June 30, 2026: @XDevelopers announced hosted MCP servers — agents can call the X API without building a custom integration. Elon Musk quoted the thread: "Try it out." The same week Cursor shipped its iOS app, X closed the loop on real-time social data inside agent workflows.
If you already use MCP in Cursor or Claude Code, this is the first first-party hosted MCP from a major platform at production scale — search posts, pull trends, manage bookmarks, even draft and publish Articles, all with your account's OAuth permissions.
Official docs: docs.x.com/tools/mcp. Full doc index for LLMs: docs.x.com/llms.txt.
TL;DR — two servers, one workflow
| Server | URL | What it does | Auth |
|---|---|---|---|
| X MCP | https://api.x.com/mcp | Live X API — search, users, bookmarks, trends, news, Articles | xurl local bridge + OAuth 2.0 PKCE |
| Docs MCP | https://docs.x.com/mcp | Search/read X API documentation | None — connect by URL |
| Client | Config location |
|---|---|
| Cursor | ~/.cursor/mcp.json or .cursor/mcp.json |
| Claude Desktop | ~/Library/Application Support/Claude/claude_desktop_config.json |
| Grok Build | ~/.grok/config.toml via grok mcp add |
| VS Code (Copilot Agent) | .vscode/mcp.json |
Browse more MCP servers: explainx.ai/mcp-servers — our searchable directory with categories from devtools to CRM.
Why hosted MCP matters
Until now, giving an agent live X data meant: register a developer app, wire REST endpoints, handle rate limits, refresh tokens, and wrap everything in a custom MCP server you maintain. That is exactly the N×M problem Model Context Protocol was designed to collapse.
X's move is different from a random npm package:
- Hosted Streamable HTTP at
api.x.com/mcp(protocol2025-06-18,serverInfo: xmcp) - Official docs MCP so agents look up endpoint schemas without hallucinating parameters
- First-class client configs for Cursor, Claude, Grok Build, and VS Code in the official guide
For teams building agentic research loops, social listening, or content pipelines — the agent can query the same real-time graph humans scroll, with structured tools instead of scraped HTML.
Architecture — why you still run xurl mcp
X's OAuth requires your own developer app. There is no dynamic client registration, and api.x.com/mcp does not advertise native MCP OAuth discovery. So X ships a local bridge:
MCP client (Cursor, Grok, …)
→ stdio JSON-RPC
xurl mcp (local bridge)
→ HTTPS + Bearer token
api.x.com/mcp
↔ OAuth2 PKCE login + auto-refresh
The bridge:
- Runs via
npx— no separate install step required - Opens your browser once on first run for OAuth login
- Caches and auto-refreshes tokens in
~/.xurl - Sends diagnostics to stderr; stdout stays clean JSON-RPC
Docs MCP skips the bridge — it is read-only documentation search over HTTPS.
X MCP capabilities
| Category | What the model can do |
|---|---|
| Posts | Fetch posts, likers, reposters, quoters, recent counts |
| Search | Full-archive post search, user search, news search |
| Users | Current user, lookup by id/handle, posts, timeline, mentions |
| Bookmarks | List, add, remove, manage bookmark folders |
| News & Trends | News stories, location trends (WOEID) |
| Articles | Create draft Articles and publish |
Writes (bookmarks, article_publish) hit stricter rate limits than reads — expect occasional 429s and backoff.
Before you begin
- Create an X app in the X Developer Portal with OAuth 2.0 enabled
- Register redirect URI
http://localhost:8080/callback(or setREDIRECT_URIenv and register that) - Copy
CLIENT_IDandCLIENT_SECRET - Node.js installed (for
npx) - Optional: install xurl natively:
brew install --cask xdevplatform/tap/xurl
# or
npm install -g @xdevplatform/xurl
Headless servers: authenticate out-of-band first:
xurl auth oauth2 --headless
Then start your MCP client — the bridge reuses the cached token.
Connect Cursor
Create ~/.cursor/mcp.json (all projects) or .cursor/mcp.json (single repo):
{
"mcpServers": {
"xapi": {
"command": "npx",
"args": ["-y", "@xdevplatform/xurl", "mcp", "https://api.x.com/mcp"],
"env": {
"CLIENT_ID": "YOUR_X_APP_CLIENT_ID",
"CLIENT_SECRET": "YOUR_X_APP_CLIENT_SECRET"
}
},
"x-docs": {
"url": "https://docs.x.com/mcp"
}
}
}
Then:
- Open Cursor → Settings → MCP
- Confirm xapi shows a green dot and tools populate
- On first use, your browser opens for OAuth — complete once
Pair with Cursor for iOS and you can monitor agent runs on your phone while the desktop session calls X tools.
Startup timeout: if the client times out waiting for browser login, set startup timeout ≥ 300 seconds in clients that support it (Grok Build documents this explicitly).
Connect Claude Desktop
Edit claude_desktop_config.json:
- macOS:
~/Library/Application Support/Claude/claude_desktop_config.json - Windows:
%APPDATA%\Claude\
{
"mcpServers": {
"xapi": {
"command": "npx",
"args": ["-y", "@xdevplatform/xurl", "mcp", "https://api.x.com/mcp"],
"env": {
"CLIENT_ID": "YOUR_X_APP_CLIENT_ID",
"CLIENT_SECRET": "YOUR_X_APP_CLIENT_SECRET"
}
},
"x-docs": {
"url": "https://docs.x.com/mcp"
}
}
}
Restart Claude Desktop. X tools appear in the tools menu. See our full Claude Code MCP servers guide for project-level configs and /mcp troubleshooting.
Connect Grok Build
One command:
grok mcp add xapi npx \
-e CLIENT_ID=YOUR_X_APP_CLIENT_ID \
-e CLIENT_SECRET=YOUR_X_APP_CLIENT_SECRET \
-- -y @xdevplatform/xurl mcp https://api.x.com/mcp
Verify:
grok mcp doctor xapi
grok mcp list
Add Docs MCP in ~/.grok/config.toml:
[mcp_servers.x-docs]
url = "https://docs.x.com/mcp"
enabled = true
Same week as Grok 4.5 private beta, xAI and X are tightening the Musk-stack agent loop — model + social graph + dev docs in one config file.
Connect VS Code (GitHub Copilot Agent mode)
Add to .vscode/mcp.json:
{
"servers": {
"xapi": {
"type": "stdio",
"command": "npx",
"args": ["-y", "@xdevplatform/xurl", "mcp", "https://api.x.com/mcp"],
"env": {
"CLIENT_ID": "YOUR_X_APP_CLIENT_ID",
"CLIENT_SECRET": "YOUR_X_APP_CLIENT_SECRET"
}
},
"x-docs": {
"url": "https://docs.x.com/mcp"
}
}
}
Docs MCP — documentation search only
Hosted at https://docs.x.com/mcp. Tools:
| Tool | Description |
|---|---|
search_x | Search X documentation — endpoints, auth guides, examples |
get_page_x | Fetch full content of a doc page by path |
Minimal config (works in any URL-capable MCP client):
{
"mcpServers": {
"x-docs": {
"url": "https://docs.x.com/mcp"
}
}
}
Use both servers together: docs MCP when the agent needs parameter shapes; xapi when it needs live data.
App-only shortcut (read-only, no bridge)
For read endpoints only, advanced users can point a client directly at the URL with a static App-only Bearer token — no auto-refresh, no user context:
# Grok example
[mcp_servers.xapi_direct]
url = "https://api.x.com/mcp"
enabled = true
[mcp_servers.xapi_direct.headers]
Authorization = "Bearer YOUR_APP_ONLY_BEARER_TOKEN"
The xurl bridge is recommended for bookmarks, Articles, and anything acting as you.
Troubleshooting
| Symptom | Fix |
|---|---|
| Client times out on startup | Raise startup timeout to 300+ s — bridge waits for browser login |
| Browser never opens | Headless box → run xurl auth oauth2 --headless first |
401 / token refresh failed | Wrong credentials or revoked refresh → re-run xurl auth oauth2 |
| Redirect/callback error | Register http://localhost:8080/callback on your app |
client-not-enrolled | Move app to Pay-per-use + Production in developer portal |
| Empty tool output | Do not run bridge with --verbose — stdout must stay JSON-RPC clean |
Test the bridge manually:
npx -y @xdevplatform/xurl mcp https://api.x.com/mcp
Grok users: grok mcp doctor xapi for end-to-end check.
Security and best practices
- Treat
~/.xurland tokens as secrets — never paste into chats or commit to git - Prefer env vars in config over hard-coded secrets; use per-project
.cursor/mcp.jsonin.gitignore - Create a dedicated X app with minimum scopes for MCP
- The bridge is local — credentials leave your machine only as TLS Bearer calls to
api.x.com - Read MCP security guide for trust boundaries across all servers
If you are new to the protocol, start with What is MCP? before adding production API access.
OpenAPI and custom agents
Machine-readable spec: https://api.x.com/2/openapi.json
curl https://api.x.com/2/openapi.json -o openapi.json
Use it for Postman import, client generation, or feeding a custom MCP server if you outgrow the hosted tools.
Where this fits in the June 2026 agent stack
Three launches in one week:
| Date | Launch | Agent angle |
|---|---|---|
| June 29 | Cursor for iOS | Mobile control plane for cloud agents |
| June 30 | X hosted MCP | Real-time social API inside any MCP client |
| June 28 | Grok 4.5 beta | Frontier model + Cursor training signal |
X MCP is the data layer — Cursor iOS is the control layer — Grok is the model layer. Together they sketch the SpaceX-adjacent agent stack without waiting for Composer 3.
Explore more MCP servers on explainx.ai
X is one server. The ecosystem has thousands. On explainx.ai/mcp-servers you can:
- Browse by category — devtools, databases, search, CRM, browser automation
- Compare profiles — descriptions, install hints, related servers
- Pair with skills — see Introducing MCP servers on explainx.ai for how MCP + agent skills fit together
Building your own? Our MCP Bootcamp and top MCP directories roundup cover discovery beyond a single vendor.
Related reading
- Cursor's Google Workspace plugins: Gmail, Drive, Calendar in the IDE
- Cloudflare Monetization Gateway — x402 MCP payments
- What is MCP? Complete architecture guide
- Claude Code MCP servers — connect any tool
- Introducing MCP servers on explainx.ai
- MCP security guide (2026)
- Build your first MCP server
- Cursor for iOS launch (June 29)
- xAI Grok Voice Agent Builder — MCP in production phone agents
- Browse MCP servers
X MCP server URLs, xurl bridge behavior, and OAuth requirements accurate as of June 30, 2026 per docs.x.com/tools/mcp. Verify current setup steps before production use.
