Our grade: 4 checks
Based on public data, not a full audit. See how we grade. Something changed? Request a re-grade.
Community rating
- 5 6
- 4 6
- 3 6
- 2 0
- 1 0
Trust in production
- Trust it - 61%
- With caveats - 39%
- Wouldn't - 0%
94% would recommend this server
How reviewers scored it
- Setup & docs 3.8
- Auth experience 3.6
- Reliability 3.9
- Maintainer responsiveness 4.3
Why it got a B
X's own MCP server, hosted over HTTPS at api.x.com/mcp with no advisories on record. Because X has no dynamic client registration, you create your own X developer app and run X's open-source xurl bridge, which signs you in with OAuth 2.0 and refreshes the token. Every call is billed to that app's pay-per-use credits (for example $0.005 per post read and $0.015 per post created, $0.20 if the post has a link), and anything the agent writes goes out under your account and X's automation rules. Biggest deduction: xurl asks for every X scope at sign-in, including posting and reading and sending DMs, so there is no read-only sign-in and approval prompts are your only brake on writes.
How to connect
// ~/.cursor/mcp.json (global) or .cursor/mcp.json (per project) (docs.x.com/tools/mcp, "xurl bridge")
{
"mcpServers": {
"xapi": {
"command": "npx",
"args": ["-y", "@xdevplatform/xurl", "mcp", "https://api.x.com/mcp"],
"env": {
"CLIENT_ID": "YOUR_X_APP_CLIENT_ID",
"CLIENT_SECRET": "YOUR_X_APP_CLIENT_SECRET"
}
}
}
}// .vscode/mcp.json (docs.x.com/tools/mcp, "xurl bridge")
{
"servers": {
"xapi": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@xdevplatform/xurl", "mcp", "https://api.x.com/mcp"],
"env": { "CLIENT_ID": "YOUR_X_APP_CLIENT_ID", "CLIENT_SECRET": "YOUR_X_APP_CLIENT_SECRET" }
}
}
}// claude_desktop_config.json (docs.x.com/tools/mcp, "xurl bridge")
{
"mcpServers": {
"xapi": {
"command": "npx",
"args": ["-y", "@xdevplatform/xurl", "mcp", "https://api.x.com/mcp"],
"env": { "CLIENT_ID": "YOUR_X_APP_CLIENT_ID", "CLIENT_SECRET": "YOUR_X_APP_CLIENT_SECRET" }
}
}
}Is X (Twitter) MCP Server safe?
Is X (Twitter) MCP Server safe to use?
X (Twitter) MCP Server grades B (solid, with minor gaps). Login is required, but access is coarse: one sign-in or key covers more than your agent needs, so grant the narrowest account you can. Upkeep is hard to verify (closed source or a single maintainer), so pin the version you tested.
Does X (Twitter) MCP Server have known vulnerabilities?
Not in our current data: it has no open CVEs or advisories. We re-check as new ones are published.
Does X (Twitter) MCP Server support authentication?
Yes. It requires a login, so access can be tied to a person or a scoped key.
Alternatives in Collaboration
- A Google Drive MCP ServerOfficial Google-hosted Drive server (Developer Preview) to search, read, download, create, and copy files, with scoped OAuth.
- A Pragor Project Board MCP ServerHosted server that connects an agent to a Pragor project board to read and update messages, tasks and operations, with a per-agent token limited to its project role.
- A Slack MCP ServerOfficial hosted Slack server to search and read messages, files, and canvases, and send messages as you.
- A monday.com MCPmonday.com's official MCP server, hosted at mcp.monday.com or run locally from npm, to read and update boards, items, columns, updates and forms.
- B Asana MCPOfficial hosted Asana server to search, read, create, and update tasks and projects, with OAuth sign-in.
Embed this badge
[](https://trustedmcp.io/servers/x-mcp)<a href="https://trustedmcp.io/servers/x-mcp"><img src="https://trustedmcp.io/badge/x-mcp.svg" alt="TrustedMCP grade B" height="80"></a>Community reviews
Mixed feelings after two weeks
It does the job, but it took some tweaking. Scoped the token to just what the agent needs and it respected that. Fine in production if you sandbox it.
Used for Keeping project boards up to date
- Setup & docs 2/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Exactly what I needed from X (Twitter)
Our agents call this dozens of times a day. Being official from X counts for a lot when I pitch it to security. Scoped the token to just what the agent needs and it respected that.
Used for Meeting prep from shared docs
- Setup & docs 4/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 3/5
Better than the DIY script it replaced
Installed it on a Friday, it was part of my workflow by Monday. Auth is handled properly, and revoking access later was one click. It is in our production agent and I sleep fine.
Used for Drafting announcements
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Surprisingly polished
Clear tool names, sensible outputs, very few surprises. Read-only mode is the first thing I enable, and it covers most of what I need. I like that access goes through a proper sign-in instead of a long-lived secret on disk. Would recommend without hesitation.
Used for Searching old conversations for decisions
- Setup & docs 5/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Quietly reliable
Of the X (Twitter) integrations I tried, this one is the most predictable. Sign-in flow was painless and I never had to paste a key into a config file. Turned on read-only mode on day one, highly recommend doing the same.
Used for Posting daily standup summaries
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Promising, a bit raw
Took longer to configure than I expected. Being official from X counts for a lot when I pitch it to security. Sign-in flow was painless and I never had to paste a key into a config file. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. Worth it, just do not skip the hardening steps.
Used for Turning chat threads into tasks
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 3/5
- Maintainer responsiveness 4/5
Does what it says, no drama
Hooked X (Twitter) MCP Server into Claude Code and it worked on the first try. Nice to use something maintained by X rather than a random fork. Auth is handled properly, and revoking access later was one click. Good choice if you need X (Twitter) in your agent.
Used for Searching old conversations for decisions
- Setup & docs 4/5
- Auth experience 5/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Handy for dev, careful in prod
I like it, with reservations. Sign-in flow was painless and I never had to paste a key into a config file. The scope options are worth reading carefully, the defaults are broader than I wanted. Recommended, with sensible guardrails.
Used for Drafting announcements
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 3/5
- Maintainer responsiveness 5/5
OK for read-only work
Mostly reliable, with the odd timeout. The OAuth flow worked first time in Claude Code. Keep permissions tight and it is a good tool.
Used for Meeting prep from shared docs
- Setup & docs 3/5
- Auth experience 4/5
- Reliability 2/5
- Maintainer responsiveness 4/5
Good defaults, good docs
Simple to set up in Cursor, simple to reason about. I like that access goes through a proper sign-in instead of a long-lived secret on disk. You can tell it is actively maintained, the rough edges keep getting fixed. I would use it in prod, but only with a human approving writes.
Used for Meeting prep from shared docs
- Setup & docs 4/5
- Auth experience 5/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Earned a permanent spot in my config
Been running this for about a month now. The OAuth flow worked first time in Claude Code. It is in our production agent and I sleep fine.
Used for Keeping project boards up to date
- Setup & docs 5/5
- Auth experience 3/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Set it up once, forgot about it
I use this almost daily. The OAuth flow worked first time in Claude Code. Easy recommendation.
Used for Summarising channels I missed
- Setup & docs 3/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Saves me a context switch every hour
Replaced a homegrown script with X (Twitter) MCP Server and have not looked back. Auth is handled properly, and revoking access later was one click. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. Easy recommendation.
Used for Posting daily standup summaries
- Setup & docs 5/5
- Auth experience 4/5
- Reliability 4/5
- Maintainer responsiveness 5/5
Solid core, fiddly setup
Some tools are great, a couple feel half finished. I like that access goes through a proper sign-in instead of a long-lived secret on disk. Worth it, just do not skip the hardening steps.
Used for Summarising channels I missed
- Setup & docs 3/5
- Auth experience 2/5
- Reliability 3/5
- Maintainer responsiveness 4/5
The X (Twitter) integration I wanted
Started with it as an experiment, now it is a fixture. I like that access goes through a proper sign-in instead of a long-lived secret on disk. Filed an issue and got a reply within two days. Happy to run it in production.
Used for Summarising channels I missed
- Setup & docs 5/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 5/5
Solid and well behaved
Set this up for our team after comparing a few options. Sign-in flow was painless and I never had to paste a key into a config file. Filed an issue and got a reply within two days. Happy to run it in production.
Used for Turning chat threads into tasks
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 5/5
Fine once configured properly
Useful tool, though I would not hand it to a junior unsupervised. Auth is handled properly, and revoking access later was one click. Releases come often and the changelog is clear. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent.
Used for Turning chat threads into tasks
- Setup & docs 2/5
- Auth experience 3/5
- Reliability 4/5
- Maintainer responsiveness 4/5
Recommended it to two teams already
Tried it on a side project first, then rolled it out at work. Read-only mode is the first thing I enable, and it covers most of what I need. Scoped the token to just what the agent needs and it respected that. Nice that it supports both stdio and HTTP, I use stdio locally and HTTP for the shared agent. Would recommend without hesitation.
Used for Posting daily standup summaries
- Setup & docs 4/5
- Auth experience 4/5
- Reliability 5/5
- Maintainer responsiveness 4/5
Write a review
Ran this server? Tell other teams how it went. You get one review per server. We email you a link to confirm it, then an editor checks it before it goes up. We never show your email.