x-developer 2.4.1 → 2.4.4

package/skills/x-twitter-scraper/references/api-endpoints.md

@@ -124,7 +124,7 @@ POST /monitors
 }
 ```
 
-Event types: `tweet.new`, `tweet.quote`, `tweet.reply`, `tweet.retweet`, `follower.gained`, `follower.lost`.
+Event types: `tweet.new`, `tweet.quote`, `tweet.reply`, `tweet.retweet`, `webhook.test`.
 
 Returns `409 monitor_already_exists` if the username is already monitored.
 
@@ -1046,6 +1046,8 @@ Returns a checkout URL for subscribing or managing the subscription. If already
 
 Manage connected X accounts for write actions. All endpoints are free (no usage cost).
 
+**Connecting or re-authenticating an X account is done by the user in the Xquik dashboard** at [xquik.com/dashboard/account](https://xquik.com/dashboard/account), not via this skill. The skill never handles X login credentials. The agent should direct the user to the dashboard when a new account needs to be connected or an existing session needs to be refreshed.
+
 ### List X Accounts
 
 ```
@@ -1054,28 +1056,6 @@ GET /x/accounts
 
 Returns all connected X accounts. Response: `{ accounts: [{ id, username, displayName, isActive, createdAt }] }`.
 
-### Connect X Account
-
-```
-POST /x/accounts
-```
-
-**Body:**
-
-| Field | Type | Required | Description |
-|-------|------|----------|-------------|
-| `username` | string | Yes | X username (`@` auto-stripped) |
-| `email` | string | Yes | Email associated with the X account |
-| `password` | string | Yes | Account password (encrypted at rest) |
-| `totp_secret` | string | No | TOTP base32 secret for 2FA accounts |
-| `proxy_country` | string | No | Preferred proxy region (e.g. `"US"`, `"TR"`) |
-
-**Response (201):** `{ id, username, isActive, createdAt }`
-
-**Errors:** `409 account_already_connected`, `422 login_failed`
-
-**Security:** This is a credential proxy endpoint. The agent transmits the user's X credentials to Xquik over HTTPS for session establishment. Credentials are encrypted at rest and never returned in responses. Before calling: (1) confirm with the user that they want to connect this account, (2) show which fields will be sent, (3) never log or retain credentials after the call.
-
 ### Get X Account
 
 ```
@@ -1090,23 +1070,7 @@ Returns `{ id, username, displayName, isActive, createdAt }`.
 DELETE /x/accounts/{id}
 ```
 
-Permanently removes the account and deletes stored credentials. Returns `{ success: true }`.
-
-### Re-authenticate X Account
-
-```
-POST /x/accounts/{id}/reauth
-```
-
-Use when a session expires or X requires re-verification.
-
-**Body:** `{ "password": "...", "totp_secret": "..." }` (password required, totp_secret optional)
-
-**Response:** `{ success: true }`
-
-**Errors:** `422 reauth_failed`
-
-**Security:** Same credential proxy rules as POST /x/accounts — confirm with user, never log or retain credentials.
+Permanently removes the account from Xquik. Returns `{ success: true }`. Before calling, confirm with the user.
 
 ---
 

package/skills/x-twitter-scraper/references/mcp-setup.md

@@ -8,7 +8,7 @@ Connect AI agents and IDEs to Xquik via the Model Context Protocol. The MCP serv
 | Endpoint | `https://xquik.com/mcp` |
 | Auth header | `x-api-key` |
 
-> **Security:** Use a scoped, revocable API key — not your primary account key. Where your platform supports environment variable interpolation (e.g., `${XQUIK_API_KEY}`), prefer that over hardcoding. Rotate keys periodically from the [dashboard](https://dashboard.xquik.com/account). Never commit API keys to version control.
+> **Security:** Use a scoped, revocable API key - not your primary account key. Where your platform supports environment variable interpolation (e.g., `${XQUIK_API_KEY}`), prefer that over hardcoding. Rotate keys periodically from the [dashboard](https://dashboard.xquik.com/account). Never commit API keys to version control.
 
 ## Claude.ai (Web)
 
@@ -16,19 +16,24 @@ Claude.ai supports MCP connectors natively via OAuth. Add Xquik as a connector f
 
 ## Claude Desktop
 
-Claude Desktop only supports stdio transport. Use `mcp-remote` as a bridge (requires [Node.js](https://nodejs.org)).
+Claude Desktop only supports stdio transport, so it needs a local stdio-to-HTTP bridge. The recommended setup avoids runtime package fetches: **install the bridge globally first, then invoke the pinned binary directly.**
 
-> **About `mcp-remote`:** [`mcp-remote`](https://www.npmjs.com/package/mcp-remote) is an open-source stdio-to-HTTP bridge maintained by the MCP ecosystem (MIT license, [source on GitHub](https://github.com/geelen/mcp-remote)). It translates Claude Desktop's stdio transport to StreamableHTTP — it does not execute arbitrary code, access your filesystem, or modify your system. The version is pinned (`@0.1.38`) to prevent supply-chain drift. If you prefer not to use `npx`, install it globally first: `npm install -g mcp-remote@0.1.38`, then replace `"command": "npx"` with `"command": "mcp-remote"` and remove the version from args.
+> **About `mcp-remote`:** [`mcp-remote`](https://www.npmjs.com/package/mcp-remote) is an open-source stdio-to-HTTP bridge (MIT license, [source on GitHub](https://github.com/geelen/mcp-remote)) maintained by the MCP ecosystem. It translates stdio to StreamableHTTP - it does not execute arbitrary code, access your filesystem, or modify your system. Always pin the version (`@0.1.38`) and audit the package on npm before installing.
 
-Add to `claude_desktop_config.json`:
+### Step 1: Install the bridge globally (one-time, audited)
+
+```bash
+npm install -g mcp-remote@0.1.38
+```
+
+### Step 2: Add to `claude_desktop_config.json`
 
 ```json
 {
   "mcpServers": {
     "xquik": {
-      "command": "npx",
+      "command": "mcp-remote",
       "args": [
-        "mcp-remote@0.1.38",
         "https://xquik.com/mcp",
         "--header",
         "x-api-key:${XQUIK_API_KEY}"
@@ -38,7 +43,9 @@ Add to `claude_desktop_config.json`:
 }
 ```
 
-> Replace `${XQUIK_API_KEY}` with your actual API key, or set the environment variable before launching Claude Desktop.
+> Set the `XQUIK_API_KEY` environment variable before launching Claude Desktop, or replace `${XQUIK_API_KEY}` with your actual API key.
+
+> **Prefer a hosted option?** Claude.ai (web) supports Xquik natively via OAuth - see the section above. No local bridge required.
 
 ## Claude Code
 

package/skills/x-twitter-scraper/references/python-examples.md

@@ -126,8 +126,6 @@ EVENT_HANDLERS = {
     "tweet.reply": lambda u, d: print(f"Reply from @{u}: {d['text']}"),
     "tweet.quote": lambda u, d: print(f"Quote from @{u}: {d['text']}"),
     "tweet.retweet": lambda u, d: print(f"Retweet by @{u}"),
-    "follower.gained": lambda u, d: print(f"@{u} gained follower: @{d['followerUsername']}"),
-    "follower.lost": lambda u, d: print(f"@{u} lost follower: @{d['followerUsername']}"),
 }
 
 @app.route("/webhook", methods=["POST"])

package/skills/x-twitter-scraper/references/types.md

@@ -81,9 +81,7 @@ type EventType =
   | "tweet.new"
   | "tweet.quote"
   | "tweet.reply"
-  | "tweet.retweet"
-  | "follower.gained"
-  | "follower.lost";
+  | "tweet.retweet";
 
 // ─── Events ──────────────────────────────────────────────
 
@@ -117,16 +115,7 @@ interface TweetEventData {
   retweetedUsername?: string;
 }
 
-// Follower events (follower.gained, follower.lost)
-interface FollowerEventData {
-  followerId: string;
-  followerUsername: string;
-  followerName: string;
-  followerFollowersCount: number;
-  followerVerified: boolean;
-}
-
-type EventData = TweetEventData | FollowerEventData;
+type EventData = TweetEventData;
 
 interface EventList {
   events: Event[];
@@ -965,18 +954,8 @@ interface ConnectedXAccount {
   createdAt: string;          // ISO 8601 timestamp
 }
 
-interface ConnectXAccountRequest {
-  username: string;           // X username (@ auto-stripped)
-  email: string;              // Email associated with X account
-  password: string;           // Password (encrypted at rest)
-  totp_secret?: string;       // TOTP base32 secret for 2FA accounts
-  proxy_country?: string;     // Preferred proxy region (e.g. "US")
-}
-
-interface ReauthXAccountRequest {
-  password: string;           // Current password
-  totp_secret?: string;       // TOTP secret if 2FA enabled
-}
+// Connecting an X account is done by the user in the Xquik dashboard,
+// not through this skill. The skill never handles X login credentials.
 
 // ─── X Write ──────────────────────────────────────────
 

package/skills/x-twitter-scraper/references/webhooks.md

@@ -60,8 +60,8 @@ app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {
     case "tweet.reply":
       console.log(`Reply from @${event.username}: ${event.data.text}`);
       break;
-    case "follower.gained":
-      console.log(`@${event.username} gained a follower`);
+    case "tweet.retweet":
+      console.log(`@${event.username} retweeted`);
       break;
   }
 

package/skills/x-twitter-scraper/references/workflows.md

@@ -131,7 +131,7 @@ const monitor = await xquikFetch("/monitors", {
   method: "POST",
   body: JSON.stringify({
     username: "elonmusk",
-    eventTypes: ["tweet.new", "tweet.reply", "tweet.quote", "follower.gained"],
+    eventTypes: ["tweet.new", "tweet.reply", "tweet.quote", "tweet.retweet"],
   }),
 });
 
@@ -149,7 +149,7 @@ const webhook = await xquikFetch("/webhooks", {
 const events = await xquikFetch("/events?monitorId=7&limit=50");
 ```
 
-Event types: `tweet.new`, `tweet.quote`, `tweet.reply`, `tweet.retweet`, `follower.gained`, `follower.lost`.
+Event types: `tweet.new`, `tweet.quote`, `tweet.reply`, `tweet.retweet`, `webhook.test`.
 
 ## Endpoint Guide