Most Twitter servers read credentials from the environment, which means the machine running them is a place tokens live. Here the client completes OAuth and passes tokens down with each call, so the same container can serve different accounts and a compromise of the host yields nothing. The trade-off is that the calling side has to manage refresh, which is what the refresh tool exists for.
A Twitter server designed to hold no credentials of its own. Every call carries the tokens it needs as arguments, so the process can run headless in a container with no browser, no local files and nothing to leak if the host is shared.
- Search tweets by `query`, with `max_results` to bound the response
- Recent tweets by a given `user_id`, and recent replies by that user
- Post a new tweet from `text`
- Reply to an existing tweet by `tweet_id`
- `twitter_refresh_token` exchanges a refresh token for a new access token and its expiry
- Refreshing works with just the refresh token, client ID and client secret once the access token has expired
Python 3.10 or higher, or the published Docker image. Twitter API credentials from the Twitter Developer Portal — client ID, client secret, access token and refresh token — obtained by completing the OAuth flow yourself. Those values are passed as tool arguments rather than environment variables, which is the whole point of the design: the client keeps the credentials, the server never stores them.
One command plus a key — docker run -i --rm buryhuang/mcp-twitter-noauth:latest, then supply credentials