XActions — Watchlist | MCP100 Index

MCP100 Assessment

Watchlist / Tracking

Why we’re tracking it

Track provider API and authorization controls because the tool surface can perform external actions

Reviewed Oct 5, 2026 · Documentation review; complete setup workflow not independently tested

Best fit

X/Twitter research and automation with optional human approval for every write.

What we know

Large X/Twitter automation MCP supporting scraping, analytics, publishing, engagement, DMs, account actions and workflow automation.

Maintenance / activity evidence

Observed Oct 5, 2026 (UTC)Update README.md

Tracking evidence observed Oct 5, 2026. These dated signals do not establish current maintenance. Reviewed enrichment confidence: high.

Activity source · commits ↗Activity source · releases ↗

Verification gaps / watch-outs

Installation and comprehensive security have not been independently audited.
Authenticated account authority with tool filtering/approval options. Writes: Post/reply/delete; Like/repost/bookmark; Follow/unfollow/mute/block; DM; Scheduling/bulk workflows.
Live X session cookies.
Sensitive access: Account cookies, DMs, Private account state

Highly privileged social-account automation; draft approval and daily action caps should be enabled.

Security source · repository notice ↗Security source · policy file ↗Security source · policy file (attribution not established) ↗

Full authority, access and evidence limits are available in Review context and Access & risk.

Popularity

543 repository stars

Stars observed Sep 25, 2026.

Do not overwrite existing reviewed stars/download metrics with nulls from this enrichment batch.

All limitations / Review context

What action scope, credential handling, and write controls are currently documented?

The repository documents social-account automation and write-capable actions; the bounded assessment records the high-impact capability as an uncertainty and does not treat the project as installation-safe.

Highly privileged social-account automation; draft approval and daily action caps should be enabled.
Authenticated account authority with tool filtering/approval options.
Live X session cookies.
Local use talks directly to x.com; session cookies are sensitive.
Reviewed write actions: Post/reply/delete; Like/repost/bookmark; Follow/unfollow/mute/block; DM; Scheduling/bulk workflows
Sensitive access: Account cookies, DMs, Private account state
Installation, client compatibility and comprehensive security have not been independently audited. Authentication and access depend on the configured services.
The documented action surface can perform external account actions; authorization and abuse controls were not independently assessed.
No independent runtime, installation, or comprehensive security audit was performed.
No installation, runtime, client matrix, or complete tool-contract audit was performed in this review.
Most action tools need live session cookies.
Relies on X internal endpoints/browser behavior and can trigger platform enforcement.
Exact tool counts vary across documentation snapshots.

Original activity observations

2026-10-05T05:46:46Z: Update README.md

Technical identity

github.com/nirholas/xactions

Exact implementation source: https://github.com/nirholas/xactions ↗
Reviewed resource type: MCP Server
Repository identity: nirholas/xactions
Package identity: npm:xactions
Service endpoint: /mcp

Evidence & Sources

Evidence basis: Recorded source evidence
Setup runtime verification: Not independently runtime-tested by MCP100 for this setup workflow.

Reviewed Oct 5, 2026 · Latest source observation Oct 7, 2026

GitHub repository ↗
nirholas/xactions
Recorded repository material and project history.
Includes references whose attribution is not established.

Setup · Watchlist

Install & Agents

claude-desktop

Publisher instructions with a documented client setup path.

Source evidence observed Oct 14, 2026.

Additional setup details required — see the specific gaps below.

Warning

Cookie theft risk; never send real cookies to MCP100 or place in repositories.
Social automation may violate platform rate/abuse policies.
Never perform live writes, trades, scans, account actions or active external operations as setup verification.
Purpose detail: config_preview
Publisher JSON configuration for JSON-based MCP clients; not Codex config.toml. Publisher-supported parameters assembled into a machine-readable JSON example; placeholders are user-specific and no real credentials are included. Treat as reviewed composed example rather than a verbatim executable test. Replace the supplied credential/path placeholders privately; use the named host's configuration schema.
Distinguish client registration removal from software uninstall, persistent data deletion and provider OAuth/API-key revocation.

Install / connect
Publisher instructions
XActions MCP lets clients access X/Twitter data with session-cookie-backed capabilities.
mcp stdio launcher or diagnostic · Publisher instructions
npx xactions mcp-config
Configure / authenticate
MCP100 setup guide
XActions offers public keyless X scraping plus optional browser-cookie login and separate MCP transports. Treat cookie/session exports as sensitive credentials and require consent; writing to X is not a setup check.
Advanced configuration · claude desktop json · MCP100 composed guide
claude desktop json · MCP100 composed guide
{ "mcpServers": { "xactions": { "args": [ "-y", "xactions-mcp" ], "command": "npx", "env": { "XACTIONS_SESSION_COOKIE": "YOUR_PRIVATE_X_SESSION_COOKIE" } } } }
Check connection
Suggested check
Run public profile read without login, not like/follow/DM actions.
Remove / uninstall / revoke
MCP100 setup guide
For matching host registration; clear separate xactions login/cookie file only on explicit choice. CLI generated MCP config is not equivalent to server installed.
Distinguish client registration removal from software uninstall, persistent data deletion and provider OAuth/API-key revocation.
claude mcp remove xactions

Official Documentation & Sources

What it does

Large X/Twitter automation MCP supporting scraping, analytics, publishing, engagement, DMs, account actions and workflow automation.

Capability: Browser Automation
Resource type: MCP Server
Industry: Media & Marketing
Best fit: X/Twitter research and automation with optional human approval for every write.

Representative uses

Read/search profiles/timelines/analytics
Post/reply/quote/like/repost
Follow/unfollow/mute/block
Send DMs and schedule workflows

Limitations

Most action tools need live session cookies.
Relies on X internal endpoints/browser behavior and can trigger platform enforcement.
Exact tool counts vary across documentation snapshots.

Reviewed access

Access & risk

Review the exact access boundary before connecting this MCP to accounts, credentials, or sensitive data.

Authentication: Live X session cookies.
Permissions: Authenticated account authority with tool filtering/approval options.
Data handling: Local use talks directly to x.com; session cookies are sensitive.
Cost: free
Risk and cautions: Highly privileged social-account automation; draft approval and daily action caps should be enabled.

Access scope and cautions

Write actions: Post/reply/delete Like/repost/bookmark Follow/unfollow/mute/block DM Scheduling/bulk workflows
Sensitive access: Account cookies DMs Private account state
Risk level: high

FAQ

Based on reviewed evidence as of 2026-10-07. Watchlist tracking is not a recommendation or a security certification.

Which tasks are documented for this implementation?

The reviewed tasks include: Read/search profiles/timelines/analytics; Post/reply/quote/like/repost; Follow/unfollow/mute/block; Send DMs and schedule workflows.

What setup and authentication are documented?

Recorded installation/entrypoint step: npm install -g xactions; xactions-mcp. Recorded transport: stdio, streamable_http. Recorded environment-variable notes: XACTIONS_SESSION_COOKIE; XACTIONS_MCP_REQUIRE_APPROVAL optional; XACTIONS_MCP_TOKEN optional; OPENROUTER_API_KEY optional. No configuration values are supplied here. Prerequisites: Node.js 18+. These are the documented setup details, not a claim that installation or client compatibility was independently tested. Authentication: X auth cookie (+ CSRF for writes); optional inbound HTTP bearer.

Can it modify data or perform write operations?

Documented write actions include: Post/reply/delete; Like/repost/bookmark; Follow/unfollow/mute/block; DM; Scheduling/bulk workflows. Recorded permission boundary: Authenticated account authority with tool filtering/approval options.

What data-handling boundary should I consider?

Local use talks directly to x.com; session cookies are sensitive. Recorded sensitive-access context: Account cookies; DMs; Private account state.

What limitations and risks should I check before use?

Highly privileged social-account automation; draft approval and daily action caps should be enabled. Most action tools need live session cookies. Relies on X internal endpoints/browser behavior and can trigger platform enforcement. Exact tool counts vary across documentation snapshots. The documented action surface can perform external account actions; authorization and abuse controls were not independently assessed. No independent runtime, installation, or comprehensive security audit was performed.

Is this an official MCP?

XActions / nirholas is listed as First-party MCP in MCP100’s current evidence.