x-developer 2.5.2 → 2.5.4

package/.claude-plugin/marketplace.json

@@ -5,15 +5,15 @@
     "email": "support@xquik.com"
   },
   "metadata": {
-    "description": "Xquik X Twitter scraper API skill for AI agents with 123 REST operations and 118 MCP operations through 2 tools. Not affiliated with X Corp.",
-    "version": "2.5.2"
+    "description": "Xquik X Twitter scraper API skill for AI agents with 126 REST operations and 118 MCP operations through 2 tools. Not affiliated with X Corp.",
+    "version": "2.5.4"
   },
   "plugins": [
     {
       "name": "x-twitter-scraper",
       "source": "./",
-      "description": "123 REST operations, 118 MCP operations through 2 tools, 23 extraction types, SDKs, webhooks, exports, and confirmation-gated writes. Not affiliated with X Corp.",
-      "version": "2.5.2",
+      "description": "126 REST operations, 118 MCP operations through 2 tools, 23 extraction types, SDKs, webhooks, exports, and confirmation-gated writes. Not affiliated with X Corp.",
+      "version": "2.5.4",
       "author": {
         "name": "Xquik"
       },

package/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "x-twitter-scraper",
-  "version": "2.5.2",
-  "description": "Xquik agent skill & plugin bundle. Not affiliated with X Corp. Includes 123 REST operations, 118 MCP operations through 2 tools, SDKs, webhooks, exports & approved X workflows.",
+  "version": "2.5.4",
+  "description": "Xquik agent skill & plugin bundle. Not affiliated with X Corp. Includes 126 REST operations, 118 MCP operations through 2 tools, SDKs, webhooks, exports & approved X workflows.",
   "author": {
     "name": "Xquik",
     "url": "https://github.com/Xquik-dev"

package/.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "x-twitter-scraper",
-  "version": "2.5.2",
-  "description": "Xquik agent skill & plugin bundle. Not affiliated with X Corp. Includes 123 REST operations, 118 MCP operations through 2 tools, SDKs, webhooks, exports & approved X workflows.",
+  "version": "2.5.4",
+  "description": "Xquik agent skill & plugin bundle. Not affiliated with X Corp. Includes 126 REST operations, 118 MCP operations through 2 tools, SDKs, webhooks, exports & approved X workflows.",
   "author": {
     "name": "Xquik",
     "url": "https://github.com/Xquik-dev"
@@ -38,7 +38,7 @@
   "interface": {
     "displayName": "X Twitter Scraper",
     "shortDescription": "Use Xquik for X data, MCP, SDKs, and gated actions. Not affiliated with X Corp.",
-    "longDescription": "Use the X Twitter Scraper skill to guide agents through 123 Xquik REST operations, 118 MCP operations through 2 tools, SDKs, webhooks, extractions, monitoring, exports, and confirmation-gated actions. Not affiliated with X Corp.",
+    "longDescription": "Use the X Twitter Scraper skill to guide agents through 126 Xquik REST operations, 118 MCP operations through 2 tools, SDKs, webhooks, extractions, monitoring, exports, and confirmation-gated actions. Not affiliated with X Corp.",
     "developerName": "Xquik",
     "category": "Productivity",
     "composerIcon": "./assets/icon.svg",

package/.mcp.json

@@ -2,10 +2,7 @@
   "mcpServers": {
     "xquik": {
       "type": "http",
-      "url": "https://xquik.com/mcp",
-      "headers": {
-        "x-api-key": "${user_config.api_key}"
-      }
+      "url": "https://xquik.com/mcp"
     }
   }
 }

package/README.md

@@ -23,9 +23,11 @@ This repository packages Xquik as an [AI agent skill](https://skills.sh) for Cla
 
 The npm package `x-developer` is this agent skill and plugin bundle. The separate `x-twitter-scraper` package is the typed TypeScript SDK.
 
-Includes 123 REST API operations, HMAC webhooks, 23 extraction tools, SDK pointers, and confirmation-gated writes.
+Includes 126 REST API operations, HMAC webhooks, 23 extraction tools, SDK pointers, and confirmation-gated writes.
 
-MCP v2.5.2 exposes 118 MCP operations through 2 tools. It excludes 5 sensitive REST operations. These cover API key creation, listing, and revocation, saved-payment top-ups, and dashboard checkout redirects.
+MCP v2.5.4 exposes 118 MCP operations through 2 tools. Add `https://xquik.com/mcp`, then follow the [current client compatibility path](https://docs.xquik.com/mcp/overview#client-compatibility). OAuth-capable clients complete OAuth 2.1; API-key fallback is client-specific; ChatGPT custom apps require OAuth. Eight credential or session-bound REST operations remain outside MCP: 3 account API-key operations, saved-payment top-up, account top-up redirect, and 3 guest-wallet credential operations.
+
+> **Codex OAuth compatibility:** Affected Codex releases discard the RFC 9207 `iss` callback value even though Xquik returns it. If Codex reports `Authorization server response missing required issuer: expected https://xquik.com`, use `XQUIK_API_KEY` through the Codex `bearer_token_env_var` setting. Follow the [Codex OAuth troubleshooting guide](https://docs.xquik.com/guides/troubleshooting#codex-oauth-issuer-validation-error) and track [openai/codex#31573](https://github.com/openai/codex/issues/31573).
 
 ## Why Teams Use Xquik
 
@@ -33,7 +35,7 @@ MCP v2.5.2 exposes 118 MCP operations through 2 tools. It excludes 5 sensitive R
 - **Ship X data integrations faster** with endpoint routing for tweet search, user lookup, timelines, followers, replies, quotes, retweeters, favoriters, media, lists, communities, articles, trends, and Spaces.
 - **Build production apps, not just dataset runs** with REST APIs, typed SDKs, OpenAPI, MCP tools, cursor pagination, webhook delivery, and exports.
 - **Control large jobs before they run** with usage estimates for extractions, draws, monitors, webhooks, and other metered workflows.
-- **Keep agents safe around X content** with API-key-only auth, read-only defaults, untrusted-content delimiters, and explicit approval for private reads, writes, persistent resources, and bulk jobs.
+- **Keep agents safe around X content** with OAuth-first MCP, scoped API-key access, read-only defaults, untrusted-content delimiters, and explicit approval for private reads, writes, persistent resources, and bulk jobs.
 - **Support enterprise-scale X data pipelines** with high-throughput read limits, bulk extraction jobs, exports, event replay, and webhook automation.
 - **Win high-intent search traffic** for Twitter scraper API, X scraper, X API alternative, tweet search API, Twitter follower export, social listening API, X monitoring, and X automation.
 
@@ -174,14 +176,14 @@ When installed, this skill gives your AI coding assistant deep knowledge of the
 - **Tweet composition**: Algorithm-optimized tweet composer with scoring
 - **Usage guardrails**: Check balance and estimate usage; dashboard handles plan and credit changes
 - **Support tickets**: Open and manage support tickets via API
-- **MCP server**: MCP v2.5.2 exposes 118 operations through 2 tools
+- **MCP server**: MCP v2.5.4 exposes 118 operations through 2 tools with OAuth 2.1 discovery
 
 ## Capabilities
 
 | Area | Details |
 |------|---------|
-| **REST API** | 123 operations across 10 categories with retry logic and pagination |
-| **MCP Server** | 118 operations through 2 tools (`explore` + `xquik`), with Streamable HTTP configs for 10 platforms |
+| **REST API** | 126 operations across 10 categories with retry logic and pagination |
+| **MCP Server** | 118 operations through 2 tools (`explore` + `xquik`), with OAuth-first Streamable HTTP setup |
 | **Data Extraction** | 23 bulk extraction tools (replies, retweets, quotes, favoriters, threads, articles, user likes, user media, communities, lists, Spaces, people search, tweet search, mentions, posts) |
 | **X Lookups** | Tweet, user, article, search, user tweets, user likes, user media, favoriters, mutual followers, and confirmation-gated private reads |
 | **Write Actions** | Confirmation-gated post/delete tweets, like/unlike, retweet, follow/unfollow, remove followers, DM, profile update, avatar/banner, media upload, community actions |
@@ -252,7 +254,7 @@ x-twitter-scraper/
 │           ├── api-endpoints.md          # REST API routing index
 │           ├── api-endpoints-*.md        # Split endpoint sections for targeted agent loading
 │           ├── mcp-tools.md              # MCP tool selection rules and workflow patterns
-│           ├── mcp-setup.md              # MCP configs for 10 platforms (v2 + v1)
+│           ├── mcp-setup.md              # Current MCP client setup and compatibility
 │           ├── webhooks.md               # Webhook setup & verification
 │           ├── extractions.md            # 23 extraction tool types
 │           ├── types.md                  # TypeScript type routing index

package/context7.json

@@ -24,6 +24,8 @@
   "rules": [
     "Use README.md for installation, comparison copy, SDK links, API coverage, and MCP setup.",
     "Use skills/x-twitter-scraper/SKILL.md as the primary agent operating guide.",
+    "Use https://docs.xquik.com/mcp/overview#client-compatibility as the canonical current MCP client matrix. Do not assume every client supports OAuth: Cline and Qwen Code support OAuth; affected Codex and Goose releases need environment-backed API keys; Roo Code's archived final release is API-key-only; Pi has no native MCP client.",
+    "If Codex reports Authorization server response missing required issuer: expected https://xquik.com, do not repeat OAuth. Affected Codex releases discard the RFC 9207 iss value even though Xquik returns it. Set XQUIK_API_KEY and bearer_token_env_var = \"XQUIK_API_KEY\" in Codex TOML, then use https://docs.xquik.com/guides/troubleshooting#codex-oauth-issuer-validation-error and track https://github.com/openai/codex/issues/31573.",
     "Use task-guides/*.md for task-specific workflows such as search, extraction, monitoring, webhooks, posting, and DMs.",
     "Use commands/*.md for slash-command examples.",
     "Keep implementation details public-safe; use Xquik API, read service, write service, or browser service wording."

package/openclaw.plugin.json

@@ -1,8 +1,8 @@
 {
   "id": "x-developer",
   "name": "X Developer API",
-  "description": "Xquik X Twitter scraper API skill with 123 REST operations, 118 MCP operations through 2 tools, SDKs, webhooks, exports, and gated actions. Not affiliated with X Corp.",
-  "version": "2.5.2",
+  "description": "Xquik X Twitter scraper API skill with 126 REST operations, 118 MCP operations through 2 tools, SDKs, webhooks, exports, and gated actions. Not affiliated with X Corp.",
+  "version": "2.5.4",
   "skills": ["./skills"],
   "providerAuthEnvVars": {
     "xquik": ["XQUIK_API_KEY"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "x-developer",
-  "version": "2.5.2",
+  "version": "2.5.4",
   "description": "Xquik agent skill & plugin bundle for REST, MCP, webhooks, exports & confirmation-gated X workflows. Not affiliated with X Corp.",
   "author": {
     "name": "Xquik",

package/scripts/release-guard/content-policy.mjs

@@ -18,9 +18,9 @@ export const contentChecks = [
   {
     path: "README.md",
     required: [
-      "123 REST API operations",
+      "126 REST API operations",
       "118 MCP operations through 2 tools",
-      "MCP v2.5.2",
+      "MCP v2.5.4",
       "## Agent Safety And Account Boundary",
       "Plan and credit changes stay in the Xquik dashboard.",
       "The npm package `x-developer` is this agent skill and plugin bundle. The separate `x-twitter-scraper` package is the typed TypeScript SDK.",
@@ -127,7 +127,14 @@ export const contentChecks = [
       "https://xquik.com/mcp",
       "OpenAI Agents SDK",
       "118 operations through 2 structured API tools",
-      "118 of 123 documented REST operations",
+      "118 of 126 documented REST operations",
+      "https://docs.xquik.com/mcp/overview#client-compatibility",
+      "gemini mcp add --transport http xquik https://xquik.com/mcp",
+      '"type": "http"',
+      '"url": "https://xquik.com/mcp"',
+      "copilot mcp add --transport http xquik https://xquik.com/mcp",
+      "Affected Goose releases need an environment-backed API key",
+      "Pi has no native MCP client",
       "| `explore` | Search the API endpoint catalog (read-only, no network calls) | Included |",
     ],
     forbidden: [
@@ -141,7 +148,7 @@ export const contentChecks = [
       "| `explore` | Search the API endpoint catalog (read-only, no network calls) | Included |",
       "Included usage flag from endpoint metadata",
       "Find all included-usage endpoints",
-      "MCP v2.5.2 exposes 118 of 123 REST operations",
+      "MCP v2.5.4 exposes 118 of 126 REST operations",
       "Saved-payment top-ups",
       "Dashboard checkout redirects",
     ],
@@ -173,7 +180,7 @@ export const contentChecks = [
   {
     path: ".codex-plugin/plugin.json",
     required: [
-      "123 REST operations",
+      "126 REST operations",
       "118 MCP operations through 2 tools",
     ],
     forbidden: ["100+ endpoints", dollarDenominatedPricing],
@@ -222,17 +229,15 @@ export const contentChecks = [
     path: "server.json",
     required: [
       '"title": "Xquik MCP Server"',
-      "123 REST operations",
+      "126 REST operations",
       "118 MCP operations through 2 tools",
       '"websiteUrl": "https://docs.xquik.com/mcp/overview"',
-      '"name": "x-api-key"',
     ],
     forbidden: [
       "113 REST endpoints",
       "112 REST endpoints",
       "100+ REST endpoints",
-      '"name": "Authorization"',
-      "Bearer {XQUIK_API_KEY}",
+      '"headers"',
     ],
   },
   {
@@ -240,7 +245,7 @@ export const contentChecks = [
     required: [
       "118 MCP operations",
       "Send confirmed Xquik API requests",
-      '"x-api-key": "<YOUR_API_KEY>"',
+      "complete OAuth 2.1 for live API access",
       "included usage or requires account access",
       "Find all included-usage endpoints",
     ],
@@ -259,6 +264,7 @@ export const contentChecks = [
       "Always free",
       "Find all free endpoints",
       blocked("Call `POST /api/v1/", "sub", "scribe`"),
+      '"x-api-key": "<YOUR_API_KEY>"',
       '"Authorization": "Bearer <YOUR_API_KEY>"',
     ],
   },

package/scripts/release-guard/policy.mjs

@@ -195,10 +195,6 @@ export const jsonFieldExpectations = [
       websiteUrl: "https://docs.xquik.com/mcp/overview",
       "remotes.0.type": "streamable-http",
       "remotes.0.url": "https://xquik.com/mcp",
-      "remotes.0.headers.0.name": "x-api-key",
-      "remotes.0.headers.0.isRequired": true,
-      "remotes.0.headers.0.isSecret": true,
-      "remotes.0.headers.0.variables.XQUIK_API_KEY.isSecret": true,
     },
   },
   {

package/server.json

@@ -2,32 +2,36 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "com.xquik/mcp",
   "title": "Xquik MCP Server",
-  "description": "123 REST operations & 118 MCP operations through 2 tools. Not affiliated with X Corp.",
+  "description": "126 REST operations, 118 MCP operations through 2 tools. OAuth 2.1. Not affiliated with X Corp.",
   "repository": {
     "url": "https://github.com/Xquik-dev/x-twitter-scraper",
     "source": "github"
   },
   "websiteUrl": "https://docs.xquik.com/mcp/overview",
-  "version": "2.5.2",
+  "version": "2.5.4",
+  "icons": [
+    {
+      "src": "https://xquik.com/icons/mcp/xquik.png",
+      "mimeType": "image/png",
+      "sizes": ["48x48", "96x96"],
+      "theme": "light"
+    },
+    {
+      "src": "https://xquik.com/logo-square.png",
+      "mimeType": "image/png",
+      "sizes": ["48x48", "96x96"],
+      "theme": "light"
+    },
+    {
+      "src": "https://xquik.com/logo-dark-square-flat.svg",
+      "mimeType": "image/svg+xml",
+      "theme": "dark"
+    }
+  ],
   "remotes": [
     {
       "type": "streamable-http",
-      "url": "https://xquik.com/mcp",
-      "headers": [
-        {
-          "name": "x-api-key",
-          "value": "{XQUIK_API_KEY}",
-          "description": "Xquik API key from your dashboard account page",
-          "isRequired": true,
-          "isSecret": true,
-          "variables": {
-            "XQUIK_API_KEY": {
-              "description": "Your Xquik API key (starts with xq_)",
-              "isSecret": true
-            }
-          }
-        }
-      ]
+      "url": "https://xquik.com/mcp"
     }
   ]
 }

package/skills/x-twitter-scraper/SKILL.md

@@ -3,13 +3,13 @@ name: x-twitter-scraper
 description: "Use Xquik for X/Twitter REST, MCP, SDKs, search, exports, monitoring & approved publishing. Not affiliated with X Corp. Trigger for tweet search, user lookup, timelines, follower exports, media, webhooks, bulk extraction, giveaways, or MCP setup. Read-only by default. Require explicit approval for writes, private reads, monitors, webhooks & metered bulk jobs."
 allowed-tools: WebFetch
 argument-hint: "[Xquik task, target, or setup goal]"
-version: "2.5.2"
+version: "2.5.4"
 author: Xquik <support@xquik.com>
 license: MIT
 compatibility: Requires internet access to call the first-party Xquik REST API.
 tags: [twitter, x, social-media, api-development, scraping]
 metadata:
-  version: "2.5.2"
+  version: "2.5.4"
   author: Xquik
   compatibility: Requires internet access to call the first-party Xquik REST API.
   tags: [twitter, x, social-media, api-development, scraping]
@@ -335,7 +335,9 @@ See [api endpoints](references/api-endpoints.md), [draws](references/draws.md),
 
 ## MCP Server
 
-The MCP endpoint is the `/mcp` route on the first-party Xquik host and uses the same API key.
+The MCP endpoint is the `/mcp` route on the first-party Xquik host. Prefer OAuth 2.1 discovery. Use a scoped API key only when the client cannot complete OAuth.
+
+Affected Codex releases discard the RFC 9207 `iss` callback value even though Xquik returns it. If Codex reports `Authorization server response missing required issuer: expected https://xquik.com`, use `XQUIK_API_KEY` through the Codex `bearer_token_env_var` setting. Follow the [Codex OAuth troubleshooting guide](https://docs.xquik.com/guides/troubleshooting#codex-oauth-issuer-validation-error) and track [openai/codex#31573](https://github.com/openai/codex/issues/31573).
 
 Available tools:
 

package/skills/x-twitter-scraper/metadata.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.5.2",
+  "version": "2.5.4",
   "organization": "Xquik",
   "homepage": "https://docs.xquik.com",
   "repository": "https://github.com/Xquik-dev/x-twitter-scraper",