Overview
OpenSRE connects to X’s official Model Context Protocol (MCP) server. During investigations the agent can call X API capabilities — tweet search, timelines, user profiles, likes, retweets, bookmarks, and posting — through MCP tools. Unlike PostHog or Sentry’s always-on hosted MCP servers, xmcp is designed to run locally: you clone the repo, supply your own X API credentials, and run the server yourself. OpenSRE connects to that local endpoint (or a tunneled URL if you need remote access, for example via ngrok).Prerequisites
- A running xmcp instance with your X API credentials configured on that server (
X_BEARER_TOKEN, and OAuth1/OAuth2 credentials if you need write access such as posting) - Network access from OpenSRE to the xmcp server URL (local by default; tunnel it if OpenSRE runs elsewhere)
Setup
Option 1: Interactive CLI
http://127.0.0.1:8000/mcp) and, optionally, an auth token if the endpoint is tunneled behind an authenticating proxy.
Option 2: Environment variables
Have OpenSRE launch xmcp via
stdio instead of connecting to a server you already started:
Option 3: Persistent store
Credentials
XMCP authenticates to the X API using its own environment (X_BEARER_TOKEN, OAuth credentials) at startup. For streamable-http / sse connections to an already-running server, OpenSRE does not need your X API credentials — only the server URL. Set an optional auth token only if the endpoint sits behind an authenticating tunnel or proxy. X_BEARER_TOKEN in OpenSRE’s environment is used when OpenSRE launches xmcp itself via stdio.
Investigation tools
Typical flow: call
list_x_tools first, then call_x_tool with the chosen name and arguments. Pass name_filter (space- or comma-separated terms, e.g. "search tweet") to narrow a large list, and include_schema=true on a narrowed list for the full input schema.
Verify
Troubleshooting
Security
- Keep X API credentials on the xmcp server process, not in OpenSRE config, when using
streamable-http/sseto an already-running server. - Prefer read-only X tokens when investigations only need search and timeline access.
- Do not commit
X_BEARER_TOKENor OAuth secrets to source control.