Back to Browse

Tweetkit X MCP Server

Developer ToolsUse Caution4.2MCP RegistryLocal
Free

Server data from the Official MCP Registry

Post, delete & read on X (Twitter) using your own logged-in web session — no paid API.

About

Post, delete & read on X (Twitter) using your own logged-in web session — no paid API.

Security Report

4.2
Use Caution4.2High Risk

tweetkit-x is a well-intentioned tool for automating personal X (Twitter) interactions using session cookies. The codebase is clean, properly structured, and handles credentials more carefully than many similar projects. However, the server's design inherently accepts user session cookies as input, which—while necessary for functionality—creates significant account security risk if misused. The primary concerns are the lack of explicit input validation on user-provided data, potential for account compromise through cookie exfiltration by malicious actors, and the absence of rate-limiting or safety guardrails. The disclosed purpose (personal automation) is legitimate, but permissions and trust assumptions match a tool operating at user's full account permissions. Supply chain analysis found 5 known vulnerabilities in dependencies (0 critical, 1 high severity). Package verification found 1 issue.

3 files analyzed · 14 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

env_vars

Check that this permission is expected for this type of plugin.

File System Read

Reads files on your machine. Normal for tools that analyze or process local data.

File System Write

Writes or modifies files on your machine. Check that this is expected for the tool.

HTTP Network Access

Connects to external APIs or services over the internet.

clipboard

Check that this permission is expected for this type of plugin.

What You'll Need

Set these up before or after installing:

macOS Keychain service name holding your X session cookie string (must contain auth_token + ct0). Alternatively set TWEETKIT_COOKIE (the raw cookie string) or TWEETKIT_COOKIE_FILE (a file path).Optional

Environment variable: TWEETKIT_COOKIE_KEYCHAIN

Your X (Twitter) session cookie string — the Cookie header from a logged-in x.com request. Must contain auth_token and ct0.Required

Environment variable: TWEETKIT_COOKIE

How to Install

Add this to your MCP configuration file:

{
  "mcpServers": {
    "io-github-nsozturk-tweetkit-x": {
      "env": {
        "TWEETKIT_COOKIE": "your-tweetkit-cookie-here",
        "TWEETKIT_COOKIE_KEYCHAIN": "your-tweetkit-cookie-keychain-here"
      },
      "args": [
        "tweetkit-x"
      ],
      "command": "uvx"
    }
  }
}

Reviews

No reviews yet

Be the first to review this server!