X MCP Server

Post, search, and delete tweets via OAuth 1.0a or 2.0 with X API support.

Data last scanned today · Reviewed today

28 1 dangerous tool3 tools★ 21TypeScriptMIT

Overview

The X MCP Server provides an interface for interacting with the X platform directly through the Model Context Protocol. It supports posting text tweets, managing media uploads, searching content, and deleting posts. Built in TypeScript, the server includes Zod validation and implements rate-limiting to help manage API consumption. The server handles complex API versioning requirements, intelligently switching between v1.1 and v2 endpoints depending on the authentication method chosen. Users can select between legacy OAuth 1.0a, which allows for specific v1.1 fallbacks, or the modern OAuth 2.0 flow for exclusive v2 API access.

Our verdict

This server carries a high risk level with a security score of 28/100. The repository has not been updated in over 392 days, which raises concerns regarding its compatibility with evolving API standards and security patches. Furthermore, the codebase is community-maintained rather than vendor-supported and has not undergone an editorial security review. Given the lack of active maintenance, developers should exercise caution and avoid using this in production environments where account integrity or API stability is critical.

Supports both OAuth 1.0a and OAuth 2.0 authentication flows
Includes built-in rate limiting to protect API usage
Uses Zod for type-safe validation of requests
Small dependency surface with only 5 direct dependencies

Last commit was 392 days ago
High security risk score of 28/100
Community-maintained without official vendor support
Authentication methods have not been independently reviewed

Setup

Claude Desktop

{
  "mcpServers": {
    "x-mcp-server": {
      "args": [
        "-y",
        "@mbelinky/x-mcp-server"
      ],
      "command": "npx"
    }
  }
}

Paste into ~/Library/Application Support/Claude/claude_desktop_config.json (macOS) or %APPDATA%\Claude\claude_desktop_config.json (Windows), then restart Claude Desktop. Some servers require API keys or tokens as environment variables — check the project's README and add an "env" object if needed.

No read-only mode — running this grants full read/write access.
No built-in authentication — anyone with access to this config can invoke every tool it exposes.

Tools

Tool	Description	Risk
post_tweet	Post a new tweet with optional media attachments and replies.	medium
search_tweets	Search for tweets with customizable result count (10-100).	low
delete_tweet	Delete a tweet by its ID.	high

Compatibility

Client	Local	Docker	Remote	Read-only
ChatGPT
Claude Desktop
Cursor
VS Code
Windsurf

Frequently asked questions

›What authentication methods does the server support?

The server supports both OAuth 1.0a and OAuth 2.0 authentication methods for X API access.

›Are there differences in feature availability between auth methods?

Yes, OAuth 1.0a allows for v1.1 API fallbacks, which are necessary for certain operations like tweet deletion, whereas OAuth 2.0 relies exclusively on v2 API endpoints.

›What system prerequisites are required to run this server?

You need a registered X Developer Account, an X App created in the Developer Portal with 'Read and Write' permissions, and Node.js 18 or higher installed.

›How can I generate credentials for OAuth 2.0?

You can use the provided helper script located in 'scripts/oauth2-setup.js' within the cloned repository or perform a manual OAuth 2.0 flow with PKCE.

›Why does the server sometimes use v1.1 API endpoints?

The server falls back to v1.1 endpoints because some v2 endpoints, such as the tweet deletion feature, currently experience 500 errors.