Verified

X MCP Server

Post, search, and delete tweets via the X API with OAuth 2.0 and media support.

Data last scanned yesterday · Reviewed last month

13 1 dangerous tool3 tools★ 21TypeScriptMIT

Overview

This TypeScript-based MCP server enables direct interaction with the X platform, allowing AI assistants to create text posts, handle media uploads, and perform tweet searches. It is designed to provide comprehensive control over your X account programmatically. The server implements dual authentication, supporting both OAuth 1.0a and OAuth 2.0. It features built-in rate limiting to manage API usage and uses Zod validation for type safety. It also intelligently manages endpoint routing, switching between API v1.1 and v2 based on your chosen authentication method to optimize feature compatibility.

Our verdict

With a high-risk security score of 33/100, this server should be used with extreme caution. The project is not maintained by the official vendor and has not received a code update in over 396 days, which creates significant concerns regarding the reliability of its authentication and API handling. Given these factors, it is best suited for experimental use in isolated development environments rather than being connected to active, high-traffic accounts.

Supports both OAuth 1.0a and OAuth 2.0 authentication flows
Provides automatic fallback to v1.1 endpoints for tweet deletion
Small footprint with only 5 direct dependencies
Includes built-in rate limiting for X API requests

Project has not been updated in over one year
Maintained by community contributors rather than the official vendor
Authentication methods have not undergone a professional security review
Read-only capabilities remain unverified

Setup

Claude Desktop

{
  "mcpServers": {
    "x-mcp-server": {
      "args": [
        "-y",
        "@mbelinky/x-mcp-server"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Tools

Tool	Description	Risk
post_tweet	Post a new tweet with optional media attachments and replies.	medium
search_tweets	Search for tweets with customizable result count (10-100).	low
delete_tweet	Delete a tweet by its ID.	high

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›What authentication methods does the server support?

The server supports both OAuth 1.0a and OAuth 2.0 authentication methods for X API access.

›Are there differences in feature availability between auth methods?

Yes, OAuth 1.0a allows for v1.1 API fallbacks, which are necessary for certain operations like tweet deletion, whereas OAuth 2.0 relies exclusively on v2 API endpoints.

›What system prerequisites are required to run this server?

You need a registered X Developer Account, an X App created in the Developer Portal with 'Read and Write' permissions, and Node.js 18 or higher installed.

›How can I generate credentials for OAuth 2.0?

You can use the provided helper script located in 'scripts/oauth2-setup.js' within the cloned repository or perform a manual OAuth 2.0 flow with PKCE.

›Why does the server sometimes use v1.1 API endpoints?

The server falls back to v1.1 endpoints because some v2 endpoints, such as the tweet deletion feature, currently experience 500 errors.