xpoz-best-practices — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited xpoz-best-practices (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Xpoz is a social media intelligence platform providing access to Twitter/X, Instagram, Reddit, and TikTok data through MCP tools, Python SDK, TypeScript SDK, and CLI — no social media API keys required.
Load this skill for any Xpoz interaction — not just when the user explicitly asks about best practices. It provides the context needed to use Xpoz tools correctly:
MCP — add the Xpoz MCP server to your agent's config. The server URL is https://mcp.xpoz.ai/mcp. Most MCP clients handle OAuth automatically on first tool call.
Example for Claude Code (~/.claude.json):
{
"mcpServers": {
"xpoz": {
"url": "https://mcp.xpoz.ai/mcp",
"transport": "streamable-http"
}
}
}Python SDK:
pip install xpozfrom xpoz import XpozClient
client = XpozClient() # reads XPOZ_API_KEY env var
results = client.twitter.search_posts("artificial intelligence")
print(f"Found {results.pagination.total_rows:,} tweets")
client.close()TypeScript SDK:
npm install @xpoz/xpozimport { XpozClient } from "@xpoz/xpoz";
const client = new XpozClient();
await client.connect();
const results = await client.twitter.searchPosts("artificial intelligence");
console.log(`Found ${results.pagination.totalRows.toLocaleString()} tweets`);
await client.close();CLI:
pip install xpoz-cli
xpoz-cli twitter search_posts --query "artificial intelligence" --limit 20See [references/authentication.md](references/authentication.md) for detailed auth flows (MCP, SDK, CLI). See [references/sdk.md](references/sdk.md) for complete Python & TypeScript SDK reference. See [references/cli.md](references/cli.md) for CLI installation, commands, and rendering modes.
All keyword search tools support boolean query syntax:
| Operator | Example | Effect |
|---|---|---|
| Exact phrase | "machine learning" | Matches exact phrase |
| OR | "AI" OR "artificial intelligence" | Matches either term |
| AND | "Tesla" AND "earnings" | Matches both terms |
| Grouping | ("deep learning" OR "neural network") AND python | Combines operators |
Date filtering: Use startDate / endDate in YYYY-MM-DD format. Omit to use defaults (varies by tool).
Content filtering (Twitter only): Set filterOutRetweets: true to exclude retweets.
Forbidden in query string: from:, to:, lang:, since:, until:, filter: — use dedicated parameters instead.
| Tool | Purpose |
|---|---|
getTwitterUser / getTwitterUsers | Look up 1-100 users by ID or username |
searchTwitterUsers | Fuzzy search users by name |
getTwitterUserConnections | Get followers or following |
getTwitterUsersByKeywords | Find users who posted about a topic |
getTwitterPostsByIds | Get 1-100 posts by ID |
getTwitterPostsByAuthor | Get all posts from a username |
getTwitterPostsByKeywords | Search posts by keywords |
getTwitterPostRetweets | Get retweets of a post |
getTwitterPostQuotes | Get quote tweets of a post |
getTwitterPostComments | Get replies to a post |
getTwitterPostInteractingUsers | Get commenters, quoters, or retweeters |
countTweets | Count tweets matching a phrase |
See [references/twitter.md](references/twitter.md) for all parameters, fields, and examples.
| Tool | Purpose |
|---|---|
getInstagramUser | Look up user by ID or username |
searchInstagramUsers | Fuzzy search users by name |
getInstagramUserConnections | Get followers or following |
getInstagramUsersByKeywords | Find users who posted about a topic |
getInstagramPostInteractingUsers | Get commenters or likers of a post |
getInstagramPostsByIds | Get posts by strong_id |
getInstagramPostsByUser | Get posts from a user |
getInstagramPostsByKeywords | Search posts by keywords in captions/subtitles |
getInstagramCommentsByPostId | Get comments on a post |
See [references/instagram.md](references/instagram.md) for all parameters, fields, and examples.
| Tool | Purpose |
|---|---|
getRedditUser | Look up user by username |
searchRedditUsers | Fuzzy search users by name |
getRedditUsersByKeywords | Find users who posted about a topic |
getRedditPostsByKeywords | Search posts by keywords |
getRedditPostWithCommentsById | Get a post with all its comments |
getRedditCommentsByKeywords | Search comments by keywords |
searchRedditSubreddits | Search subreddits by name |
getRedditSubredditWithPostsByName | Get subreddit details with posts |
getRedditSubredditsByKeywords | Search subreddits by keyword in description |
See [references/reddit.md](references/reddit.md) for all parameters, fields, and examples.
| Tool | Purpose |
|---|---|
getTiktokUser | Look up user by ID or username |
searchTiktokUsers | Fuzzy search users by name |
getTiktokUsersByKeywords | Find users who posted about a topic |
getTiktokUsersByHashtags | Find users who used specific hashtags |
getTiktokPostsByIds | Get posts by ID |
getTiktokPostsByUser | Get posts from a user |
getTiktokPostsByKeywords | Search posts by keywords |
getTiktokPostsByHashtags | Search posts by hashtags |
getTiktokCommentsByPostId | Get comments on a post |
See [references/tiktok.md](references/tiktok.md) for all parameters, fields, and examples.
Setting up tracking is a best practice for getting more complete data from Xpoz. Tracked items are crawled regularly in the background, which means:
Track keywords, users, subreddits, and hashtags across all 4 platforms.
Supported types per platform:
| Platform | keyword | user | subreddit | hashtag |
|---|---|---|---|---|
| Yes | Yes | — | — | |
| Yes | Yes | — | — | |
| Yes | Yes | Yes | — | |
| TikTok | Yes | Yes | — | Yes |
View current tracking:
MCP: call getTrackedItems
Python: client.tracking.get_tracked_items()
TypeScript: await client.tracking.getTrackedItems()
CLI: xpoz-cli tracking get_tracked_itemsAdd tracked items:
MCP: call addTrackedItems with items: [{ phrase: "AI agents", type: "keyword", platform: "twitter" }]
Python: client.tracking.add_tracked_items([{ "phrase": "AI agents", "type": "keyword", "platform": "twitter" }])
TypeScript: await client.tracking.addTrackedItems([{ phrase: "AI agents", type: "keyword", platform: "twitter" }])
CLI: xpoz-cli tracking add_tracked_items --items '[{"phrase": "AI agents", "type": "keyword", "platform": "twitter"}]'Remove tracked items:
MCP: call removeTrackedItems with items: [{ phrase: "AI agents", type: "keyword", platform: "twitter" }]
Python: client.tracking.remove_tracked_items([...])
TypeScript: await client.tracking.removeTrackedItems([...])
CLI: xpoz-cli tracking remove_tracked_items --items '[{"phrase": "AI agents", "type": "keyword", "platform": "twitter"}]'See [xpoz-social-tracking](../xpoz-social-tracking/SKILL.md) for full tracking workflows and advanced patterns.
All paginated tools support three response modes via responseType:
| Mode | Behavior | Best For |
|---|---|---|
"fast" (default) | Returns up to 300 results immediately | Quick lookups, exploration |
"paging" | Async — returns operationId, poll with checkOperationStatus | Large datasets, page-by-page |
"csv" | Async CSV export to S3 — returns download URL | Bulk export, offline analysis |
See [references/pagination-and-export.md](references/pagination-and-export.md) for async polling patterns, pagination, and CSV export details.
Pass fields to request only the data you need. This reduces response size and improves performance.
MCP: fields: ["id", "text", "authorUsername", "likeCount"]
Python: fields=["id", "text", "author_username", "like_count"]
TypeScript: fields: ["id", "text", "authorUsername", "likeCount"]
CLI: --fields id text author_username like_countEach platform has different available fields — see the platform-specific references for complete field lists.
Search → Analyze → Export:
Find Users → Get Their Posts → Analyze:
Data Freshness:
forceLatest: true to bypass cache and force a live fetch (increases latency and cost)| Problem | Solution |
|---|---|
| MCP: "Unauthorized" | Re-run OAuth flow — see references/authentication.md |
SDK: AuthenticationError | Verify key at xpoz.ai/settings |
| Empty results | Check query syntax, widen date range, try different keywords |
| Stale data | Use forceLatest: true to bypass cache |
| Operation timeout | Keep polling checkOperationStatus every ~5s until status is no longer running |
| Token exchange fails | Ask user to re-authorize — codes are single-use |
For complete parameters, response fields, patterns, and examples:
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.