xpoz-getting-started — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited xpoz-getting-started (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Xpoz is a social media intelligence platform providing access to Twitter/X, Instagram, Reddit, and TikTok data — no social media API keys required. Available via MCP tools, Python SDK, TypeScript SDK, and CLI.
Activate when the user asks:
| Situation | Path |
|---|---|
| Using an MCP-compatible AI agent (Claude Code, Cursor, Windsurf, etc.) | MCP |
| Building a Python application | Python SDK |
| Building a TypeScript/Node.js application | TypeScript SDK |
| Running from terminal | CLI |
Quick check — already set up?
checkAccessKeyStatus — if it returns hasAccessKey: true, skip to Step 4XpozClient — if no error, skip to Step 4Real results need a real key: get a free access key (free tier, up to 75K results, no credit card), then follow your integration path (MCP, SDK, or CLI, below). MCP connections sign in with the same account via OAuth on first tool call.
Add the Xpoz MCP server to your agent's config. The server URL is https://mcp.xpoz.ai/mcp. Most MCP clients handle OAuth automatically on first tool call.
Example for Claude Code (~/.claude.json):
{
"mcpServers": {
"xpoz": {
"url": "https://mcp.xpoz.ai/mcp",
"transport": "streamable-http"
}
}
}For other MCP clients, consult your agent's documentation for how to add an MCP server by URL.
pip install xpozAsk the user:
"Go to https://xpoz.ai/get-token (free, no credit card) and paste the key."
WAIT for the user to reply with the key. Do not proceed until they respond.
from xpoz import XpozClient
client = XpozClient("THE_KEY_FROM_USER")Or set the environment variable and use the default constructor:
export XPOZ_API_KEY=THE_KEY_FROM_USERnpm install @xpoz/xpozAsk the user for the key (same URL).
WAIT for the user to reply with the key. Do not proceed until they respond.
import { XpozClient } from "@xpoz/xpoz";
const client = new XpozClient({ apiKey: "THE_KEY_FROM_USER" });
await client.connect();pip install xpoz-cli
export XPOZ_API_KEY=THE_KEY_FROM_USER| Problem | Solution |
|---|---|
| MCP: "Unauthorized" | Re-run the OAuth flow |
SDK: AuthenticationError | Verify key at xpoz.ai/settings |
| Token exchange fails | Ask user to re-authorize — codes are single-use |
See xpoz-best-practices/references/authentication.md for detailed auth flows and troubleshooting.
MCP: call checkAccessKeyStatus — expect hasAccessKey: true.
Then call getAccountDetails to retrieve the user's account information. Present a summary:
## Your Xpoz Account
**Plan:** [plan name]
**Billing period:** [start] – [end]
**Next renewal:** [date]
### Usage
- Subscription credits remaining: [X]
- Extra credits: [X]
- Tracked items: [X] / [limit]Setting up tracking is highly recommended — it's a best practice for getting more complete data. Tracked items are crawled regularly, so your search results have better coverage and capture activity that one-off queries might miss. Walk the user through their first tracked items.
Ask:
"What would you like to monitor? For example: - Your brand name as a keyword across all platforms - A competitor's account on Twitter/Instagram - A relevant hashtag on TikTok - A subreddit in your niche"
WAIT for the user to reply. Do not proceed until they respond.
| Platform | keyword | user | subreddit | hashtag |
|---|---|---|---|---|
| Yes | Yes | — | — | |
| Yes | Yes | — | — | |
| Yes | Yes | Yes | — | |
| TikTok | Yes | Yes | — | Yes |
Call addTrackedItems with items:
[{ phrase: "your brand", type: "keyword", platform: "twitter" },
{ phrase: "your brand", type: "keyword", platform: "reddit" },
{ phrase: "competitor_username", type: "user", platform: "instagram" }]Call getAccountDetails to check available tracked item slots.
See xpoz-social-tracking for advanced tracking workflows.
| Platform | Users | Posts | Comments | Connections | Interactions | Special |
|---|---|---|---|---|---|---|
| lookup, search, by keywords | by ID, author, keywords | replies | followers/following | commenters/quoters/retweeters | countTweets | |
| lookup, search, by keywords | by ID, user, keywords | by post | followers/following | commenters/likers | strong_id format | |
| lookup, search, by keywords | by keywords, with comments | by keywords | — | — | subreddit search/lookup | |
| TikTok | lookup, search, by keywords, by hashtags | by ID, user, keywords, hashtags | by post | — | — | hashtag search |
| "I want to..." | Use this skill |
|---|---|
| Export tweets to CSV | twitter-data-export |
| Find influencers | influencer-discovery |
| Vet Instagram creators | creator-authenticity-score |
| Compare brands | competitive-intel |
| Analyze sentiment | social-sentiment-analyzer |
| Research Reddit discussions | reddit-research |
| Monitor security threats | security-osint |
| See what AI engines cite | ai-answer-trace |
| Check my brand's AI visibility | geo-visibility-check |
| Get cited by AI via Reddit | geo-reddit |
| Find buying-intent leads | lead-gen-scan |
| Track keywords/users | xpoz-social-tracking |
| Learn Xpoz patterns | xpoz-best-practices |
Quick examples to try immediately:
MCP:
Call getTwitterPostsByKeywords:
query: "AI agents"
fields: ["id", "text", "authorUsername", "likeCount"]Python:
results = client.twitter.search_posts(
"AI agents",
fields=["id", "text", "author_username", "like_count"]
)
for post in results.data[:5]:
print(f"@{post.author_username}: {post.text[:100]}")TypeScript:
const results = await client.twitter.searchPosts("AI agents", {
fields: ["id", "text", "authorUsername", "likeCount"],
});
results.data.slice(0, 5).forEach(post =>
console.log(`@${post.authorUsername}: ${post.text.slice(0, 100)}`)
);CLI:
xpoz-cli twitter search_posts --query "AI agents" --fields id text author_username like_count --limit 5~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.