Agent-first X/Twitter client in Go — JSON envelope per command, multi-account, cookie-safe anti-detection for autonomous agents
SaferSkills independently audited AgentX (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
agentx is a single Go binary. Every command prints one JSON envelope to stdout, so parse stdout as JSON and check .ok. Build: go build -o agentx ./cmd/agentx.
{"ok":true,"schema_version":"1","data":<any>,"pagination":{"nextCursor":"…"},"rateLimit":{…}}
{"ok":false,"schema_version":"1","error":{"code":"…","message":"…"}}Rules: check .ok first. List data → .data is an array + .pagination.nextCursor. Single object → .data is an object. On error read .error.code (machine) + .error.message (human). Exit code ≠0 on error. Output is compact single-line JSON by default (token-efficient); add --pretty only when a human reads it.
agentx account add --name NAME --auth-token <auth_token> --ct0 <ct0>Cookies come from a logged-in browser (auth_token + ct0). Env fallback: TWITTER_AUTH_TOKEN, TWITTER_CT0. Store: $AGENTX_HOME/accounts.json (default ~/.agentx, mode 0600). Multi-account: add several, pick with -a NAME. account login --name N --username U (pass via $TWITTER_PASSWORD) does user/pass→cookies but X blocks login from datacenter IPs — prefer cookies.
-a NAME account · -n N max items · --cursor C page cursor · --pretty human-readable JSON · --account/--count long forms. IDs: any <id> also accepts a full tweet/list/community URL. Handles: with or without @.
READ
feed [--latest] [-n N] [--cursor C] home timeline
search [--type Top|Latest] <query> search
user <handle> | user --id <id> profile
me own profile
posts <handle> [-n N] a user's tweets
media <handle|id> [-n N] user's photos/videos
tweet <id> single tweet (zero-auth FxTwitter fallback)
thread <id> tweet + replies
article <id> [--markdown] long-form X Article
analytics <id> metrics + engagement rate
likes <handle> | bookmarks | mentions tweet lists
followers <handle> | following <handle> user lists
retweeters <id> | likers <id> who RT'd/liked (likers: author-only by X)
list <id> | list members <id> List tweets / members
community posts <id> [--latest] | community info <id>
notifications [all|mentions|verified] | unread (alias: notif)
trends [woeid] | trends locations trending (Indonesia woeid=23424846)
scheduled | drafts your queued/draft tweets
settings your privacy settingsWRITE (state-changing; reversible ones noted)
post <text> [--media f [--alt txt]] [--thread] tweet (>280 → long-form, Premium)
reply <id> <text> [--media f] | quote <id> <text> [--media f]
poll <text> --option A --option B [--option C|D] [--duration MIN]
vote <id> <choice 1-4>
like/unlike retweet/unretweet bookmark/unbookmark delete <id>
pin/unpin <id> pin tweet to profile
bookmark <id> --folder <id> bookmark into folder
follow/unfollow mute/unmute block/unblock <handle>
edit <id> <text> Premium
draft <text> | draft delete <id>
schedule <unix|+30m|+2h|+1d> <text> | unschedule <id>
profile [--name N] [--bio B] [--location L] [--url U]
avatar <img> | banner <img>
settings [--protected b] [--dms-from all|following] [--discoverable-email b] [--geo b]
topic follow|unfollow <topic_id>
list create <name> [--desc T] [--private] | list delete <id>
list add|remove <listid> <handle|id> | list subscribe|unsubscribe <id>
community join|leave <id> | community create <name> (create is permanent)
bookmarks folder create <name> | delete <id> (Premium)
dm send <handle> <text> [--media f]GROK (AI)
grok <prompt> text answer (live web search built in)
grok image <prompt> [--out file] generate image(s), download to file(s)UTILITIES
download <id|url> [--out f] [--all] save tweet media / a direct URL
watch <mentions|search <q>> [--interval 60s] [--once] NDJSON stream of new tweets
account list|remove <n>|default [n]|check [n]List commands return .pagination.nextCursor. Pass it back via --cursor for the next page. -n N caps items in the response (note: the cursor still points past the full fetched page, so for exact paging use the cursor, not a tiny -n).
.error.code)not_authenticated bad/expired cookies · not_found · invalid_input · rate_limited (see .rateLimit) · query_id_error X rotated a GraphQL id → set AGENTX_QID_<Operation>=<id> env or update constants · network_error · api_error x.com rejected (message has detail) · account_error.
edit, note/long-form post (>280), bookmarks folder writes.community create needs an eligible account.dm send/list/download. X's new XChat is end-to-end encrypted and out of scope (keys are device-only, non-extractable)..rateLimit carries x-rate-limit-*; back off when remaining is low.AGENTX_UTLS=1 sends a Chrome JA3 TLS fingerprint (HTTP/2) for stealth.agentx posts elonmusk -n 20agentx reply <id> "nice" · Quote with image: agentx quote <id> "look" --media pic.jpgagentx post --thread "long text…" · Poll: agentx poll "Q?" --option A --option Bagentx schedule +2h "later" then agentx scheduledagentx grok "USD to IDR today?" · Image: agentx grok image "a dragon" --out d.pngagentx feed -n 40 → take nextCursor → agentx feed --cursor <c>~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.