Back to Browse

Twitter MCP Server

Marketing & SocialModerate5.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Read public X posts, replies, profiles, and search results through Rettiwt or the official API.

About

Read public X posts, replies, profiles, and search results through Rettiwt or the official API.

Security Report

5.2
Moderate5.2Moderate Risk

This is a well-architected Twitter/X MCP server with proper authentication, clear credential handling, and appropriate permission scoping. The code is clean, type-safe, and follows security best practices. Minor code quality observations exist but do not present security risks. Supply chain analysis found 3 known vulnerabilities in dependencies (2 critical, 0 high severity). Package verification found 1 issue.

7 files analyzed · 8 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

env_vars

Check that this permission is expected for this type of plugin.

HTTP Network Access

Connects to external APIs or services over the internet.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

What You'll Need

Set these up before or after installing:

Rettiwt key containing an authenticated X browser sessionRequired

Environment variable: RETTIWT_API_KEY

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-granitebps-twitter-mcp": {
      "env": {
        "RETTIWT_API_KEY": "your-rettiwt-api-key-here"
      },
      "args": [
        "-y",
        "@granitebps/twitter-mcp"
      ],
      "command": "npx"
    }
  }
}

Documentation

View on GitHub

From the project's GitHub README.

Twitter/X MCP

CI npm version npm downloads MCP Registry License: ISC

Twitter/X MCP lets an MCP client read public X posts, replies, and profiles, or search X. It uses Rettiwt by default, so you do not need an X developer plan. You can switch to the official X API if you have access.

Requirements

  • Node.js 22.21.0 or newer within the Node 22 release line. The current Rettiwt release does not support Node 23 or later.
  • A RETTIWT_API_KEY. Official X API credentials work when you select API mode.

Quick start

Once the package is published, your MCP client can run it without a clone:

npx -y @granitebps/twitter-mcp

The server selects Rettiwt when you omit TWITTER_MODE. Pass RETTIWT_API_KEY in the client configuration.

The server uses stdio. Keep stdout reserved for MCP traffic.

Run from a cloned repository

To develop the server or use a clone directly:

git clone https://github.com/granitebps/twitter-mcp.git
cd twitter-mcp
npm ci
npm run build

Point your MCP client at the compiled entry point:

node /absolute/path/to/twitter-mcp/dist/cli.js

Run npm run build after each source change. Do not use src or npm run dev as the client's stdio command. Build logs on stdout can corrupt MCP messages.

Client configuration

Each example starts with the npm package, followed by the local equivalent. Replace /absolute/path/to/twitter-mcp with your clone's path and your_key_here with your Rettiwt key. Do not commit a configuration file that contains the key.

Claude

Add the npm package to Claude Code:

claude mcp add twitter --env RETTIWT_API_KEY=your_key_here -- npx -y @granitebps/twitter-mcp

For a local build:

claude mcp add twitter --env RETTIWT_API_KEY=your_key_here -- node /absolute/path/to/twitter-mcp/dist/cli.js

Claude Code uses local scope by default. Add --scope user before twitter to make the server available across projects.

Claude Desktop reads the same server from claude_desktop_config.json. Restart the app after editing the file.

{
  "mcpServers": {
    "twitter": {
      "command": "npx",
      "args": ["-y", "@granitebps/twitter-mcp"],
      "env": {
        "RETTIWT_API_KEY": "your_key_here"
      }
    }
  }
}

For a local build, replace command and args with:

{
  "command": "node",
  "args": ["/absolute/path/to/twitter-mcp/dist/cli.js"]
}

Codex

Add the npm package to ~/.codex/config.toml, or to .codex/config.toml in a trusted project:

[mcp_servers.twitter]
command = "npx"
args = ["-y", "@granitebps/twitter-mcp"]

[mcp_servers.twitter.env]
RETTIWT_API_KEY = "your_key_here"

For a local build:

[mcp_servers.twitter]
command = "node"
args = ["/absolute/path/to/twitter-mcp/dist/cli.js"]

[mcp_servers.twitter.env]
RETTIWT_API_KEY = "your_key_here"

Restart Codex after editing the file. The CLI, IDE extension, and desktop app share this configuration on the same computer.

OpenCode

Add the npm package to opencode.json or opencode.jsonc:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "twitter": {
      "type": "local",
      "command": ["npx", "-y", "@granitebps/twitter-mcp"],
      "enabled": true,
      "environment": {
        "RETTIWT_API_KEY": "your_key_here"
      }
    }
  }
}

For a local build, replace the command array with:

{
  "command": ["node", "/absolute/path/to/twitter-mcp/dist/cli.js"]
}

Cursor

Add the npm package to .cursor/mcp.json in a project, or to ~/.cursor/mcp.json for global use:

{
  "mcpServers": {
    "twitter": {
      "command": "npx",
      "args": ["-y", "@granitebps/twitter-mcp"],
      "env": {
        "RETTIWT_API_KEY": "your_key_here"
      }
    }
  }
}

For a local build, replace command and args with:

{
  "command": "node",
  "args": ["/absolute/path/to/twitter-mcp/dist/cli.js"]
}

Providers

ModeSelectionCredentialsNotes
RettiwtDefault, or TWITTER_MODE=rettiwtRETTIWT_API_KEYFree of X API charges. Uses unofficial internal endpoints and may break or put the account at risk.
Official APITWITTER_MODE=apiBearer token or complete OAuth credentialsUses the supported X API. X controls access tiers and pricing.

Rettiwt setup

Rettiwt requires authenticated user mode in this server. Guest mode is not supported.

  1. Generate an API key using the Rettiwt authentication instructions.
  2. Store it as RETTIWT_API_KEY in the MCP client's environment.
  3. Start the server without TWITTER_MODE, or set TWITTER_MODE=rettiwt explicitly.

A Rettiwt key contains X session cookies and has the same access as the account. Treat it like a password. Do not commit it, paste it into an issue, log it, or pass it as a command-line argument. Use a key only for an account you own or have permission to access.

Rettiwt is unofficial. X's automation rules prohibit non-API website automation and warn that violations may lead to account suspension. Read the X Rules before using this mode. You accept the compliance and account risk.

Official X API setup

Use a bearer token:

TWITTER_MODE=api
TWITTER_BEARER_TOKEN=your_bearer_token

Or provide the complete OAuth set:

TWITTER_MODE=api
TWITTER_API_KEY=your_api_key
TWITTER_API_SECRET=your_api_secret
TWITTER_ACCESS_TOKEN=your_access_token
TWITTER_ACCESS_SECRET=your_access_secret

Create credentials in the X Developer Portal. X controls API access and pricing, so check the current terms before choosing this mode.

Configuration

VariableRequiredMeaning
TWITTER_MODENorettiwt by default, or api. Other values fail startup.
RETTIWT_API_KEYRettiwt modeAuthenticated Rettiwt session key.
TWITTER_BEARER_TOKENAPI mode optionOfficial API bearer token.
TWITTER_API_KEYOAuth optionOAuth application key.
TWITTER_API_SECRETOAuth optionOAuth application secret.
TWITTER_ACCESS_TOKENOAuth optionOAuth access token.
TWITTER_ACCESS_SECRETOAuth optionOAuth access secret.
TWITTER_REQUEST_TIMEOUT_MSNoRequest deadline from 1,000 to 120,000 ms. Default: 30,000.

The server rejects an incomplete OAuth configuration at startup. It reads credentials from the process environment and never returns them through get_server_info.

Tools

ToolInputResult
get_tweettweet_idOne post. Accepts a numeric ID or an x.com or twitter.com status URL.
get_tweet_repliestweet_id, optional max_resultsReplies and available page metadata.
get_user_profileusernameOne public profile. A leading @ is accepted.
search_tweetsquery, optional max_resultsMatching posts and available page metadata. Search operators depend on the provider.
get_server_infoNoneVersion, active provider, tools, limits, and capabilities.

max_results defaults to 10 and accepts 1 through 100. Successful calls return structured MCP content plus JSON text for older clients. Collection tools return the items as JSON text and put cursors and warnings in structured content.

Errors

Tool failures use stable codes:

  • INVALID_INPUT
  • AUTH_REQUIRED
  • AUTH_FAILED
  • NOT_FOUND
  • RATE_LIMITED
  • UPSTREAM_UNAVAILABLE
  • TIMEOUT
  • UNSUPPORTED_OPERATION
  • INTERNAL_ERROR

Errors name the provider and tell the client whether a retry may work. They do not include credentials or raw upstream response bodies.

Architecture

stdio CLI
  -> validated environment configuration
  -> MCP server and tool handlers
  -> TwitterProvider contract
       -> Rettiwt adapter
       -> official X API adapter

The domain schemas do not depend on either provider. Each provider adapter maps upstream data, enforces limits and deadlines, and translates errors. Importing src/index.ts does not start the server.

Development

npm ci
npm run check

npm run check checks formatting, lint, types, coverage, the production build, npm package contents, and a clean tarball installation. The default test suite uses fakes and does not need X credentials.

Useful focused commands:

npm test
npm run typecheck
npm run lint
npm run build
npm run check:package
npm run check:install
npx @modelcontextprotocol/inspector node dist/cli.js

Live Rettiwt smoke test

The live smoke test starts the compiled stdio server and calls get_tweet, get_tweet_replies, get_user_profile, and search_tweets. It derives the username and search query from the selected post.

RETTIWT_API_KEY=your_key_here \
TWITTER_LIVE_TWEET_ID=1234567890123456789 \
npm run test:live

Choose a public post whose author profile is still available. If either variable is missing, the command stops before starting the live server or making a network request. It does not run as part of npm run check or normal CI.

Release verification

The automated suite covers configuration, provider adapters, MCP calls, the compiled stdio entry point, and installation from an npm tarball. The live Rettiwt smoke test is optional and does not run in normal CI. Version 1.0.0 was prepared without live upstream verification.

Maintainers can follow the release guide for the manual npm, MCP Registry, and GitHub release process. Live tests must read credentials from repository secrets and must not run for untrusted pull requests.

Troubleshooting

Missing Rettiwt key

If startup reports RETTIWT_API_KEY is required in rettiwt mode, set the key in the MCP client configuration. Desktop clients do not automatically inherit a shell's .env file.

Invalid Rettiwt authentication

If you see Invalid authentication data or AUTH_FAILED, generate a new Rettiwt key and check that the X session still works. Never post the failing key in an issue.

Rate limit

For RATE_LIMITED, wait before retrying and reduce the request rate. Check retryAfterSeconds when the provider supplies it.

Official API 401 or 403

Confirm the credential set, app permissions, endpoint access, and current X API plan.

Node engine warning

Run Node.js 22.21.0 or a newer Node 22 release. Do not use Node 23 or later with the current Rettiwt dependency.

License

ISC

Reviews

No reviews yet

Be the first to review this server!