x-developer 2.5.3 → 2.5.4

package/.claude-plugin/marketplace.json

@@ -6,14 +6,14 @@
   },
   "metadata": {
     "description": "Xquik X Twitter scraper API skill for AI agents with 126 REST operations and 118 MCP operations through 2 tools. Not affiliated with X Corp.",
-    "version": "2.5.3"
+    "version": "2.5.4"
   },
   "plugins": [
     {
       "name": "x-twitter-scraper",
       "source": "./",
       "description": "126 REST operations, 118 MCP operations through 2 tools, 23 extraction types, SDKs, webhooks, exports, and confirmation-gated writes. Not affiliated with X Corp.",
-      "version": "2.5.3",
+      "version": "2.5.4",
       "author": {
         "name": "Xquik"
       },

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "x-twitter-scraper",
-  "version": "2.5.3",
+  "version": "2.5.4",
   "description": "Xquik agent skill & plugin bundle. Not affiliated with X Corp. Includes 126 REST operations, 118 MCP operations through 2 tools, SDKs, webhooks, exports & approved X workflows.",
   "author": {
     "name": "Xquik",

package/.codex-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "x-twitter-scraper",
-  "version": "2.5.3",
+  "version": "2.5.4",
   "description": "Xquik agent skill & plugin bundle. Not affiliated with X Corp. Includes 126 REST operations, 118 MCP operations through 2 tools, SDKs, webhooks, exports & approved X workflows.",
   "author": {
     "name": "Xquik",

package/README.md

@@ -25,7 +25,9 @@ The npm package `x-developer` is this agent skill and plugin bundle. The separat
 
 Includes 126 REST API operations, HMAC webhooks, 23 extraction tools, SDK pointers, and confirmation-gated writes.
 
-MCP v2.5.3 exposes 118 MCP operations through 2 tools. Add `https://xquik.com/mcp` and complete OAuth 2.1 in the client. API keys remain a fallback. Eight credential or session-bound REST operations remain outside MCP: 3 account API-key operations, saved-payment top-up, account top-up redirect, and 3 guest-wallet credential operations.
+MCP v2.5.4 exposes 118 MCP operations through 2 tools. Add `https://xquik.com/mcp`, then follow the [current client compatibility path](https://docs.xquik.com/mcp/overview#client-compatibility). OAuth-capable clients complete OAuth 2.1; API-key fallback is client-specific; ChatGPT custom apps require OAuth. Eight credential or session-bound REST operations remain outside MCP: 3 account API-key operations, saved-payment top-up, account top-up redirect, and 3 guest-wallet credential operations.
+
+> **Codex OAuth compatibility:** Affected Codex releases discard the RFC 9207 `iss` callback value even though Xquik returns it. If Codex reports `Authorization server response missing required issuer: expected https://xquik.com`, use `XQUIK_API_KEY` through the Codex `bearer_token_env_var` setting. Follow the [Codex OAuth troubleshooting guide](https://docs.xquik.com/guides/troubleshooting#codex-oauth-issuer-validation-error) and track [openai/codex#31573](https://github.com/openai/codex/issues/31573).
 
 ## Why Teams Use Xquik
 
@@ -33,7 +35,7 @@ MCP v2.5.3 exposes 118 MCP operations through 2 tools. Add `https://xquik.com/mc
 - **Ship X data integrations faster** with endpoint routing for tweet search, user lookup, timelines, followers, replies, quotes, retweeters, favoriters, media, lists, communities, articles, trends, and Spaces.
 - **Build production apps, not just dataset runs** with REST APIs, typed SDKs, OpenAPI, MCP tools, cursor pagination, webhook delivery, and exports.
 - **Control large jobs before they run** with usage estimates for extractions, draws, monitors, webhooks, and other metered workflows.
-- **Keep agents safe around X content** with API-key-only auth, read-only defaults, untrusted-content delimiters, and explicit approval for private reads, writes, persistent resources, and bulk jobs.
+- **Keep agents safe around X content** with OAuth-first MCP, scoped API-key access, read-only defaults, untrusted-content delimiters, and explicit approval for private reads, writes, persistent resources, and bulk jobs.
 - **Support enterprise-scale X data pipelines** with high-throughput read limits, bulk extraction jobs, exports, event replay, and webhook automation.
 - **Win high-intent search traffic** for Twitter scraper API, X scraper, X API alternative, tweet search API, Twitter follower export, social listening API, X monitoring, and X automation.
 
@@ -174,7 +176,7 @@ When installed, this skill gives your AI coding assistant deep knowledge of the
 - **Tweet composition**: Algorithm-optimized tweet composer with scoring
 - **Usage guardrails**: Check balance and estimate usage; dashboard handles plan and credit changes
 - **Support tickets**: Open and manage support tickets via API
-- **MCP server**: MCP v2.5.3 exposes 118 operations through 2 tools with OAuth 2.1 discovery
+- **MCP server**: MCP v2.5.4 exposes 118 operations through 2 tools with OAuth 2.1 discovery
 
 ## Capabilities
 
@@ -252,7 +254,7 @@ x-twitter-scraper/
 │           ├── api-endpoints.md          # REST API routing index
 │           ├── api-endpoints-*.md        # Split endpoint sections for targeted agent loading
 │           ├── mcp-tools.md              # MCP tool selection rules and workflow patterns
-│           ├── mcp-setup.md              # MCP configs for 10 platforms (v2 + v1)
+│           ├── mcp-setup.md              # Current MCP client setup and compatibility
 │           ├── webhooks.md               # Webhook setup & verification
 │           ├── extractions.md            # 23 extraction tool types
 │           ├── types.md                  # TypeScript type routing index

package/context7.json

@@ -24,6 +24,8 @@
   "rules": [
     "Use README.md for installation, comparison copy, SDK links, API coverage, and MCP setup.",
     "Use skills/x-twitter-scraper/SKILL.md as the primary agent operating guide.",
+    "Use https://docs.xquik.com/mcp/overview#client-compatibility as the canonical current MCP client matrix. Do not assume every client supports OAuth: Cline and Qwen Code support OAuth; affected Codex and Goose releases need environment-backed API keys; Roo Code's archived final release is API-key-only; Pi has no native MCP client.",
+    "If Codex reports Authorization server response missing required issuer: expected https://xquik.com, do not repeat OAuth. Affected Codex releases discard the RFC 9207 iss value even though Xquik returns it. Set XQUIK_API_KEY and bearer_token_env_var = \"XQUIK_API_KEY\" in Codex TOML, then use https://docs.xquik.com/guides/troubleshooting#codex-oauth-issuer-validation-error and track https://github.com/openai/codex/issues/31573.",
     "Use task-guides/*.md for task-specific workflows such as search, extraction, monitoring, webhooks, posting, and DMs.",
     "Use commands/*.md for slash-command examples.",
     "Keep implementation details public-safe; use Xquik API, read service, write service, or browser service wording."

package/openclaw.plugin.json

@@ -2,7 +2,7 @@
   "id": "x-developer",
   "name": "X Developer API",
   "description": "Xquik X Twitter scraper API skill with 126 REST operations, 118 MCP operations through 2 tools, SDKs, webhooks, exports, and gated actions. Not affiliated with X Corp.",
-  "version": "2.5.3",
+  "version": "2.5.4",
   "skills": ["./skills"],
   "providerAuthEnvVars": {
     "xquik": ["XQUIK_API_KEY"]

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "x-developer",
-  "version": "2.5.3",
+  "version": "2.5.4",
   "description": "Xquik agent skill & plugin bundle for REST, MCP, webhooks, exports & confirmation-gated X workflows. Not affiliated with X Corp.",
   "author": {
     "name": "Xquik",

package/scripts/release-guard/content-policy.mjs

@@ -20,7 +20,7 @@ export const contentChecks = [
     required: [
       "126 REST API operations",
       "118 MCP operations through 2 tools",
-      "MCP v2.5.3",
+      "MCP v2.5.4",
       "## Agent Safety And Account Boundary",
       "Plan and credit changes stay in the Xquik dashboard.",
       "The npm package `x-developer` is this agent skill and plugin bundle. The separate `x-twitter-scraper` package is the typed TypeScript SDK.",
@@ -128,6 +128,13 @@ export const contentChecks = [
       "OpenAI Agents SDK",
       "118 operations through 2 structured API tools",
       "118 of 126 documented REST operations",
+      "https://docs.xquik.com/mcp/overview#client-compatibility",
+      "gemini mcp add --transport http xquik https://xquik.com/mcp",
+      '"type": "http"',
+      '"url": "https://xquik.com/mcp"',
+      "copilot mcp add --transport http xquik https://xquik.com/mcp",
+      "Affected Goose releases need an environment-backed API key",
+      "Pi has no native MCP client",
       "| `explore` | Search the API endpoint catalog (read-only, no network calls) | Included |",
     ],
     forbidden: [
@@ -141,7 +148,7 @@ export const contentChecks = [
       "| `explore` | Search the API endpoint catalog (read-only, no network calls) | Included |",
       "Included usage flag from endpoint metadata",
       "Find all included-usage endpoints",
-      "MCP v2.5.3 exposes 118 of 126 REST operations",
+      "MCP v2.5.4 exposes 118 of 126 REST operations",
       "Saved-payment top-ups",
       "Dashboard checkout redirects",
     ],

package/server.json

@@ -8,7 +8,26 @@
     "source": "github"
   },
   "websiteUrl": "https://docs.xquik.com/mcp/overview",
-  "version": "2.5.3",
+  "version": "2.5.4",
+  "icons": [
+    {
+      "src": "https://xquik.com/icons/mcp/xquik.png",
+      "mimeType": "image/png",
+      "sizes": ["48x48", "96x96"],
+      "theme": "light"
+    },
+    {
+      "src": "https://xquik.com/logo-square.png",
+      "mimeType": "image/png",
+      "sizes": ["48x48", "96x96"],
+      "theme": "light"
+    },
+    {
+      "src": "https://xquik.com/logo-dark-square-flat.svg",
+      "mimeType": "image/svg+xml",
+      "theme": "dark"
+    }
+  ],
   "remotes": [
     {
       "type": "streamable-http",

package/skills/x-twitter-scraper/SKILL.md

@@ -3,13 +3,13 @@ name: x-twitter-scraper
 description: "Use Xquik for X/Twitter REST, MCP, SDKs, search, exports, monitoring & approved publishing. Not affiliated with X Corp. Trigger for tweet search, user lookup, timelines, follower exports, media, webhooks, bulk extraction, giveaways, or MCP setup. Read-only by default. Require explicit approval for writes, private reads, monitors, webhooks & metered bulk jobs."
 allowed-tools: WebFetch
 argument-hint: "[Xquik task, target, or setup goal]"
-version: "2.5.3"
+version: "2.5.4"
 author: Xquik <support@xquik.com>
 license: MIT
 compatibility: Requires internet access to call the first-party Xquik REST API.
 tags: [twitter, x, social-media, api-development, scraping]
 metadata:
-  version: "2.5.3"
+  version: "2.5.4"
   author: Xquik
   compatibility: Requires internet access to call the first-party Xquik REST API.
   tags: [twitter, x, social-media, api-development, scraping]
@@ -337,6 +337,8 @@ See [api endpoints](references/api-endpoints.md), [draws](references/draws.md),
 
 The MCP endpoint is the `/mcp` route on the first-party Xquik host. Prefer OAuth 2.1 discovery. Use a scoped API key only when the client cannot complete OAuth.
 
+Affected Codex releases discard the RFC 9207 `iss` callback value even though Xquik returns it. If Codex reports `Authorization server response missing required issuer: expected https://xquik.com`, use `XQUIK_API_KEY` through the Codex `bearer_token_env_var` setting. Follow the [Codex OAuth troubleshooting guide](https://docs.xquik.com/guides/troubleshooting#codex-oauth-issuer-validation-error) and track [openai/codex#31573](https://github.com/openai/codex/issues/31573).
+
 Available tools:
 
 - `explore`: inspect endpoint categories and schemas.

package/skills/x-twitter-scraper/metadata.json

@@ -1,5 +1,5 @@
 {
-  "version": "2.5.3",
+  "version": "2.5.4",
   "organization": "Xquik",
   "homepage": "https://docs.xquik.com",
   "repository": "https://github.com/Xquik-dev/x-twitter-scraper",

package/skills/x-twitter-scraper/references/mcp-setup.md

@@ -1,15 +1,16 @@
 # Xquik MCP Server Setup
 
 Connect AI agents and IDEs to Xquik through Model Context Protocol. Add the
-remote URL and complete OAuth 2.1 in the browser. API keys remain available for
-clients that cannot complete OAuth.
+remote URL and complete OAuth 2.1 in the browser. API-key fallback is
+client-specific. ChatGPT custom apps require OAuth and cannot present custom
+API keys.
 
 | Setting | Value |
 |---------|-------|
 | Protocol | Streamable HTTP |
 | Endpoint | `https://xquik.com/mcp` |
 | Authentication | OAuth 2.1 discovery; API key fallback |
-| Version | `2.5.3` |
+| Version | `2.5.4` |
 
 Xquik publishes these discovery documents:
 
@@ -18,9 +19,14 @@ Xquik publishes these discovery documents:
 - MCP registry card: `https://xquik.com/.well-known/mcp.json`
 - Agent-readable auth guide: `https://xquik.com/auth.md`
 
-OAuth clients should prefer Client ID Metadata Documents (CIMD). Dynamic Client
-Registration (DCR) remains available as a compatibility fallback. Both use
-Authorization Code with S256 PKCE and the `mcp:tools` scope.
+Xquik supports Client ID Metadata Documents (CIMD) and Dynamic Client
+Registration (DCR). Let each client use its documented registration flow. Both
+use Authorization Code with S256 PKCE and the `mcp:tools` scope.
+
+Use the [canonical client compatibility matrix](https://docs.xquik.com/mcp/overview#client-compatibility)
+for current per-client support. Cline and Qwen Code support OAuth. Affected
+Affected Goose releases need an environment-backed API key, Roo Code's archived final
+release is API-key-only, and Pi has no native MCP client.
 
 > **Security:** Start OAuth from the MCP client. Do not open Xquik login routes
 > directly. Do not proxy Xquik credentials through local bridge packages or
@@ -31,13 +37,16 @@ Authorization Code with S256 PKCE and the `mcp:tools` scope.
 
 ### Claude.ai
 
-1. Open **Customize > Connectors**.
+1. Open [Claude Connectors](https://claude.ai/settings/connectors) or **Customize > Connectors**.
 2. Select **+**, then **Add custom connector**.
 3. Enter `https://xquik.com/mcp`.
-4. Select **Connect** and approve Xquik access.
+4. Select **Add**.
+5. In a chat, select **+ > Connectors**, enable Xquik, then select **Connect** and approve access.
 
-Leave advanced client ID and client secret fields empty. Claude can use Xquik's
-CIMD or DCR registration path.
+Leave advanced client ID and client secret fields empty. Free accounts can add
+1 custom connector. On Team and Enterprise plans, an Owner or Primary Owner
+must first add the Web connector under **Organization settings > Connectors >
+Add > Custom**. The feature is currently beta.
 
 ### Claude Desktop
 
@@ -56,61 +65,91 @@ Run `/mcp`, select `xquik`, then authenticate.
 
 ### ChatGPT
 
-1. Open **Settings > Security and login**.
-2. Enable **Developer mode**.
-3. Open **Settings > Plugins** or `https://chatgpt.com/plugins`.
-4. Select **+** and create a developer-mode app.
-5. Enter `https://xquik.com/mcp` as the server URL.
-6. Complete Xquik authorization.
+1. In ChatGPT on the web, open **Settings > Apps > Advanced settings** and enable **Developer mode**.
+2. Open **Settings > Apps > Create**. Workspace administrators may instead use **Workspace settings > Apps > Create**.
+3. Enter `https://xquik.com/mcp`, choose OAuth, then select **Scan tools**.
+4. Complete Xquik authorization and select **Create**.
 
-Do not paste an API key into the app definition.
+ChatGPT cannot present a custom API key. Business and Enterprise/Edu
+workspaces support full MCP, including write tools. Pro supports read and fetch
+tools only. Custom MCP apps are web-only.
 
 ### Codex CLI
 
+Current Codex releases affected by
+[openai/codex#31573](https://github.com/openai/codex/issues/31573) must use the
+environment-backed API-key configuration in **Codex Config** below. Do not run
+`codex mcp login xquik` while that configuration is active.
+
+After your Codex release includes the upstream issuer fix, remove
+`bearer_token_env_var`, then run:
+
 ```bash
 codex mcp add xquik --url https://xquik.com/mcp
 codex mcp login xquik
 codex mcp list
 ```
 
+Affected releases discard the RFC 9207 `iss` callback value and fail before
+token exchange. If login reports
+`Authorization server response missing required issuer: expected https://xquik.com`,
+Xquik already returns the required issuer. Follow the [Xquik troubleshooting guide](https://docs.xquik.com/guides/troubleshooting#codex-oauth-issuer-validation-error).
+
 ### Codex Desktop
 
-1. Open **Settings > MCP servers**.
-2. Select **Add server**.
-3. Choose **Streamable HTTP**.
-4. Enter `https://xquik.com/mcp`.
-5. Save, select **Authenticate**, then restart.
+Current affected releases use the environment-backed API-key configuration
+below through the shared `config.toml`, then restart Codex Desktop. After your
+release includes the upstream fix, open **Settings > MCP servers**, add
+`https://xquik.com/mcp` as Streamable HTTP, select **Authenticate**, then
+restart.
 
 ### Codex Config
 
-Add to `~/.codex/config.toml`:
+Current affected releases need an environment-backed API key instead of OAuth.
+Load `XQUIK_API_KEY` from your password manager or operating-system secret
+store. Do not type the key into a shell command, save it in shell history, or
+put it in `config.toml`.
+
+Use this `~/.codex/config.toml` entry:
 
 ```toml
 [mcp_servers.xquik]
 url = "https://xquik.com/mcp"
+bearer_token_env_var = "XQUIK_API_KEY"
 ```
 
-Then run `codex mcp login xquik`.
+Restart Codex, then run `codex mcp list`. Do not run `codex mcp login xquik`
+while using the API-key configuration.
+
+After your Codex release includes the upstream fix, remove
+`bearer_token_env_var` so the entry contains only the MCP URL, then run
+`codex mcp login xquik`.
 
 ### OpenAI Agents SDK
 
 Use the OpenAI Agents SDK for programmatic access. When the runtime cannot open
-OAuth, inject an API key from its secret store:
+OAuth, pass an API key into the connection function from its secret store:
 
 ```python
+from agents import Agent, Runner
 from agents.mcp import MCPServerStreamableHttp
 
-def load_secret(name: str) -> str:
-    raise RuntimeError(f"Configure {name} in your secret store.")
-
-api_key = load_secret("XQUIK_API_KEY")
 
-async with MCPServerStreamableHttp(
-    url="https://xquik.com/mcp",
-    headers={"Authorization": f"Bearer {api_key}"},
-    params={},
-) as xquik:
-    pass
+async def run_xquik(api_key: str) -> str:
+    async with MCPServerStreamableHttp(
+        name="Xquik",
+        params={
+            "url": "https://xquik.com/mcp",
+            "headers": {"Authorization": f"Bearer {api_key}"},
+        },
+    ) as server:
+        agent = Agent(
+            name="Xquik agent",
+            instructions="Use Xquik to inspect the API catalog.",
+            mcp_servers=[server],
+        )
+        result = await Runner.run(agent, "List the endpoint categories.")
+        return str(result.final_output)
 ```
 
 ## Editors and Terminals
@@ -164,7 +203,8 @@ Add to `~/.codeium/windsurf/mcp_config.json`:
 ```
 
 Enable the server in **Windsurf Settings > Cascade > MCP Servers**, then
-complete OAuth.
+complete OAuth. Enterprise users must enable MCP manually. Team policies may
+disable MCP or restrict servers to an allowlist.
 
 ### OpenCode
 
@@ -190,44 +230,57 @@ opencode mcp list
 
 ### Gemini CLI
 
-Add to Gemini CLI settings:
+Add the remote server:
+
+```bash
+gemini mcp add --transport http xquik https://xquik.com/mcp
+```
+
+Or add it to `~/.gemini/settings.json` for user scope or
+`.gemini/settings.json` for project scope:
 
 ```json
 {
-  "mcpServers": {
-    "xquik": {
-      "httpUrl": "https://xquik.com/mcp"
-    }
-  }
+      "mcpServers": {
+        "xquik": {
+          "type": "http",
+          "url": "https://xquik.com/mcp"
+        }
+      }
 }
 ```
 
-Run `/mcp auth xquik` to complete OAuth.
+Older Gemini CLI builds also accept the legacy `httpUrl` field.
 
-## API-Key Fallback
+Run `/mcp auth xquik` to complete OAuth.
 
-Use this only when the client cannot complete OAuth and can store secrets
-securely:
+### GitHub Copilot CLI
 
-```json
-{
-  "mcpServers": {
-    "xquik": {
-      "url": "https://xquik.com/mcp",
-      "headers": {
-        "Authorization": "Bearer ${XQUIK_API_KEY}"
-      }
-    }
-  }
-}
+```bash
+copilot mcp add --transport http xquik https://xquik.com/mcp
 ```
 
+If your installed CLI does not recognize those flags, start `copilot`, run
+`/mcp add`, choose HTTP, name the server `xquik`, enter the endpoint above, and
+save. This interactive path works across Copilot CLI command variants.
+
+In an interactive Copilot CLI session, run `/mcp auth xquik`. Enterprise policy
+may block servers that are not on the organization allowlist.
+
+## API-Key Fallback
+
+Use this only when the client cannot complete OAuth and documents a secure
+secret-input or environment-variable mechanism. ChatGPT custom apps cannot use
+this fallback. Codex uses the `bearer_token_env_var` configuration above.
+Client schemas and environment syntax differ, so do not copy a generic header
+object between clients or place a literal key in a configuration file.
+
 Full account keys expose 118 operations. Active guest `paid_reads` keys expose
 33 eligible GET routes.
 
 ## MCP Server Architecture
 
-The MCP server (v2.5.3) at `https://xquik.com/mcp` exposes 118 operations through 2 structured API tools:
+The MCP server (v2.5.4) at `https://xquik.com/mcp` exposes 118 operations through 2 structured API tools:
 
 | Tool | Description | Usage |
 |------|-------------|------|
@@ -238,7 +291,7 @@ The MCP server (v2.5.3) at `https://xquik.com/mcp` exposes 118 operations throug
 operations with normalized snake_case responses. Authentication is injected, so
 tool code must never include credentials.
 
-MCP v2.5.3 exposes 118 of 126 documented REST operations. These 8 credential or
+MCP v2.5.4 exposes 118 of 126 documented REST operations. These 8 credential or
 session-bound operations remain direct REST or dashboard workflows:
 
 - API key creation, listing, and revocation

package/skills/x-twitter-scraper/references/mcp-tools.md

@@ -157,7 +157,7 @@ Use `POST /api/v1/extractions` ONLY for bulk data that simpler endpoints cannot
 
 ## REST-only operations
 
-MCP v2.5.3 exposes 118 of 126 REST operations. These 8 credential or session-bound operations remain outside MCP:
+MCP v2.5.4 exposes 118 of 126 REST operations. These 8 credential or session-bound operations remain outside MCP:
 
 - API key creation
 - API key listing

package/skills/x-twitter-scraper/skill-card.md

@@ -53,7 +53,7 @@ Mitigation: Verify unfamiliar endpoint details against `https://docs.xquik.com`
 - NVIDIA signing guidance: `https://docs.nvidia.com/skills/signing-agent-skills`
 - NVIDIA skill card guidance: `https://docs.nvidia.com/skills/skill-cards`
 - NVIDIA release checklist: `https://docs.nvidia.com/skills/release-checklist`
-- Scan evidence: `skillspector-report.md` records a static SkillSpector v2.3.7 scan from 2026-07-10 with 0 findings. Refresh it after each `SKILL.md` change.
+- Scan evidence: `skillspector-report.md` records a static SkillSpector v2.3.7 scan from 2026-07-16 with 0 findings. Refresh it after each skill directory change.
 - Signing evidence: pending `skill.oms.sig` for signed release artifacts.
 - Evaluation evidence: pending Tier-3 evaluation data and `BENCHMARK.md` for NVIDIA-Verified release.
 
@@ -69,7 +69,7 @@ Other properties: The skill performs no shell execution, no local file access, n
 
 ## Skill Version
 
-2.5.3
+2.5.4
 
 ## Ethical Considerations
 

package/skills/x-twitter-scraper/skillspector-report.md

@@ -2,7 +2,7 @@
 
 **Skill:** x-twitter-scraper
 **Source:** `skills/x-twitter-scraper`
-**Scanned:** 2026-07-10 18:54:50 UTC
+**Scanned:** 2026-07-16 13:37:35 UTC
 
 ## Static Scan
 

package/skills/xquik-social-research/SKILL.md

@@ -57,6 +57,8 @@ Use Xquik MCP when an agent should inspect live endpoint metadata first.
 
 Connect through `https://xquik.com/mcp` using the documented remote setup.
 
+If Codex reports `Authorization server response missing required issuer: expected https://xquik.com`, do not repeat OAuth. Affected Codex releases discard the RFC 9207 `iss` value even though Xquik returns it. Use `XQUIK_API_KEY` through the Codex `bearer_token_env_var` setting, then follow the [Codex OAuth troubleshooting guide](https://docs.xquik.com/guides/troubleshooting#codex-oauth-issuer-validation-error). Track the client fix in [openai/codex#31573](https://github.com/openai/codex/issues/31573).
+
 Prefer REST when writing application code, backend jobs, or data pipelines.
 
 ## Safety Gates

package/stub-server.mjs

@@ -8,7 +8,7 @@ import { createInterface } from "node:readline";
 
 const SERVER_INFO = {
   name: "xquik",
-  version: "2.5.3",
+  version: "2.5.4",
 };
 
 const CAPABILITIES = {

package/task-guides/check-mutuals.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/clean-followers.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/export-tweets-csv.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/extract-followers.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/find-bangers.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/find-influencers.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/find-viral-tweets.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/follow-unfollow.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/for-you-feed.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/going-viral.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/grow-followers.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/monitor-accounts.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/optimize-tweets.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/post-tweets.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/run-giveaway.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/search-tweets.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/send-dms.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/top-replies.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/track-competitors.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/track-hashtags.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/track-mentions.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/trending-news.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/tweet-analytics.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/tweet-ideas.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/tweet-replies.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/tweet-style.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/tweet-webhooks.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/update-x-profile.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/user-tweets.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/who-liked.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/who-quoted.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/who-retweeted.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/write-threads.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/write-tweets.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/x-articles.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/x-bookmarks.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/x-communities.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/x-lists.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/x-spaces.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env:

package/task-guides/x-trends.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.4"
   openclaw:
     requires:
       env: