Skip to main content
Glama
fatwang2

x-api-mcp

by fatwang2

Server Configuration

Describes the environment variables required to run the server.

NameRequiredDescriptionDefault
X_TOOLSNo`write` registers only the account and write tools; `read` registers only the account and read tools.all
X_SCOPESNoSet to narrow permissions. Defaults to all non-DM scopes the tools use.
X_AUTH_MODENo`loopback`, `paste`, or `auto` (paste over SSH). Set `X_AUTH_MODE=paste` explicitly for chat-bot hosts.auto
X_CLIENT_IDYesYour X App's OAuth 2.0 Client ID. Can instead be saved once with `npx x-api-mcp config --client-id <id>` or the `set_client_id` tool (stored in ~/.x-api-mcp/app.json); the environment variable wins when both are set.
X_ENABLE_DMNo`1` requests the `dm.read dm.write` scopes and registers the DM tools. The App needs Direct Messages permission.off
X_API_MCP_HOMENoStorage directory for the OAuth tokens and the saved Client ID.~/.x-api-mcp
X_REDIRECT_URINoOAuth callback URI. Must match the App settings.http://127.0.0.1:8765/callback
X_CLIENT_SECRETNoOnly for Web Apps (confidential clients). Native Apps (public clients) do not need a secret.
X_DEFAULT_ACCOUNTNoAccount used when no default account is set locally.
X_REQUIRE_ACCOUNTNo`1` makes write tools refuse calls without an `account` argument. Recommended when several accounts are configured.off

Instructions

Guidance the server publishes about itself, which clients place ahead of the tool catalog so the model reads it before choosing anything.

This server publishes no instructions, or was last inspected before Glama recorded them.

Capabilities

Features and capabilities supported by this server

Protocol revision2025-11-25

CapabilityDetails
tools
{
  "listChanged": true
}

Tools

Functions exposed to the LLM to take actions

NameDescription
list_accountsA

List X accounts authorized on this machine and which one is the default. Local only, no API cost.

set_client_idA

Save the OAuth 2.0 Client ID of the user's own X App (from console.x.com) on this machine, for hosts that cannot pass the X_CLIENT_ID environment variable. Needed once before add_account. No API call.

add_accountA

Start OAuth 2.0 (PKCE) to authorize another X account. Returns authorize_url for the user to open in a browser logged in to that account, and a note to relay to them. mode=loopback: a local listener saves the token automatically; confirm with auth_status. mode=paste: ask the user to paste the callback URL from the address bar right after approving and pass it to complete_authorization at once. Tokens are stored only on this machine.

auth_statusA

Check whether an authorization started with add_account has finished. Optionally wait for it.

complete_authorizationA

Fallback when the automatic callback listener is unavailable: finish add_account with the full callback URL from the browser address bar (contains code and state). X codes expire ~30 seconds after approval.

set_default_accountA

Choose which authorized account is used when a tool call omits account.

remove_accountB

Forget an authorized account on this machine and revoke its tokens at X.

get_meA

Fetch the authenticated user's profile via GET /2/users/me (billed as a user read).

create_postA

Publish a post as the given account; also used to reply (reply_to_post_id). Attach media via media_files (uploads for you) or media_ids. Spends pay-per-use credits (roughly $0.015 per post, much more if the text contains a URL; check current pricing in the X console). Only call when the user has confirmed the exact text and account.

create_threadA

Publish a thread: each post replies to the previous one. Stops at the first failure and reports what was posted. Each post is billed like create_post.

delete_postA

Delete a post owned by the given account (billed per request).

post_actionB

Interact with a post as the given account: like, unlike, repost, unrepost, bookmark, unbookmark, hide_reply or unhide_reply (replies to your own posts).

upload_mediaA

Upload an image, GIF or video and return its media_id for create_post. Images <= 5 MB go in one request; GIFs, videos and larger files use chunked upload and wait for processing. Optional alt text.

get_media_statusC

Check processing status of an uploaded video/GIF.

searchA

Search X. type=posts: posts from the last 7 days (billed per post returned, keep max_results small). type=users: search accounts by keyword.

get_postsA

Look up posts by ID (1-100), with author, metrics, media and referenced posts. Billed per post.

get_timelineA

Read a timeline. type: home (your reverse-chronological home feed), posts (a user's posts), mentions, liked (posts a user liked), bookmarks (yours). user defaults to the account itself. Billed per post returned.

get_post_engagementA

Who engaged with a post. type: liking_users, reposted_by (users), or quotes (quote posts).

get_usersA

Look up user profiles by usernames or by numeric IDs (up to 100). Billed per user.

get_user_relationsA

List followers or following of a user (default: the account itself), or the account's own muting/blocking list.

user_actionA

Follow, unfollow, mute, unmute, block or unblock a user as the given account. X documents block as Enterprise-only, so it may be refused on pay-per-use apps.

list_actionC

Manage X Lists: create, update, delete, add_member, remove_member.

get_listsC

Read Lists. type: owned (lists a user owns, default the account), info, members, or posts of list_id.

get_trendsC

Personalized trends for the account.

Prompts

Interactive templates invoked by user choice

NameDescription

No prompts

Resources

Contextual data attached and managed by the client

NameDescription

No resources

TDQS

A3.5/5.0

Scored across 24 tools

Disambiguation4/5

Most tools target distinct resource+action combinations, and the auth cluster (add_account, auth_status, complete_authorization) is well-differentiated by description. Minor overlap exists between get_posts, get_timeline, and search for retrieving posts, but descriptions clarify the boundaries.

Naming Consistency4/5

The large majority follow a clear verb_noun pattern (get_posts, create_post, delete_post, get_users, set_default_account). Deviations are the noun_action bundles (list_action, post_action, user_action), the bare 'search', and 'auth_status', but these remain readable and the *_action group is internally consistent.

Tool Count4/5

24 tools is slightly heavy but justified by the broad X API surface spanning auth, posting, media, timelines, search, lists, users, and relations. Each tool maps to a meaningful capability with little redundancy.

Completeness4/5

Core workflows are well covered: OAuth account lifecycle, posting/threads/deletes, engagement actions, media upload, timelines, search, lists, and user relations. Gaps like direct messages, profile editing, and pinned-post management exist but are outside the stated posting/reading focus.

Maintenance

ActivityNo data
ResponsivenessNo issues