Apitwitter Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Apitwitter Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
MCP server for the apitwitter.com Twitter/X API. Lets Claude Desktop, Cursor, and any other MCP client use X/Twitter as first-class tools: read timelines, search, post tweets, DMs, lists, communities, topics, bookmarks, follows, likes — the full surface.
actions are performed as. You can pass it per tool call, or set a default via APITWITTER_COOKIE.
uvx (zero-install, recommended){
"mcpServers": {
"apitwitter": {
"command": "uvx",
"args": ["apitwitter-mcp"],
"env": {
"APITWITTER_KEY": "sk_live_...",
"APITWITTER_COOKIE": "auth_token=...; ct0=..."
}
}
}
}pippip install apitwitter-mcp{
"mcpServers": {
"apitwitter": {
"command": "apitwitter-mcp",
"env": {
"APITWITTER_KEY": "sk_live_...",
"APITWITTER_COOKIE": "auth_token=...; ct0=..."
}
}
}
}Place the snippet in:
%APPDATA%\Claude\claude_desktop_config.json (Windows) or ~/Library/Application Support/Claude/claude_desktop_config.json (macOS)Restart the client; the tools appear under the hammer icon.
| Var | Required | Default | Purpose |
|---|---|---|---|
APITWITTER_KEY | yes | — | Your apitwitter.com API key (sent as X-API-Key). |
APITWITTER_COOKIE | no | — | Default x.com session cookie. Without it, every tool call must pass cookie=. |
APITWITTER_BASE | no | https://api.apitwitter.com | Override for self-hosting / staging. |
APITWITTER_PROXY | no | — | Default proxy URL for Twitter requests. |
APITWITTER_TIMEOUT | no | 60 | HTTP timeout (seconds). |
All endpoints of /twitter/* are exposed. Every tool accepts optional cookie and proxy arguments that override the env defaults.
Tweets — post_tweet, lookup_tweet, get_user_tweets, get_for_you_timeline, get_latest_timeline, search_tweets, delete_tweet, retweet, unretweet, pin_tweet, unpin_tweet
Users — verify_session, get_user, get_users_batch, get_user_by_id, get_user_followers, get_user_following, get_user_likes, get_user_media, get_user_replies, get_followers_you_know, remove_follower, get_blocked_accounts, get_muted_accounts
Engagement — like_tweet, unlike_tweet, follow_user, unfollow_user
DMs — get_dm_inbox, get_xchat_token, get_dm_permissions, block_dm, unblock_dm, send_dm
Bookmarks — bookmark_tweet, unbookmark_tweet, get_bookmarks
Lists — create_list, delete_list, get_owned_lists, get_list_memberships, get_list_info, get_list_tweets, get_list_members, add_list_member, remove_list_member, get_list_subscribers, subscribe_list, unsubscribe_list
Communities — explore_communities, get_community, join_community, leave_community, get_community_tweets, get_community_media
Topics — get_topic, follow_topic, unfollow_topic
git clone https://github.com/YOUR_ORG/apitwitter-mcp
cd apitwitter-mcp
python -m venv .venv && .venv\Scripts\activate # Windows
pip install -e .
set APITWITTER_KEY=sk_live_...
set APITWITTER_COOKIE=auth_token=...; ct0=...
apitwitter-mcp # stdio serverTo point at a staging backend:
set APITWITTER_BASE=http://localhost:8000MIT
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.