x-api-mcp
Server Configuration
Describes the environment variables required to run the server.
| Name | Required | Description | Default |
|---|---|---|---|
| X_TOOLS | No | `write` registers only the account and write tools; `read` registers only the account and read tools. | all |
| X_SCOPES | No | Set to narrow permissions. Defaults to all non-DM scopes the tools use. | |
| X_AUTH_MODE | No | `loopback`, `paste`, or `auto` (paste over SSH). Set `X_AUTH_MODE=paste` explicitly for chat-bot hosts. | auto |
| X_CLIENT_ID | Yes | Your X App's OAuth 2.0 Client ID. Can instead be saved once with `npx x-api-mcp config --client-id <id>` or the `set_client_id` tool (stored in ~/.x-api-mcp/app.json); the environment variable wins when both are set. | |
| X_ENABLE_DM | No | `1` requests the `dm.read dm.write` scopes and registers the DM tools. The App needs Direct Messages permission. | off |
| X_API_MCP_HOME | No | Storage directory for the OAuth tokens and the saved Client ID. | ~/.x-api-mcp |
| X_REDIRECT_URI | No | OAuth callback URI. Must match the App settings. | http://127.0.0.1:8765/callback |
| X_CLIENT_SECRET | No | Only for Web Apps (confidential clients). Native Apps (public clients) do not need a secret. | |
| X_DEFAULT_ACCOUNT | No | Account used when no default account is set locally. | |
| X_REQUIRE_ACCOUNT | No | `1` makes write tools refuse calls without an `account` argument. Recommended when several accounts are configured. | off |
Instructions
Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.
This server publishes no instructions, or was last inspected before Glama recorded them.
Capabilities
Features and capabilities supported by this server
Protocol revision2025-11-25
| Capability | Details |
|---|---|
| tools | {
"listChanged": true
} |
Tools
Functions exposed to the LLM to take actions
| Name | Description |
|---|---|
| list_accountsA | List X accounts authorized on this machine and which one is the default. Local only, no API cost. |
| set_client_idA | Save the OAuth 2.0 Client ID of the user's own X App (from console.x.com) on this machine, for hosts that cannot pass the X_CLIENT_ID environment variable. Needed once before add_account. No API call. |
| add_accountA | Start OAuth 2.0 (PKCE) to authorize another X account. Returns authorize_url for the user to open in a browser logged in to that account, and a note to relay to them. mode=loopback: a local listener saves the token automatically; confirm with auth_status. mode=paste: ask the user to paste the callback URL from the address bar right after approving and pass it to complete_authorization at once. Tokens are stored only on this machine. |
| auth_statusA | Check whether an authorization started with add_account has finished. Optionally wait for it. |
| complete_authorizationA | Fallback when the automatic callback listener is unavailable: finish add_account with the full callback URL from the browser address bar (contains code and state). X codes expire ~30 seconds after approval. |
| set_default_accountA | Choose which authorized account is used when a tool call omits |
| remove_accountB | Forget an authorized account on this machine and revoke its tokens at X. |
| get_meA | Fetch the authenticated user's profile via GET /2/users/me (billed as a user read). |
| create_postA | Publish a post as the given account; also used to reply (reply_to_post_id). Attach media via media_files (uploads for you) or media_ids. Spends pay-per-use credits (roughly $0.015 per post, much more if the text contains a URL; check current pricing in the X console). Only call when the user has confirmed the exact text and account. |
| create_threadA | Publish a thread: each post replies to the previous one. Stops at the first failure and reports what was posted. Each post is billed like create_post. |
| delete_postA | Delete a post owned by the given account (billed per request). |
| post_actionB | Interact with a post as the given account: like, unlike, repost, unrepost, bookmark, unbookmark, hide_reply or unhide_reply (replies to your own posts). |
| upload_mediaA | Upload an image, GIF or video and return its media_id for create_post. Images <= 5 MB go in one request; GIFs, videos and larger files use chunked upload and wait for processing. Optional alt text. |
| get_media_statusC | Check processing status of an uploaded video/GIF. |
| searchA | Search X. type=posts: posts from the last 7 days (billed per post returned, keep max_results small). type=users: search accounts by keyword. |
| get_postsA | Look up posts by ID (1-100), with author, metrics, media and referenced posts. Billed per post. |
| get_timelineA | Read a timeline. type: home (your reverse-chronological home feed), posts (a user's posts), mentions, liked (posts a user liked), bookmarks (yours). |
| get_post_engagementA | Who engaged with a post. type: liking_users, reposted_by (users), or quotes (quote posts). |
| get_usersA | Look up user profiles by usernames or by numeric IDs (up to 100). Billed per user. |
| get_user_relationsA | List followers or following of a user (default: the account itself), or the account's own muting/blocking list. |
| user_actionA | Follow, unfollow, mute, unmute, block or unblock a user as the given account. X documents block as Enterprise-only, so it may be refused on pay-per-use apps. |
| list_actionC | Manage X Lists: create, update, delete, add_member, remove_member. |
| get_listsC | Read Lists. type: owned (lists a user owns, default the account), info, members, or posts of list_id. |
| get_trendsC | Personalized trends for the account. |
Prompts
Interactive templates invoked by user choice
| Name | Description |
|---|---|
No prompts | |
Resources
Contextual data attached and managed by the client
| Name | Description |
|---|---|
No resources | |
TDQS
Scored across 24 tools
Most tools target distinct resource+action combinations, and the auth cluster (add_account, auth_status, complete_authorization) is well-differentiated by description. Minor overlap exists between get_posts, get_timeline, and search for retrieving posts, but descriptions clarify the boundaries.
The large majority follow a clear verb_noun pattern (get_posts, create_post, delete_post, get_users, set_default_account). Deviations are the noun_action bundles (list_action, post_action, user_action), the bare 'search', and 'auth_status', but these remain readable and the *_action group is internally consistent.
24 tools is slightly heavy but justified by the broad X API surface spanning auth, posting, media, timelines, search, lists, users, and relations. Each tool maps to a meaningful capability with little redundancy.
Core workflows are well covered: OAuth account lifecycle, posting/threads/deletes, engagement actions, media upload, timelines, search, lists, and user relations. Gaps like direct messages, profile editing, and pinned-post management exist but are outside the stated posting/reading focus.