@twitterapis/mcp 0.6.2 → 0.6.3

package/CHANGELOG.md

@@ -1,5 +1,20 @@
 # Changelog
 
+## 0.6.3 (2026-08-02)
+
+### Added
+
+- **Two new tools, `twitter_blocking` and `twitter_muting`**, for the accounts your authenticated account has blocked or muted. Both are cursor-paginated lists of full user objects and both read YOUR OWN lists only: there is no `user_id` argument, because X provides no way to read another account's block or mute list and an argument the API ignores would be worse than none. An empty `users` array means you block or mute nobody; it is never a silent parse failure, because the endpoint returns an error status rather than an empty page when it cannot read the list. The catalog is now **51 tools: 37 reads and 14 write actions**.
+- **Registry descriptors so the server is discoverable outside npm**: `server.json` for the official MCP Registry, `smithery.yaml` with a full `configSchema` (so hosted installers prompt for the API key by name rather than showing a bare variable), and `glama.json` for the maintainer claim. npm is a pull channel; these are where agent users browse.
+
+### Fixed
+
+- **`npm test` was failing on `main`, which blocked any release.** `twitter_users_by_ids` and `twitter_media_status` were merged on 2026-07-31 but the catalog-count assertions were left at the pre-merge 47 tools / 33 reads, so the suite reported a mismatch that had nothing to do with the tools themselves. The counts are corrected and now carry a reads-plus-writes-equals-total invariant that does not depend on them, so two cancelling errors cannot pass.
+
+### Changed
+
+- Release tooling hardened. No user-facing or API behaviour change.
+
 ## Unreleased
 
 ### Added
@@ -16,10 +31,7 @@
 
 ### Changed
 
-- The publish firewall now runs on `npm publish` itself, via `prepublishOnly`, not only on a manual `npm test`. A release that skips the test step can no longer reach the registry unchecked. Verified: with a competitor reference reintroduced into the README, `npm publish` aborts before the tarball stage.
-- The firewall no longer carries its own list of banned terms. It delegates to the maintainer's isolation registry, which is the single place those rules live, so the gate and everything else that enforces them cannot drift apart. If the registry cannot be located, the gate fails rather than passing.
-
-The two firewall changes above are release tooling only.
+- Release tooling hardened. No user-facing or API behaviour change.
 
 ## 0.6.1 (2026-07-20)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@twitterapis/mcp",
-  "version": "0.6.2",
+  "version": "0.6.3",
   "description": "Official MCP server for twitterapis.com, the Twitter/X API (search, users, followers, tweets, threads, lists, likes, bookmarks, DMs) plus write actions (post/like/retweet/follow) as native tools for Claude, Cursor, and any MCP client.",
   "repository": {
     "type": "git",
@@ -23,10 +23,11 @@
   "scripts": {
     "start": "node src/index.js",
     "check": "node --check src/index.js && node --check src/tools.js",
-    "test": "node test/tools.test.mjs && node test/smoke.mjs && node test/openapi-parity.mjs && node test/firewall.mjs",
+    "test": "node test/tools.test.mjs && node test/smoke.mjs && node test/openapi-parity.mjs && node test/firewall.mjs && node test/registry-manifests.mjs",
     "prepublishOnly": "npm test",
     "check:openapi-parity": "node test/openapi-parity.mjs",
-    "check:firewall": "node test/firewall.mjs"
+    "check:firewall": "node test/firewall.mjs",
+    "check:registry": "node test/registry-manifests.mjs"
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.0.0",

package/src/tools.js

@@ -111,6 +111,17 @@ export const TOOLS = [
       ),
     },
   },
+  {
+    name: "twitter_users_by_ids",
+    path: "/twitter/users/by_ids",
+    description:
+      "Resolve up to 100 numeric user ids into full profiles in ONE call. Same user object as twitter_user_info_by_id, returned as a list. Use this whenever you hold several ids and would otherwise loop twitter_user_info_by_id, for example hydrating the authors of a batch of tweets. Ids that no longer resolve (suspended or deleted accounts) are omitted rather than returned as nulls; compare the requested and resolved counts in the response, or diff the returned ids against the ones you sent, to see which were dropped. Sending more than 100 ids is rejected rather than truncated, so a short list always means those accounts are gone, never that the request was clipped.",
+    shape: {
+      user_ids: z.string().describe(
+        "Comma-separated numeric Twitter/X user ids, up to 100 (e.g. '44196397,745273'). Duplicates are collapsed and billed once.",
+      ),
+    },
+  },
   {
     name: "twitter_user_about",
     path: "/twitter/user/user_about",
@@ -354,6 +365,20 @@ export const TOOLS = [
       "List YOUR authenticated account's bookmarked tweets, most recent first. Requires an authenticated session behind your key. Returns each bookmarked tweet with author and metrics plus a cursor.",
     shape: { ...PAGINATION, ...INLINE },
   },
+  {
+    name: "twitter_blocking",
+    path: "/twitter/user/blocking",
+    description:
+      "List the accounts YOUR authenticated account has BLOCKED, as full user objects, cursor-paginated. Requires an authenticated session behind your key. There is no user_id argument: X provides no way to read another account's block list, so this reads yours only. An empty users array is a real answer meaning you block nobody, never a silent failure, because the endpoint returns an error status rather than an empty page when it cannot read the list.",
+    shape: { ...PAGINATION, ...INLINE },
+  },
+  {
+    name: "twitter_muting",
+    path: "/twitter/user/muting",
+    description:
+      "List the accounts YOUR authenticated account has MUTED, as full user objects, cursor-paginated. Muting hides an account's posts from your timeline without blocking it, so this is a different list from twitter_blocking and an account can appear in one and not the other. Requires an authenticated session behind your key. There is no user_id argument: X provides no way to read another account's mute list. An empty users array means you mute nobody, never a silent failure.",
+    shape: { ...PAGINATION, ...INLINE },
+  },
   {
     name: "twitter_bookmark_search",
     path: "/twitter/user/bookmark_search",
@@ -596,6 +621,18 @@ export const TOOLS = [
       ...INLINE,
     },
   },
+  {
+    name: "twitter_media_status",
+    path: "/twitter/media/status",
+    description:
+      "Check whether an uploaded media_id has finished processing on X, before you attach it to a tweet. Video, GIF and large uploads are processed ASYNCHRONOUSLY: twitter_media_upload returns a media_id immediately, but attaching it via twitter_create_tweet FAILS until X reports state 'succeeded'. Poll this until then. Returns media_id, state ('pending', 'in_progress', 'succeeded' or 'failed'), check_after_secs (how long X asks you to wait before polling again, honour it rather than tight-looping), progress_percent, and an error object when state is 'failed'. Reads through YOUR OWN registered account session, the same one that performed the upload, so register first with twitter_customer_session or twitter_user_login, or pass auth_token/ct0 for this call. This is a READ: no daily write cap applies.",
+    shape: {
+      media_id: z.string().describe(
+        "Numeric media id returned by twitter_media_upload, e.g. '1234567890123456789'.",
+      ),
+      ...INLINE,
+    },
+  },
 ];
 
 // Pure query-string builder: drops undefined/null/empty values, URL-encodes the rest.