X Just Shipped an MCP Server. It Exposes 131 Tools With Zero Access Control.

X (formerly Twitter) just released xmcp, an official MCP server that wraps the entire X API v2. It is the largest social media platform to ship a first-party MCP integration, and it exposes 131 tools to any connected agent.

That includes createPosts, sendChatMessage, followUser, repostPost, deletePosts, and createDirectMessagesByParticipantId. Every one of those tools is available to every connected agent, with no permissions model, no scoping, and no rate limiting at the MCP layer.

What the X MCP server exposes

The server dynamically generates tools from X's OpenAPI specification at startup. After filtering out streaming and webhook endpoints, agents get access to 131 operations across every major surface of the platform:

Category