Skip to main content
Glama
RongleCat

x-api

by RongleCat
OverviewSchemaSourceRelated ServersDiscussionsAdmin
JavaScript
Local

NOTE

Not an official xAI or X product. This is an open-source plugin by ι“ζŸ±AGI / RongleCat for the local Grok App workbench and OpenAI Codex. It talks to X API v2 with your developer App credentials. Public lookups should stay on Grok subscription tools (x_search / x_keyword_search / …) so you do not spend pay-per-use credits on search.

Background write-up: η”¨η§―εˆ†εˆ€εˆƒδΈŠηš„ζŽˆζƒζ΅η¨‹ (@cgnot996).

Contents

Related MCP server: mcp-x

Why this plugin

Job

Use

Search X / Twitter publicly

Grok built-in x_search, x_keyword_search, x_semantic_search, x_user_search, x_thread_fetch (subscription, no X developer credits)

Post, reply, like, follow, DMs, lists, your own data

This plugin (pay-per-use X API)

Official hosted MCP https://api.x.com/mcp (xurl)

Incomplete for posting; not a substitute

Zero runtime npm dependencies. Node 18+. Credentials live in ~/.x-api/credentials.json (mode 0600).

Auth (shorter than the 12-step PIN)

You still create a developer App once (Read and write, Native App, callback, website URL). What this plugin shortens is authorization, not the console.

Order

Path

When

Why it is shorter

1 (default)

Four console tokens

You operate the account that owns the App

No authorize URL, no PIN, tokens do not expire

2

OAuth 2.0 PKCE localhost

One browser Allow + refresh

Callback http://127.0.0.1:8787/callback; Native App secret empty

3

OAuth 1.0a localhost

Same keys, no PIN

User token does not expire

4

PIN / oob

No localhost

Same as the original article steps 8–11

5

Bearer

Public reads only

Cannot post

Install

Requires Node 18+.

Grok App (recommended)

  1. Open Settings β†’ Extensions β†’ Plugins

  2. Under Recommended, install X API (never auto-installs)

  3. Confirm trust

  4. Settings β†’ Extensions β†’ MCP β†’ From plugins β†’ x-api β†’ Authorize

  5. Start a new conversation so tools inject (x-api__status, x-api__create_post, …)

CLI equivalent:

grok plugin install --trust https://github.com/RongleCat/x-api
grok plugin enable x-api

Local checkout:

grok plugin install --trust /path/to/x-api
grok plugin enable x-api

Codex

The repo includes .codex-plugin/plugin.json. Install from the local path or git URL, or:

node scripts/register-mcp.mjs codex

Authorize

Do not paste secrets into chat.

In Grok App: MCP row Authorize (console four tokens, or browser OAuth 2).

Terminal:

node scripts/x-api.mjs login --tokens    # shortest, App-owner account
node scripts/x-api.mjs login --oauth2    # one Allow
node scripts/x-api.mjs login --oauth1
node scripts/x-api.mjs login --pin
node scripts/x-api.mjs status
node scripts/x-api.mjs whoami
node scripts/x-api.mjs logout

Non-interactive (used by Grok App):

node scripts/x-api.mjs login --tokens --no-prompt \
  --api-key … --api-secret … --access-token … --access-token-secret …

Env vars: see .env.example. HTTP(S)_PROXY is honored when exchanging OAuth codes (Node fetch does not use the system proxy by default).

Credits

Same split as the original article:

  • Read/search the public firehose: Grok subscription tools β€” do not put lookups through this plugin

  • Write / read your own account: this MCP (~$0.015 per plain post)

  • Do not put hostnames in the post body: x.com is auto-linked; cost jumps to ~$0.20

create_post rejects hostnames unless confirm_url_billing=true.

MCP tools

Post, delete, media, like/retweet/follow, bookmarks, hide replies, followers, mute/block, DMs, lists, trends, usage, whoami. Anything else: generic request with confirm_spend.

In a Grok session, tools are named x-api__<tool> (for example x-api__create_post).

Stdio speaks NDJSON for Grok App / Grok Build (same as official-aux). Content-Length is still accepted for Claude/Codex-style hosts.

Endpoint index: https://docs.x.com/x-api/llms.txt

Layout

.grok-plugin/plugin.json    Grok App / Grok Build
.codex-plugin/plugin.json   Codex
.mcp.json                   stdio MCP β†’ mcp/server.mjs
skills/                     x-api + x-auth
commands/x-auth.md
mcp/                        zero-dep Node implementation
scripts/x-api.mjs           auth CLI

Development

npm test              # node --test
npx grok plugin validate .

No npm install required for runtime.

Security

See SECURITY.md. Report privately on X @cgnot996 or via GitHub Security Advisories. Never file tokens in public issues.

Related projects

Project

Link

Grok App

RongleCat/grok-app Β· grok-app.com

GrokGo

RongleCat/grok-go

awesome-grok-bot

RongleCat/awesome-grok-bot

License & author

MIT Β© 2026 RongleCat.

Channel

Link

𝕏 X (Twitter)

@cgnot996 (ι“ζŸ±AGI)

πŸ“’ WeChat Official Account

Search γ€Œι“ζŸ±AGI」 or scan the top-left QR

πŸ’¬ WeChat community

Scan the top-right QR

πŸ™ GitHub

RongleCat

⭐ If this plugin saves you X API credits, please star the repo β€” and Grok App.

This server cannot be deployed

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • X (Twitter) MCP Server

    Dishant27
    A
    license
    Not graded
    quality
    D
    maintenance
    Enables interaction with X (formerly Twitter), allowing for posting tweets, searching content, managing accounts, and organizing lists.
    9 npm
    3
    MIT

  • agent-twitter-client-mcp

    theo-nash
    A
    license
    B
    quality
    D
    maintenance
    Enables AI models to interact with Twitter, including posting tweets, searching, following users, and chatting with Grok, using cookie or credential authentication.
    14
    1,402 npm
    1
    MIT

  • x-mcp-server

    MindMadeLab
    A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI assistants to interact with X (Twitter) API v2 for posting tweets, searching, liking, retweeting, and more through natural language.
    MIT