capx café
capx café
The safe way to let your AI run your X.
One MCP server. Your X token never touches the agent — and every post clears an enforced guardrail before it ships.
The guardrail, live — every verdict above is produced by the real chokepoint code (pnpm demo replays it).
capx café is an agent-native X poster that installs as one MCP server into any coding agent (Claude Code / Cursor / Codex / Windsurf). A whitelisted user connects their X account once; after that they create / schedule / post from inside their agent session. The whole product rests on one security thesis: the X token, the guardrail (casserole), and the send are one inseparable server-side unit — the agent on your laptop only ever holds a short-TTL session handle, never the token. That's why it structurally can't be prompt-injected into tweeting a scam. "The AI writes; casserole decides what ships."
Why it's different
Every other "let your AI post" tool has the same flaw: to let an agent post, you paste your X token into a plaintext config right next to an autonomous agent that reads untrusted web pages, issues, and code. One prompt-injection and your account tweets a scam. capx café is the only one that structurally can't be.
🔒 Your X token never touches your machine. OAuth completes on capx café's hosted callback; the token lives encrypted in a server-side vault. Your agent holds only a short-TTL, revocable session handle.
🛡️ casserole — a deterministic (non-AI) six-layer guardrail — runs server-side at the only door to X and checks every post. A blocked post never even decrypts your token (proven by an adversarial test suite).
🔗 The token, the guard, and the send are one unit. Skip the plugin and call the server directly — you still hit the guard. The client's checks are cosmetic; the server's are load-bearing.
✍️ capx generates nothing. Your agent's model writes; capx ships what clears the guard.
→ Full threat model, architecture & the "what we can/can't see" table: docs/SECURITY.md
Related MCP server: X MCP Server
How it works
flowchart LR
subgraph M["🖥️ your machine · untrusted"]
A["agent model<br/>writes the draft"]
S["capx skills"]
C["capx MCP client<br/>holds a session handle · NO token"]
end
subgraph K["🔒 capx chokepoint · hosted · AGPL-3.0"]
AD["admission<br/>allowlist · kill-switch"]
CAS["casserole<br/>6-layer guardrail"]
V["vault<br/>the token lives here"]
XA["x-adapter<br/>the only egress"]
end
X["🐦 X · /2/tweets"]
A --> C
S --> C
C -->|"short-TTL handle<br/>crosses — never the token"| AD
AD --> CAS
CAS -->|PASS| V --> XA --> X
CAS -.->|blocked / held| CThe token, the guardrail, and the send live together behind a trust boundary; your agent can only ask.
The guardrail: casserole
Six deterministic layers on every post. Worst result wins — pass / rewrite / hold / block — and a blocked post never even decrypts the token.
flowchart TD
D["draft"] --> AD{"admitted?<br/>allowlisted · not killed"}
AD -->|no| R["rejected"]
AD -->|yes| CAS["casserole<br/>L1 eligibility · L2 rate · L3 anti-slop<br/>L4 authenticity · L5 kill-switch · L6 audit"]
CAS --> VER{"verdict"}
VER -->|block| B["blocked — never sent<br/>🔒 token never decrypted"]
VER -->|hold| H["held for your review"]
VER -->|rewrite| RW["ask the agent to fix"]
VER -->|pass| SEND["vault → x-adapter → X ✅"]60-second quickstart
npx -y capx-cafe # runs the MCP server — add it to your agent's MCP configThen, inside your agent:
"connect my X account" → opens a browser once; the token stays on the server
"post: shipping the thing today" → clears casserole, or tells you exactly why not
"turn my last week of commits into a build-in-public thread" → drafts + queues itSet CAPX_EMAIL (your whitelisted email) and, for the BYO lane, X_CLIENT_ID (your own X app) in
~/.capx/config.json or your agent's MCP env. A guided setup page hands you the exact callback URL to paste.
Install matrix
Agent | How |
Claude Code |
|
Cursor | add to |
Codex | add to your MCP config; prompt pack in |
Windsurf | add to MCP config; workflows in |
Any MCP agent | point it at |
Docker Desktop |
|
What your agent can do
Tool | What it does |
| One-time browser OAuth — the token lands in the server vault, never on your machine |
| Post now (clears casserole first). Supports reply-chains and media |
| Dry-run a draft through the guardrail without sending — pass / hold / block + why |
| The durable record of what capx posted or attempted on your behalf, and its state |
| Scheduled posting — a queue you wrote, sent on a schedule, laptop-off |
| Stream a local image/video to X and attach it (media you made with your own tools) |
| The connected account + its status |
Skills — your work becomes your content
capx lives inside a coding agent, so it has what no social scheduler does: your repo, commits, PRs, releases. Skills turn that into posts — automatically, and always through the guardrail.
flowchart LR
G["git commits"] --> BIP["build-in-public<br/>drafts a week of posts"]
BIP --> Q["loop queue"]
Q -->|"1/day · laptop-off"| POST["posted to X"]
Q -.->|"runs low"| GAP["gap-alert"]
GAP -.->|"top up from new commits"| BIPThe self-refilling content engine: you code → commits accrue → the loop drains as it posts → gap-alert tops it up from the new commits. Your normal work is the pipeline.
🏆 build-in-public · ship-note · changelog-thread · repurpose (blog/README → thread) · launch-thread · til · fix-note
voice-match (sound like you) · draft-review (lint against the guard) · thread-builder · hook-rewrite
best-time · cadence-planner · gap-alert · audit-trail · connection-health · quickstart · self-host-guide
Media directors —
image-director,video-director,prompt-engine,model-guide: capx runs no models; it guides your image/video tools (higgsfield, fal, kling, …) and uploads the result. casserole guards your caption; you own the media.
One canonical SKILL.md per skill, generated for all four agents. capx never writes the content — it makes
good content easy and stops bad content regardless of which skill produced it.
Two lanes
BYO — bring your own X developer app. You're X's customer and pay X directly — since Feb 2026 that means pre-loading credits (no free X tier for new apps) at ~$0.015/post, $0.20 if the post contains a link. Free on capx café's side; heavy users can self-host the identical image.
capx-app (creator lane) — post through capx café's shared X app, no developer account needed. Opening as a paid beta (waitlist):
Short $5/Tall $15/Grande $35monthly tiers + top-up packs, quotas enforced server-side at the gate. Full sheet + the math: docs/ECONOMICS.md · policy posture: docs/X-COMPLIANCE.md.
Self-host
The chokepoint is open source (AGPL-3.0). Run the identical image with your own X app, keys, database, and
domain — CAPX_DEPLOY_MODE=self-host, zero telemetry to capx. See the self-host-guide skill and
docs/HANDOFF.md.
Licensing
MIT for the client and everything it bundles (apps/capx-mcp, core, config, platform-client) plus
skills & docs. AGPL-3.0 for the server half (the chokepoint + casserole/captain/counter/canteen/
chef). Full map: LICENSING.md.
Status
Private alpha, whitelist-only. The first real post shipped 2026-07-19 — guardrail-cleared, token never on the machine. Not yet open for public signups.
Dev
Node ≥ 22.6 (TypeScript runs natively via --experimental-strip-types — no build step). pnpm run verify =
unit tests across packages / services / apps + tsc. Contributions accepted under the project CLA.
Available Tools
11 toolsauditA
Show the durable history of what capx has posted or attempted on your behalf (most recent first, with delivery state). A trust feature — read-only, your own handle only.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | max rows (default 50) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It explicitly declares the tool is read-only, restricted to one's own handle, returns durable history in reverse chronological order, and includes delivery state. This is thorough transparency for a simple read-only audit tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences that front-load the core purpose and then add essential constraints and output details. Every phrase earns its place with no redundancy or verbosity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one optional parameter and no output schema, the description covers the core behavior: what is shown, ordering, delivery state, read-only nature, and handle scope. It does not detail the exact output format or field list, which would make it fully complete, but nothing critical is missing for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents the only parameter (limit) with a description and default, so the description need not repeat it. The description adds no additional parameter semantics, which is acceptable given 100% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Show') and a concrete resource ('durable history of what capx has posted or attempted on your behalf'), and adds scope boundaries ('your own handle only'). This clearly distinguishes it from siblings like post_now or preview, making the tool's role unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use the tool: it is a 'trust feature' for reviewing one's own posting/attempt history, and it is read-only. It does not explicitly name alternatives or state when not to use it, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
connect_xA
Connect (or confirm) your X account via the capx chokepoint. Call once for a consent URL; after authorizing in the browser, call again with { confirm: true }.
| Name | Required | Description | Default |
|---|---|---|---|
| lane | No | ||
| confirm | No | ||
| clientId | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It reveals the two-phase choreography and the need for external browser authorization, which are essential behavioral traits. It does not discuss error handling or side effects, but the core interaction pattern is transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the purpose and followed by the concrete usage pattern. Every word earns its place; there is no fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The two-step flow is clearly explained, but with no output schema and no annotations, the description should also clarify the meaning of lane and clientId and the response shape beyond 'consent URL.' It is adequate for a high-level understanding but not fully complete for direct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate by explaining the parameters. It only touches on confirm via the example { confirm: true }, while leaving lane and clientId completely unexplained. This is a significant gap for an agent trying to invoke the tool correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: connect or confirm an X account via the capx chokepoint. It names the specific resource and mechanism, and it is easily distinguishable from sibling tools like post_now or upload_media, which target different resources and actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an explicit two-step usage protocol: call once for a consent URL, then call again with confirm:true after browser authorization. It does not explicitly mention alternatives or exclusions, but no sibling tool offers a competing connect flow, so the guidance is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_loopA
Schedule recurring posts. YOU (the agent) must write the posts and pass them in posts — capx never generates content, so at fire time it only ships text you already wrote. When the queue empties the loop pauses and asks for more. Requires a verified X account at least 30 days old.
| Name | Required | Description | Default |
|---|---|---|---|
| time | Yes | local time, HH:MM, e.g. "09:00" | |
| posts | Yes | the posts YOU wrote; one is sent per fire, in order | |
| timezone | No | IANA zone (defaults to this machine's), e.g. Asia/Kolkata | |
| daysOfWeek | Yes | 0=Sunday .. 6=Saturday, e.g. [1,3,5] | |
| aiGenerated | No | label this loop's posts AI-assisted — the USER decides; default false |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It reveals non-obvious runtime traits: capx never generates content, firing only sends pre-written text, the loop pauses and asks for more when the queue empties, and an account-age prerequisite exists. This is exactly the kind of info an agent would otherwise discover only after invoking.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, all substantive and non-redundant. The core purpose is front-loaded, and the behavioral caveats and requirement are delivered without fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The definition plus schema gives the agent everything needed to invoke correctly: what the tool does, what content to supply, how the loop behaves, and a hard prerequisite. It is slightly short of complete because it doesn't indicate what the call returns or explicitly route to post_now for one-off posting, but neither blocks correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds genuine value beyond the schema for the `posts` parameter by making clear that the agent is solely responsible for authoring content and that capx will not fill in generated text. It doesn't add detail for time, timezone, or daysOfWeek, but those are already well documented in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'Schedule recurring posts,' a specific verb and resource that clearly states the tool's function. It also distinguishes this from siblings like post_now (one-off posting) and loop management tools (pause_loop, list_loops, delete_loop) by emphasizing recurrence and the loop lifecycle.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: the agent must write the posts itself, capx never generates content, and a verified X account at least 30 days old is required. It doesn't explicitly name alternatives or say 'use this instead of post_now,' but the guidance is sufficient for correct use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_loopA
Delete a loop permanently.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The word 'permanently' discloses the destructive, irreversible nature of the operation, which is valuable behavioral context in the absence of annotations. However, it does not mention other traits such as cascading effects, authentication requirements, or error behavior, leaving clear gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no redundant words. The qualifier 'permanently' adds meaningful behavioral information, and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter delete operation, the description is minimally adequate. However, without annotations or an output schema, the agent is left to infer side effects, error conditions, and return behavior, so completeness is only partial.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for the single 'id' parameter, and the description does not explicitly explain what 'id' refers to. The tool name and resource mention imply it is the loop ID, but the description provides no direct parameter-level guidance to compensate for the schema's lack of detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Delete') and resource ('loop') with the qualifier 'permanently', making the action unambiguous. It inherently distinguishes from sibling tools like pause_loop, which imply a non-destructive operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The qualifier 'permanently' implies this tool is for irreversible deletion rather than temporary pauses, giving some implied usage context. However, it does not explicitly reference alternatives such as pause_loop or state when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_loopsA
List your scheduled loops, their next-post queue, and whether any are paused.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations to carry the safety profile, the description itself conveys that this is a read-only listing operation and clarifies the scope to the current user's loops. It adds useful detail about what is surfaced (next-post queue, paused state), though it does not mention authentication, ordering, or output limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One compact sentence that starts with the action and packs three useful facts about the result set. There is no filler and every phrase earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple zero-parameter read tool with no output schema, the description names the main return facets: scheduled loops, next-post queue, and paused status. It is nearly complete, though it could additionally specify the response format or any connection/auth requirement.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is no parameter meaning the description needs to add beyond the schema. The word 'your' adds useful scope context and is the only semantic clarification needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a concrete verb, 'List', and identifies the exact resource: 'your scheduled loops'. It also names the distinctive content (next-post queue and paused status), which separates it cleanly from sibling tools like create_loop, pause_loop, and audit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies that this is the tool to call when the user wants to see their scheduled loops. However, it does not explicitly state when to prefer it over alternatives such as audit or preview, nor does it provide any exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pause_loopB
Pause or resume a loop.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| paused | No | false to resume; defaults to true |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states that the tool pauses or resumes a loop, with no explanation of what pausing does to an active loop, whether the operation is idempotent, what side effects occur, or what happens on resume.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler or repetition. It could be slightly more informative without losing conciseness, so it is strong but not perfect.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter state toggle, the combination of the description and the schema is minimally viable: id is the required target and paused has an explicit schema description. However, it lacks behavioral context, return expectations, and any relationship to sibling loop tools, leaving the agent to infer too much.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 50%, and the description names neither parameter. The agent must infer that id identifies the target loop and that paused controls the state; the description adds no parameter-level meaning beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific action—pause/resume—and identifies the resource as a loop, which clearly distinguishes it from siblings like create_loop, list_loops, and delete_loop. Even without naming alternatives, the operation is unambiguous for an agent choosing among the provided sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance about when to use this tool versus alternatives, no conditions, and no mention of related tools such as create_loop, top_up_loop, or delete_loop. The only usage signal is the action phrase itself, which is implied rather than explicitly scoped.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
post_nowA
Post text to X now. Every post passes the casserole guardrail at the chokepoint; blocked/held posts are never sent, and the token never touches this machine. Set aiGenerated only if the user wants this post labelled AI-assisted (default off — it is the user's choice). Pass inReplyToId with a prior post's platformPostId to chain a native reply/thread.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | ||
| mediaIds | No | media ids from upload_media to attach to this post | |
| aiGenerated | No | label this post AI-assisted — the USER decides; default false | |
| inReplyToId | No | platformPostId of the post this replies to (for threads) | |
| idempotencyKey | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full disclosure burden; it goes beyond the obvious by revealing a guardrail/chokepoint, that blocked/held posts are never sent, and that the token never touches this machine. It also discloses default-off AI labeling and reply chaining. It falls short only on idempotency and exact failure/return behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with its core purpose before behavioral and parameter details. It is slightly dense with jargon ('casserole guardrail at the chokepoint'), but every sentence contributes substantive guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Core invocation is covered, but with no output schema the description should state what the tool returns (e.g., platformPostId for chaining replies), and it leaves idempotencyKey semantics unaddressed. It is adequate for a simple text post but not complete for advanced thread/retry usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 60%, so the description must compensate for text and idempotencyKey, which lack schema descriptions. It adds clarity to aiGenerated (user choice, default off) and inReplyToId (platformPostId chaining), but leaves idempotencyKey completely unexplained and does not mention mediaIds.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence names a specific action ('Post text to X now') with a concrete resource and immediacy, which distinguishes it from scheduling/preview siblings. The rest of the description reinforces it as a direct posting action, not a management or upload tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives parameter-level conditions ('Set aiGenerated only if...', 'Pass inReplyToId...') but never states when to choose post_now over siblings like preview or create_loop, or when not to use it. No exclusions or alternatives are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
previewA
Dry-run a draft through the casserole guardrail WITHOUT posting: returns whether it would pass, be held, or be blocked, and why. Use it to fix a draft before posting or scheduling. This is a linter, never a way to bypass the guard.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | ||
| aiGenerated | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description fully carries the behavioral disclosure burden. It clearly communicates the non-destructive nature ('WITHOUT posting', 'linter'), what it returns (pass/held/blocked and why), and the guardrail caveat. It omits authentication or rate-limit details, but for a dry-run linter this is strong transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core action and constraints. Every clause earns its place: the dry-run behavior, return value, intended use case, and the warning that it is not a bypass. No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple 2-parameter schema, no annotations, and no output schema, the description covers the essential context: purpose, when to use, return value, and safety. The only notable gap is the undocumented aiGenerated parameter, preventing a perfect score.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It relates the required 'text' to 'a draft', but the optional 'aiGenerated' boolean is never mentioned. The agent gets no guidance on when or how to set that parameter, leaving a meaningful gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Dry-run'), the resource ('a draft through the casserole guardrail'), and the exact outcome ('returns whether it would pass, be held, or be blocked, and why'). 'WITHOUT posting' and the linter framing clearly distinguish it from siblings like post_now.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit timing ('before posting or scheduling') and a clear when-not ('never a way to bypass the guard'). It does not name alternative sibling tools explicitly, but the context makes it obvious that actual posting requires a different tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
top_up_loopA
Add more posts YOU wrote to a loop's queue. Resumes a loop that paused because it ran out.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| posts | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It discloses that the tool adds posts and resumes a paused loop, and it implies an ownership constraint with 'YOU wrote.' However, it does not clarify whether posts are appended or replace the queue, whether active loops can also be topped up, or what happens when validation fails.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no filler. The first sentence states the core action and scope; the second adds the key resumption behavior. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, but the description omits important operational details: the meaning of 'id', the expected format of 'posts', and any side effects beyond resuming a paused loop. It is sufficient for a rough understanding but not fully self-contained given the absent annotations and minimal schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It gives partial meaning to 'posts' by saying they are posts YOU wrote and belong in a loop's queue, but it never explains what the strings should contain (IDs, text, media URLs?). The 'id' parameter is not described at all, leaving it ambiguous whether it is the loop ID or something else.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Add'), names the resource ('a loop's queue'), and adds a clear scope ('posts YOU wrote'). It also distinguishes the tool from siblings like create_loop and post_now by stating it operates on an existing loop queue and can resume a paused loop.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear when-to-use condition: add posts when a loop paused because it ran out of content. It does not explicitly list alternatives or when not to use the tool, so it stops short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
upload_mediaA
Upload a local image or video (produced by your own media tool) so it can be attached to a post. Reads the file, streams the bytes to the chokepoint, and returns a media id to pass to post_now as mediaIds. Media is not moderated by casserole — you set the AI-content label per the media skills.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | local file path to the image/video, e.g. ./out/hero.png |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and does well: it discloses the read-and-stream behavior, the returned media id, and the notable non-moderation/labeling policy. It doesn't cover permissions, failure modes, or side effects, but it is far beyond a bare mutation statement.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three purpose-built sentences: one for what/why, one for mechanism and result, one for moderation policy. It is front-loaded with the key action and no sentence is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with no output schema, the description covers the necessary call flow, return value, and important policy context. It omits format/size limits and error behavior, but these are minor for basic invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and includes an example, so baseline is 3. The description adds meaningful constraint: path must be a local media file 'produced by your own media tool' and the bytes are streamed, which clarifies what the parameter should hold beyond the schema's generic wording.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Upload a local image or video... so it can be attached to a post.' It also names the downstream consumer (post_now) and the returned media id, making the tool's role distinct among siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly connects upload_media to the post-creation workflow ('returns a media id to pass to post_now'), indicating when to use it. It doesn't explicitly state when not to use it or compare with alternatives, but the context is clear enough for an agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
whoamiA
Show the connected X account and its status (via the chokepoint).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral disclosure burden. It states that the tool returns the connected account and its status, and adds the specific mechanism 'via the chokepoint'. While it does not describe error cases or output formatting, it clearly conveys a read-only status operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler. It front-loads the main action and object, and every word adds meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple zero-parameter identity lookup, the description is largely sufficient: it names both the returned information and the source. It could be slightly stronger with an explicit statement about expected use after connect_x, but nothing essential is missing for invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero parameters, so parameter semantics are not a concern. Schema description coverage is 100%, and the description does not need to document parameter behavior that does not exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb, 'Show', and a clear resource, 'the connected X account and its status'. It is immediately distinguishable from sibling tools like connect_x, post_now, and preview, which all perform different actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies the tool is for checking which X account is currently connected and its status, which is a distinct context among the sibling tools. It does not explicitly state exclusions or compare against alternatives, but the usage context is clear for a zero-parameter identity/status tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
11 tool updates
v0.1.3- First observed
audit - First observed
connect_x - First observed
create_loop - First observed
delete_loop - First observed
list_loops - First observed
pause_loop - First observed
post_now - First observed
preview - First observed
top_up_loop - First observed
upload_media - First observed
whoami
TDQS
Each tool targets a distinct operation: account connection/status, immediate posting, dry-run preview, audit history, media upload, and loop lifecycle management. Even similar actions like create_loop, top_up_loop, and pause_loop are clearly separated by their descriptions.
Most tools follow a snake_case verb_noun pattern (create_loop, list_loops, pause_loop, upload_media, delete_loop). Minor deviations like post_now, preview, audit, and whoami are still readable and do not cause confusion, though they are slightly less consistent.
Eleven tools is well within the ideal range for this domain. The count covers account management, posting, guardrail preview, audit, media upload, and loop scheduling without feeling bloated or redundant.
The core workflows are well covered: connect, verify, post, preview, audit, upload media, and manage recurring loops through create/pause/top-up/delete. Minor gaps exist such as the lack of a disconnect account tool or a one-off scheduled post, but they do not block the main purpose.
Maintenance
Related MCP Connectors
Guarded agent surface for X & LinkedIn: discover, score, and draft in your voice. No key can post.
Connect any AI agent to 11+ social platforms: schedule, publish & track posts via hosted MCP.
MCP server for QPost — lets AI agents publish video and image posts to YouTube, TikTok, Instagram.
Free social platform for AI agents — boards with tool-call receipts; MCP server + REST API.
Related MCP Servers
- AlicenseAqualityDmaintenanceMCP server for Twitter/X enabling AI agents to search, post, reply, and engage with tweets.14211MIT
- AlicenseBqualityDmaintenanceMCP server for interacting with the X platform (Twitter) via MCP clients like Claude, Cursor AI, and Windsurf AI.20156MIT
- AlicenseNot gradedqualityAmaintenanceA local-first MCP server for social publishing on X (Twitter), enabling draft management, scheduling, and posting via CLI or AI agents.415MIT
- AlicenseAqualityAmaintenanceA local Model Context Protocol server that lets your coding agent draft, get human approval for, and publish posts to X using the X API v2.333763MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/vb-tyagi/capx-cafe'
If you have feedback or need assistance with the MCP directory API, please join our Discord server