x-mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited x-mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Use this skill when you need an AI agent to configure or use Nekoneko's public X/Twitter MCP server.
https://x-mcp.nekoneko.dev/mcphttps://x-mcp.nekoneko.dev/.well-known/mcp.jsonhttps://twitter.2-38.com/api/fx/2/...https://github.com/mc-nekoneko/x-mcpUse x-mcp for public, read-only X/Twitter lookups through twitter.2-38.com:
from:jack, #AI, keywordsDo not use this MCP for posting, liking, retweeting, following, DMs, notifications, private accounts, or authenticated timeline access. It only wraps public read-only endpoints.
For Nekoneko's normal public X/Twitter search and retrieval requests, prefer this MCP over built-in x_search or the xurl CLI. Reserve xurl for explicit authenticated or write-capable X API operations that this read-only MCP cannot perform.
Prefer the Hermes MCP CLI if available:
hermes mcp add x --url https://x-mcp.nekoneko.dev/mcp
hermes mcp test xOr add this to ~/.hermes/config.yaml and restart Hermes / start a new session:
mcp_servers:
x:
url: "https://x-mcp.nekoneko.dev/mcp"Expected Hermes tool names after discovery are prefixed with the server name, for example:
mcp_x_search_posts
mcp_x_get_post
mcp_x_get_profile
mcp_x_get_profile_statuses
mcp_x_get_profile_media
mcp_x_get_trends
mcp_x_typeahead
mcp_x_get_openapiUse the remote/HTTP/Streamable HTTP server URL supported by your client:
{
"mcpServers": {
"x": {
"url": "https://x-mcp.nekoneko.dev/mcp"
}
}
}Some clients use servers instead of mcpServers, or require an explicit transport/type field. Keep the same URL and select the client's HTTP / Streamable HTTP MCP transport.
search_postsUse for public X search queries. This wraps:
https://twitter.2-38.com/api/fx/2/searchArguments:
q — required query string. Examples: from:jack, #AI, open source, from:jack builderbotfeed — latest or top; default latestcount — 1 to 100; default 10cursor — optional pagination cursor from a previous responseExample request concept:
{
"q": "from:jack",
"feed": "latest",
"count": 10
}This calls the same upstream shape as:
https://twitter.2-38.com/api/fx/2/search?q=from%3Ajack&feed=latest&count=10get_postUse when you already have a numeric status ID and need post details.
{ "id": "2067319680654594543" }get_profileUse for public profile metadata.
{ "handle": "jack" }The handle may include or omit @; the server normalizes it.
get_profile_statusesUse for a public profile's recent posts.
{ "handle": "jack", "count": 10 }get_profile_mediaUse for a public profile's recent media posts.
{ "handle": "jack", "count": 10 }get_trendsUse for public trend data.
{ "count": 10 }typeaheadUse for account/query suggestions.
{ "q": "jack", "count": 10 }get_openapiUse when you need to inspect the upstream API schema.
After installing/configuring the MCP, verify all of these:
curl -sS https://x-mcp.nekoneko.dev/health curl -sS https://x-mcp.nekoneko.dev/.well-known/mcp.jsontools/list includes search_posts.search_posts call with q="from:jack", feed="latest", count=2 returns status 200 and an upstreamUrl beginning with: https://twitter.2-38.com/api/fx/2/search?q=from%3AjackTool results are JSON serialized into MCP text content. Parse the text as JSON when possible.
Typical top-level fields:
{
"upstreamUrl": "https://twitter.2-38.com/api/fx/2/search?...",
"status": 200,
"data": { "code": 200, "results": [] }
}Common data fields depend on the upstream endpoint. Search/profile timeline endpoints usually return results and may return cursor for pagination.
twitter.2-38.com, so treat results as current external data and cite timestamps/URLs when reporting.twitter.2-38.com and may change.count values first, then paginate with cursor if needed.When a user asks for X/Twitter information:
get_postget_profile, get_profile_statuses, or get_profile_mediasearch_poststypeaheadfeed="latest" unless the user asks for popular/top results.count=10 or less for quick checks.twitter.2-38.com.~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.