# twittrapi-mcp

MCP server for TwittrAPI: read public Twitter/X tweets, profiles, followers and search results. Pay as you go from $0.065 per 1,000 calls.

- **Type:** MCP server
- **Trust:** 85/100 (A), scored on the package rubric
- **Verification:** verified (build provenance)
- **Version:** 1.0.0
- **Author:** TwittrAPI
- **License:** MIT
- **npm:** twittrapi-mcp
- **Endpoints:** streamable-http https://mcp.twittrapi.com/mcp
- **Source:** https://github.com/twittrapi/twittrapi-mcp
- **Endpoint health:** reachable (last checked 2026-10-16T05:48:44.646Z, 1 sample) — uptime is not a security property and is not part of the trust score
- **Compatible clients:** claude-code, cursor, copilot, chatgpt, gemini (basis: transport)

## Trust

85/100 (A), scored on the package rubric
- Publisher verified: no
- Build provenance: verified attestation
- npm trusted publishing (OIDC): yes
- Install scripts: nothing suspicious found
- Prompt-injection scan: not run
- Obfuscation scan: not run
- Evidence age: 0 days

## Security scan

- **Status:** clean
- **Scanned:** 2026-10-16T10:38:34.535Z
- **Version scanned:** 1.1.0
- **CVEs:** none found by OSV at scan time
**Findings**
- shipped source (note) in `dist/icons.js`: Very large base64-looking blob in source (in minified file)
**Changes since the previous scan:** tool-added

## Tools

23 declared. Statically extracted from the shipped source — a floor on the surface, not a census.
- `create_tweet` — Post a tweet from the user's X account. Optional: quote another tweet (quoteUrl), add a poll (pollChoices), limit who can reply. Only call this when the user as
- `reply_to_tweet` — Reply to a tweet from the user's X account. Only call this when the user asked to post this reply.
- `list_dm_conversations` — The user's direct message inbox: conversations with participants and settings. With an X Chat passcode configured on the server, each conversation also carries 
- `send_dm` — Send an encrypted text direct message from the user's X account, to a conversation or to a user. Text only. Only call this when the user asked to send this mess
- `create_list` — Create an X list owned by the user. Returns the new list with its ID.
- `create_draft` — Save a tweet as a draft in the user's X account (not posted). The user can post it later from x.com.
- `list_drafts` — The user's saved tweet drafts, newest first.
- `get_user_by_username` — Get an X (Twitter) user's profile by handle: name, bio, follower/following counts, verification, created date, and the numeric user ID (rest_id) needed by other
- `get_user_by_id` — Get an X user's profile by numeric user ID (rest_id). Same data as get_user_by_username.
- `username_to_id` — Resolve an X handle to its numeric user ID. Cheaper and smaller than get_user_by_username when you only need the ID.
- `users_by_ids` — Get profiles for up to 500 X users in one call, by numeric user ID.
- `search_tweets` — Search X like the search box. Supports X search operators in the query, e.g. from:user, to:user, "exact phrase", lang:en, since:2025-01-01, until:2025-02-01, mi
- `get_tweet` — Get a tweet by ID with full text, author, media, engagement counts and the reply thread (conversation). Use cursor to load more replies.
- `get_tweet_retweets` — Get the users who retweeted a tweet. Paginated.
- `get_tweet_quotes` — Get tweets that quote a given tweet. Paginated.
- `get_list_details` — Get an X list's name, description, owner, and member/follower counts.
- `get_list_tweets` — Get the tweet timeline of an X list (tweets from its members), newest first. Paginated.
- `get_list_members` — Get the accounts that are members of an X list. Paginated.
- `get_community` — Get an X Community's name, description, rules, member count and admins.
- `get_community_tweets` — Get tweets posted in an X Community. Paginated.
- `search_communities` — Search X Communities by keyword. Returns community IDs for get_community and get_community_tweets. Paginated.
- `get_trends` — Get trending topics for a location by WOEID (1 = worldwide, 23424977 = United States, 23424975 = United Kingdom). Use get_trend_locations to look up other WOEID
- `get_trend_locations` — List the locations (countries and cities) that have trends, with their WOEIDs for get_trends.

## Install

**Verdict: review** — Installable, but 1 thing to check first: 1 suspicious change since the previous scanned version.
**Cautions** (coverage gaps and advisories — never blocking)
- 1 suspicious change since the previous scanned version. — Tool surface grew since v1.0.0: added create_tweet, reply_to_tweet, list_dm_conversations, send_dm, create_list, create_draft, list_drafts
**Config** (claude-code):
```json
"{\n  \"mcpServers\": {\n    \"twittrapi\": {\n      \"command\": \"npx\",\n      \"args\": [\n        \"-y\",\n        \"twittrapi-mcp\"\n      ],\n      \"env\": {\n        \"TWITTRAPI_API_KEY\": \"<YOUR_TWITTRAPI_API_KEY>\",\n        \"RAPIDAPI_KEY\": \"<YOUR_RAPIDAPI_KEY>\"\n      }\n    }\n  }\n}"
```
**Credentials it will ask for** (names only — Forge never holds a value):
- `TWITTRAPI_API_KEY` — Twittrapi API Key (optional)
- `RAPIDAPI_KEY` — Rapidapi Key (optional)
Placeholders only. Forge never holds, brokers, or transmits a credential value — replace each <YOUR_NAME> in your own config file. Do not send a value back to Forge; no Forge endpoint accepts one.
- This entry needs 2 credentials (0 required). The generated config carries placeholders, so it will fail in the editor rather than at runtime if they are left unset.

## Blast radius

Moderate blast radius — runs locally and hosted; holds an api key.
- Floor 29, ceiling 29 (tier: moderate)
- This is impact, not likelihood. A high radius is not a defect: a filesystem server is supposed to write files. It is never part of the trust score.

## Machine-readable views of this entry

- Signed JSON: https://forgeregistry.com/api/v1/packages/twittrapi-mcp
- Install plan: https://forgeregistry.com/api/v1/packages/twittrapi-mcp/install-plan
- Alternatives: https://forgeregistry.com/api/v1/alternatives/twittrapi-mcp
- HTML page: https://forgeregistry.com/registry/twittrapi-mcp
- MCP: POST https://forgeregistry.com/api/mcp → `forge_get_package` / `forge_install_plan`

## About this document

Generated by Forge (https://forgeregistry.com) — a compact rendering of the same record served, signed, at the JSON URL above. Trust and scan facts are the registry's own measurements; anything Forge did not measure is named as unmeasured rather than omitted.