Skip to main content

Overview

OpenSRE connects to X’s official Model Context Protocol (MCP) server. During investigations the agent can call X API capabilities — tweet search, timelines, user profiles, likes, retweets, bookmarks, and posting — through MCP tools. Unlike PostHog or Sentry’s always-on hosted MCP servers, xmcp is designed to run locally: you clone the repo, supply your own X API credentials, and run the server yourself. OpenSRE connects to that local endpoint (or a tunneled URL if you need remote access, for example via ngrok).

Prerequisites

  • A running xmcp instance with your X API credentials configured on that server (X_BEARER_TOKEN, and OAuth1/OAuth2 credentials if you need write access such as posting)
  • Network access from OpenSRE to the xmcp server URL (local by default; tunnel it if OpenSRE runs elsewhere)

Setup

Option 1: Interactive CLI

You will be prompted for the xmcp server URL (defaults to http://127.0.0.1:8000/mcp) and, optionally, an auth token if the endpoint is tunneled behind an authenticating proxy.

Option 2: Environment variables

Have OpenSRE launch xmcp via stdio instead of connecting to a server you already started:

Option 3: Persistent store

Credentials

XMCP authenticates to the X API using its own environment (X_BEARER_TOKEN, OAuth credentials) at startup. For streamable-http / sse connections to an already-running server, OpenSRE does not need your X API credentials — only the server URL. Set an optional auth token only if the endpoint sits behind an authenticating tunnel or proxy. X_BEARER_TOKEN in OpenSRE’s environment is used when OpenSRE launches xmcp itself via stdio.

Investigation tools

Typical flow: call list_x_tools first, then call_x_tool with the chosen name and arguments. Pass name_filter (space- or comma-separated terms, e.g. "search tweet") to narrow a large list, and include_schema=true on a narrowed list for the full input schema.

Verify

A successful check connects to the MCP server and reports how many tools it discovered.

Troubleshooting

Security

  • Keep X API credentials on the xmcp server process, not in OpenSRE config, when using streamable-http / sse to an already-running server.
  • Prefer read-only X tokens when investigations only need search and timeline access.
  • Do not commit X_BEARER_TOKEN or OAuth secrets to source control.