled, the exact callback URL registered, sufficient API credits/access for the endpoints used, and an authorized X account.