Setting the auth token in configuration is the path that keeps the password out of the model's context, and the credentials set that way are injected only into the calls that need them rather than shown to the model. That warning is the vendor's, not a reading of ours. The monitor layer is the part with published limits, each tool stating its own rate, and the webhook test reports the HTTP status your endpoint returned rather than only whether the call went out. Cost is metered here and not only at X, so the account balance is a number worth reading before a long crawl.
An X/Twitter server over GetXAPI, an independent third-party API not affiliated with X: search and retrieval, posting and engagement, profile and article management, direct messages, and a monitor layer that delivers new tweets to a webhook. Reading needs only the GetXAPI key; anything that acts on a real account needs that account's own session.
- Retrieval down to a single tweet: advanced_search_tweets takes operators with paging, get_tweet_detail returns author, media and engagement data, get_tweet_thread resolves a linear self-thread from any tweet inside it, and get_tweet_replies and get_tweet_retweeters page the responses.
- Timelines and profiles: get_user_tweets, get_user_tweets_and_replies, get_user_tweets_complete with self-thread expansion, get_user_media, get_user_mentions, get_user_likes and get_home_timeline, alongside get_user_info, get_user_info_by_id and get_user_about for account creation location and username history.
- Follower-graph reads: get_user_followers and get_user_following, their v2 counterparts with a canDm field, get_verified_followers, get_followers_you_know for mutuals, check_follow_relationship for follow, block and mute state, and get_user_affiliates for a verified organisation's accounts.
- Posting and engagement: create_tweet with text, media, a quote target and a reply target, favorite_tweet, retweet_tweet, bookmark_tweet, unbookmark_tweet, follow_user, unfollow_user, delete_tweet, and upload_media through the chunked upload flow.
- Long-form articles as a full lifecycle: create_article with an optional publish, update_article for title, body markdown or cover image, list_articles by lifecycle, then publish_article, unpublish_article, delete_article and get_article.
- Direct messages: list_direct_messages by tab, get_direct_message_conversation newest-first with cursor paging, and send_direct_message addressed by id or username.
- Profile maintenance: update_avatar, update_banner, and update_profile for name, bio, location, URL, link colour and birthdate.
- Real-time monitoring: add_monitor starts watching an account, create_monitor_webhook registers the HTTPS destination, test_monitor_webhook sends a correctly signed payload down the live delivery path and reports the HTTP status your server returned, and update_monitor pauses or retunes it.
- Ambient context: get_trends by country or place id, get_trend_locations, get_space_info for a Space's title, host, state and listener counts, download_space as MP3 with an optional transcript, plus list and search over bookmarks, list members and user search.
- Account visibility: get_account_info returns the GetXAPI account, its credit balance and usage summary, and get_payment_history returns top-ups.
A GetXAPI key in GETXAPI_KEY on an account carrying credit — every tool call is metered as ordinary API usage, with no separate charge for going through MCP. That key alone covers every read tool. The write and private half — posting, liking, DMs, articles, profile edits — additionally needs the X account's own session, and there are two ways to supply it: a login tool that takes your password as a tool argument, or X_AUTH_TOKEN set in the server's configuration. Prefer the second: the vendor's own guidance is that the password otherwise transits the model's context.
One command plus a key — npx -y @getxapi/mcp@latest, then supply credentials