Skip to content

nabuxai/nabu-x

v0.1.0

Work with your authorized X accounts, posts, mentions and supported publishing workflows.

GitHubOpen Website

Community source release (MIT). Self-host using your own credentials. No NabuxAI production accounts or hosted-service access are included.

X MCP by Nabux

Managed multi-user MCP gateway for the official X API v2.

Production target: https://x.nabuxai.com
MCP endpoint: https://x.nabuxai.com/mcp

Why this exists when X already has XMCP

X publishes an official XMCP server that generates 200+ MCP tools from X's official OpenAPI spec. XMCP is excellent for local/single-user use, but its current implementation keeps OAuth credentials in memory and is not a hosted multi-tenant token vault.

Nabux keeps the official X API surface but adds:

  • multi-user / multi-account storage
  • OAuth 2.0 Authorization Code + PKCE
  • encrypted access and refresh tokens
  • offline.access token refresh
  • owner-isolated MCP auth
  • local cache/search for retrieved posts/mentions/DM events
  • a controlled generic x_api_request for additional official X API v2 endpoints

MCP tools

  • x_accounts
  • x_profile
  • x_search_recent
  • x_my_posts
  • x_mentions
  • x_create_post
  • x_delete_post
  • x_like
  • x_unlike
  • x_follow
  • x_unfollow
  • x_dm_events
  • x_dm_conversation
  • x_send_dm
  • x_search_cached_data
  • x_api_request

x_api_request accepts only relative X API v2 paths and cannot call arbitrary hosts.

OAuth scopes

Default requested scopes:

tweet.read
tweet.write
users.read
offline.access
dm.read
dm.write
like.read
like.write
follows.read
follows.write
bookmark.read
bookmark.write
list.read
list.write
media.write

Reduce this list in production if your Meta-style least-privilege product tier does not need all actions.

OAuth callback:

https://x.nabuxai.com/x/callback

Data collection

Live official X API reads can be cached into the local database for MCP search. Recent-search results, mentions, owned posts and DM events are cacheable. This is API-backed collection, not cookie/session scraping.

X's DM lookup API currently exposes recent DM events rather than an unlimited personal-history archive, so the gateway should continuously ingest/call the official API if long-term retention is desired.

Coolify

Deploy branch feature/x-mcp-gateway with docker-compose.coolify.yml and route x.nabuxai.com to port 8000.

Required environment:

PUBLIC_BASE_URL=https://x.nabuxai.com
APP_SECRET_KEY=<32+ random chars>
X_CLIENT_ID=<X OAuth2 client id>
X_CLIENT_SECRET=<optional/required for confidential client configuration>
X_REDIRECT_URI=https://x.nabuxai.com/x/callback
INTERNAL_SERVICE_TOKEN=<random secret>

Access/refresh tokens are encrypted at rest. MCP bearer tokens are stored hashed.

Status

Production-shaped code; real E2E requires an X Developer app with OAuth 2.0 enabled, the exact callback URL registered, sufficient API credits/access for the endpoints used, and an authorized X account.