x-developer 2.5.3 → 2.5.5

package/skills/x-twitter-scraper/references/mcp-setup.md

@@ -1,26 +1,32 @@
 # Xquik MCP Server Setup
 
 Connect AI agents and IDEs to Xquik through Model Context Protocol. Add the
-remote URL and complete OAuth 2.1 in the browser. API keys remain available for
-clients that cannot complete OAuth.
+remote URL and complete OAuth 2.1 in the browser. API-key fallback is
+client-specific. ChatGPT custom apps require OAuth and cannot present custom
+API keys.
 
 | Setting | Value |
 |---------|-------|
 | Protocol | Streamable HTTP |
 | Endpoint | `https://xquik.com/mcp` |
 | Authentication | OAuth 2.1 discovery; API key fallback |
-| Version | `2.5.3` |
+| Version | `2.5.5` |
 
 Xquik publishes these discovery documents:
 
 - Protected resource metadata: `https://xquik.com/.well-known/oauth-protected-resource/mcp`
 - Authorization server metadata: `https://xquik.com/.well-known/oauth-authorization-server`
-- MCP registry card: `https://xquik.com/.well-known/mcp.json`
+- MCP registry card: `https://xquik.com/.well-known/mcp/server-card.json`
 - Agent-readable auth guide: `https://xquik.com/auth.md`
 
-OAuth clients should prefer Client ID Metadata Documents (CIMD). Dynamic Client
-Registration (DCR) remains available as a compatibility fallback. Both use
-Authorization Code with S256 PKCE and the `mcp:tools` scope.
+Xquik supports Client ID Metadata Documents (CIMD) and Dynamic Client
+Registration (DCR). Let each client use its documented registration flow. Both
+use Authorization Code with S256 PKCE and the `mcp:tools` scope.
+
+Use the [canonical client compatibility matrix](https://docs.xquik.com/mcp/overview#client-compatibility)
+for current per-client support. Cline and Qwen Code support OAuth.
+Affected Goose releases need an environment-backed API key. Roo Code's archived final
+release is API-key-only. Pi has no native MCP client.
 
 > **Security:** Start OAuth from the MCP client. Do not open Xquik login routes
 > directly. Do not proxy Xquik credentials through local bridge packages or
@@ -31,13 +37,16 @@ Authorization Code with S256 PKCE and the `mcp:tools` scope.
 
 ### Claude.ai
 
-1. Open **Customize > Connectors**.
+1. Open [Claude Connectors](https://claude.ai/settings/connectors) or **Customize > Connectors**.
 2. Select **+**, then **Add custom connector**.
 3. Enter `https://xquik.com/mcp`.
-4. Select **Connect** and approve Xquik access.
+4. Select **Add**.
+5. In a chat, select **+ > Connectors**, enable Xquik, then select **Connect** and approve access.
 
-Leave advanced client ID and client secret fields empty. Claude can use Xquik's
-CIMD or DCR registration path.
+Leave advanced client ID and client secret fields empty. Free accounts can add
+1 custom connector. On Team and Enterprise plans, an Owner or Primary Owner
+must first add the Web connector under **Organization settings > Connectors >
+Add > Custom**. The feature is currently beta.
 
 ### Claude Desktop
 
@@ -56,61 +65,91 @@ Run `/mcp`, select `xquik`, then authenticate.
 
 ### ChatGPT
 
-1. Open **Settings > Security and login**.
-2. Enable **Developer mode**.
-3. Open **Settings > Plugins** or `https://chatgpt.com/plugins`.
-4. Select **+** and create a developer-mode app.
-5. Enter `https://xquik.com/mcp` as the server URL.
-6. Complete Xquik authorization.
+1. In ChatGPT on the web, open **Settings > Apps > Advanced settings** and enable **Developer mode**.
+2. Open **Settings > Apps > Create**. Workspace administrators may instead use **Workspace settings > Apps > Create**.
+3. Enter `https://xquik.com/mcp`, choose OAuth, then select **Scan tools**.
+4. Complete Xquik authorization and select **Create**.
 
-Do not paste an API key into the app definition.
+ChatGPT cannot present a custom API key. Business and Enterprise/Edu
+workspaces support full MCP, including write tools. Pro supports read and fetch
+tools only. Custom MCP apps are web-only.
 
 ### Codex CLI
 
+Current Codex releases affected by
+[openai/codex#31573](https://github.com/openai/codex/issues/31573) must use the
+environment-backed API-key configuration in **Codex Config** below. Do not run
+`codex mcp login xquik` while that configuration is active.
+
+After your Codex release includes the upstream issuer fix, remove
+`bearer_token_env_var`, then run:
+
 ```bash
 codex mcp add xquik --url https://xquik.com/mcp
 codex mcp login xquik
 codex mcp list
 ```
 
+Affected releases discard the RFC 9207 `iss` callback value and fail before
+token exchange. If login reports
+`Authorization server response missing required issuer: expected https://xquik.com`,
+Xquik already returns the required issuer. Follow the [Xquik troubleshooting guide](https://docs.xquik.com/guides/troubleshooting#codex-oauth-issuer-validation-error).
+
 ### Codex Desktop
 
-1. Open **Settings > MCP servers**.
-2. Select **Add server**.
-3. Choose **Streamable HTTP**.
-4. Enter `https://xquik.com/mcp`.
-5. Save, select **Authenticate**, then restart.
+Current affected releases use the environment-backed API-key configuration
+below through the shared `config.toml`, then restart Codex Desktop. After your
+release includes the upstream fix, open **Settings > MCP servers**, add
+`https://xquik.com/mcp` as Streamable HTTP, select **Authenticate**, then
+restart.
 
 ### Codex Config
 
-Add to `~/.codex/config.toml`:
+Current affected releases need an environment-backed API key instead of OAuth.
+Load `XQUIK_API_KEY` from your password manager or operating-system secret
+store. Do not type the key into a shell command, save it in shell history, or
+put it in `config.toml`.
+
+Use this `~/.codex/config.toml` entry:
 
 ```toml
 [mcp_servers.xquik]
 url = "https://xquik.com/mcp"
+bearer_token_env_var = "XQUIK_API_KEY"
 ```
 
-Then run `codex mcp login xquik`.
+Restart Codex, then run `codex mcp list`. Do not run `codex mcp login xquik`
+while using the API-key configuration.
+
+After your Codex release includes the upstream fix, remove
+`bearer_token_env_var` so the entry contains only the MCP URL, then run
+`codex mcp login xquik`.
 
 ### OpenAI Agents SDK
 
 Use the OpenAI Agents SDK for programmatic access. When the runtime cannot open
-OAuth, inject an API key from its secret store:
+OAuth, pass an API key into the connection function from its secret store:
 
 ```python
+from agents import Agent, Runner
 from agents.mcp import MCPServerStreamableHttp
 
-def load_secret(name: str) -> str:
-    raise RuntimeError(f"Configure {name} in your secret store.")
-
-api_key = load_secret("XQUIK_API_KEY")
 
-async with MCPServerStreamableHttp(
-    url="https://xquik.com/mcp",
-    headers={"Authorization": f"Bearer {api_key}"},
-    params={},
-) as xquik:
-    pass
+async def run_xquik(api_key: str) -> str:
+    async with MCPServerStreamableHttp(
+        name="Xquik",
+        params={
+            "url": "https://xquik.com/mcp",
+            "headers": {"Authorization": f"Bearer {api_key}"},
+        },
+    ) as server:
+        agent = Agent(
+            name="Xquik agent",
+            instructions="Use Xquik to inspect the API catalog.",
+            mcp_servers=[server],
+        )
+        result = await Runner.run(agent, "List the endpoint categories.")
+        return str(result.final_output)
 ```
 
 ## Editors and Terminals
@@ -164,7 +203,8 @@ Add to `~/.codeium/windsurf/mcp_config.json`:
 ```
 
 Enable the server in **Windsurf Settings > Cascade > MCP Servers**, then
-complete OAuth.
+complete OAuth. Enterprise users must enable MCP manually. Team policies may
+disable MCP or restrict servers to an allowlist.
 
 ### OpenCode
 
@@ -190,44 +230,57 @@ opencode mcp list
 
 ### Gemini CLI
 
-Add to Gemini CLI settings:
+Add the remote server:
+
+```bash
+gemini mcp add --transport http xquik https://xquik.com/mcp
+```
+
+Or add it to `~/.gemini/settings.json` for user scope or
+`.gemini/settings.json` for project scope:
 
 ```json
 {
-  "mcpServers": {
-    "xquik": {
-      "httpUrl": "https://xquik.com/mcp"
-    }
-  }
+      "mcpServers": {
+        "xquik": {
+          "type": "http",
+          "url": "https://xquik.com/mcp"
+        }
+      }
 }
 ```
 
-Run `/mcp auth xquik` to complete OAuth.
+Older Gemini CLI builds also accept the legacy `httpUrl` field.
 
-## API-Key Fallback
+Run `/mcp auth xquik` to complete OAuth.
 
-Use this only when the client cannot complete OAuth and can store secrets
-securely:
+### GitHub Copilot CLI
 
-```json
-{
-  "mcpServers": {
-    "xquik": {
-      "url": "https://xquik.com/mcp",
-      "headers": {
-        "Authorization": "Bearer ${XQUIK_API_KEY}"
-      }
-    }
-  }
-}
+```bash
+copilot mcp add --transport http xquik https://xquik.com/mcp
 ```
 
-Full account keys expose 118 operations. Active guest `paid_reads` keys expose
-33 eligible GET routes.
+If your installed CLI does not recognize those flags, start `copilot`, run
+`/mcp add`, choose HTTP, name the server `xquik`, enter the endpoint above, and
+save. This interactive path works across Copilot CLI command variants.
+
+In an interactive Copilot CLI session, run `/mcp auth xquik`. Enterprise policy
+may block servers that are not on the organization allowlist.
+
+## API-Key Fallback
+
+Use this only when the client cannot complete OAuth and documents a secure
+secret-input or environment-variable mechanism. ChatGPT custom apps cannot use
+this fallback. Codex uses the `bearer_token_env_var` configuration above.
+Client schemas and environment syntax differ, so do not copy a generic header
+object between clients or place a literal key in a configuration file.
+
+Full account keys expose 119 catalog routes. Of these, 118 support JSON or text.
+Active guest `paid_reads` keys expose 33 eligible GET routes.
 
 ## MCP Server Architecture
 
-The MCP server (v2.5.3) at `https://xquik.com/mcp` exposes 118 operations through 2 structured API tools:
+The MCP server (v2.5.5) exposes 119 catalog routes through 2 structured API tools. Of these, 118 support JSON or text. Binary support downloads use REST.
 
 | Tool | Description | Usage |
 |------|-------------|------|
@@ -238,8 +291,8 @@ The MCP server (v2.5.3) at `https://xquik.com/mcp` exposes 118 operations throug
 operations with normalized snake_case responses. Authentication is injected, so
 tool code must never include credentials.
 
-MCP v2.5.3 exposes 118 of 126 documented REST operations. These 8 credential or
-session-bound operations remain direct REST or dashboard workflows:
+MCP v2.5.5 catalogs 119 of 127 documented REST operations. These 8 credential
+or session operations remain direct REST or dashboard workflows:
 
 - API key creation, listing, and revocation
 - Saved-payment top-up

package/skills/x-twitter-scraper/references/mcp-tools.md

@@ -157,7 +157,7 @@ Use `POST /api/v1/extractions` ONLY for bulk data that simpler endpoints cannot
 
 ## REST-only operations
 
-MCP v2.5.3 exposes 118 of 126 REST operations. These 8 credential or session-bound operations remain outside MCP:
+MCP v2.5.5 catalogs 119 of 127 REST operations. Of these, 118 support JSON or text. Binary support downloads use REST. These 8 credential or session operations remain outside MCP:
 
 - API key creation
 - API key listing

package/skills/x-twitter-scraper/skill-card.md

@@ -53,7 +53,7 @@ Mitigation: Verify unfamiliar endpoint details against `https://docs.xquik.com`
 - NVIDIA signing guidance: `https://docs.nvidia.com/skills/signing-agent-skills`
 - NVIDIA skill card guidance: `https://docs.nvidia.com/skills/skill-cards`
 - NVIDIA release checklist: `https://docs.nvidia.com/skills/release-checklist`
-- Scan evidence: `skillspector-report.md` records a static SkillSpector v2.3.7 scan from 2026-07-10 with 0 findings. Refresh it after each `SKILL.md` change.
+- Scan evidence: `skillspector-report.md` records a static SkillSpector v2.3.7 scan from 2026-07-16 with 0 findings. Refresh it after each skill directory change.
 - Signing evidence: pending `skill.oms.sig` for signed release artifacts.
 - Evaluation evidence: pending Tier-3 evaluation data and `BENCHMARK.md` for NVIDIA-Verified release.
 
@@ -69,7 +69,7 @@ Other properties: The skill performs no shell execution, no local file access, n
 
 ## Skill Version
 
-2.5.3
+2.5.5
 
 ## Ethical Considerations
 

package/skills/x-twitter-scraper/skillspector-report.md

@@ -2,7 +2,7 @@
 
 **Skill:** x-twitter-scraper
 **Source:** `skills/x-twitter-scraper`
-**Scanned:** 2026-07-10 18:54:50 UTC
+**Scanned:** 2026-07-16 13:37:35 UTC
 
 ## Static Scan
 

package/skills/xquik-social-research/SKILL.md

@@ -57,6 +57,8 @@ Use Xquik MCP when an agent should inspect live endpoint metadata first.
 
 Connect through `https://xquik.com/mcp` using the documented remote setup.
 
+If Codex reports `Authorization server response missing required issuer: expected https://xquik.com`, do not repeat OAuth. Affected Codex releases discard the RFC 9207 `iss` value even though Xquik returns it. Use `XQUIK_API_KEY` through the Codex `bearer_token_env_var` setting, then follow the [Codex OAuth troubleshooting guide](https://docs.xquik.com/guides/troubleshooting#codex-oauth-issuer-validation-error). Track the client fix in [openai/codex#31573](https://github.com/openai/codex/issues/31573).
+
 Prefer REST when writing application code, backend jobs, or data pipelines.
 
 ## Safety Gates

package/stub-server.mjs

@@ -8,7 +8,7 @@ import { createInterface } from "node:readline";
 
 const SERVER_INFO = {
   name: "xquik",
-  version: "2.5.3",
+  version: "2.5.5",
 };
 
 const CAPABILITIES = {
@@ -42,7 +42,7 @@ const TOOLS = [
   {
     name: "explore",
     description: description([
-      "Search and browse the Xquik X (Twitter) API specification to discover endpoints before making live API calls with the 'xquik' tool.",
+      "Live Xquik tool: search the 119-route API catalog before calling 'xquik'. This package stub returns setup guidance only.",
       "",
       "## When to use",
       "- Use 'explore' FIRST to find the right endpoint path, parameters, and response shape before calling 'xquik'.",
@@ -54,11 +54,9 @@ const TOOLS = [
       "- Do NOT use if you already know the endpoint path and parameters.",
       "",
       "## Behavior",
-      "- Read-only, idempotent. No network calls - runs against an in-memory catalog of 118 MCP operations.",
-      "- Included usage and does not require authentication.",
-      "- Returns the result of your filter function, such as an empty array if no endpoints match.",
-      "- Returns a validation error if the request function is invalid.",
-      "- Timeout: 60 seconds.",
+      "- Live server: read-only, idempotent catalog search with no API request.",
+      "- Package stub: makes no network call and returns live setup guidance.",
+      "- The live catalog has 119 routes. Of these, 118 support JSON or text.",
       "- Each EndpointInfo contains method, path, summary, category, free, parameters, and responseShape fields.",
       "",
       "## Input format",
@@ -83,7 +81,7 @@ const TOOLS = [
   {
     name: "xquik",
     description: description([
-      "Send confirmed Xquik API requests across 118 MCP operations.",
+      "Live Xquik tool: send confirmed requests across 119 catalog routes. This package stub returns setup guidance only.",
       "",
       "## When to use",
       "- Use after calling 'explore' to discover the endpoint path and parameters.",
@@ -95,19 +93,19 @@ const TOOLS = [
       "- Do NOT pass API keys or auth headers - authentication is injected automatically.",
       "",
       "## Behavior",
-      "- Processes the provided request function with `xquik.request(path, options?)` and `spec.endpoints` available.",
-      "- No filesystem or arbitrary network access - only xquik.request() is available.",
-      "- Timeout: 60 seconds per invocation, 60 seconds per individual API request.",
-      "- Read operations return JSON objects with the requested data.",
-      "- Mutating operations require prior user confirmation and return `{ success: true }` or `{ success: true, warning: '...' }`.",
-      "- Pagination responses include `has_next_page` and `next_cursor`. Pass `cursor` as a query param for the next page.",
+      "- Live server: processes `xquik.request(path, options?)` inside a bounded sandbox.",
+      "- Package stub: makes no API request and returns live setup guidance.",
+      "- The live tool has no filesystem or arbitrary network access.",
+      "- 118 catalog routes support JSON or text. Binary support downloads use REST.",
+      "- Mutating operations require prior user confirmation and can return durable actions.",
+      "- Pagination responses include `has_more` and `next_cursor`. Pass `cursor` for the next page.",
       "- Some operations modify X or Xquik resources. Show the exact payload, target, and usage estimate before calling them.",
       "",
       "## Error handling",
       "- 402: Account access or usage balance requires dashboard attention. Explain the account state and direct the user to the dashboard before retrying.",
       "- 429: Rate limited. Retry after backoff.",
       "- 404: Resource not found, such as a missing user, tweet, or monitor.",
-      "- 200 with `warning` field: Probable success - do NOT retry.",
+      "- Durable writes: follow `safe_to_retry` and `next_action` before retrying.",
       "",
       "## Input format",
       "Provide a bounded request function using `xquik.request(path, { method?, body?, query? })`. Auth is automatic.",

package/task-guides/check-mutuals.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/clean-followers.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/export-tweets-csv.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/extract-followers.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/find-bangers.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/find-influencers.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/find-viral-tweets.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/follow-unfollow.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/for-you-feed.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/going-viral.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/grow-followers.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/monitor-accounts.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/optimize-tweets.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/post-tweets.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:
@@ -105,4 +105,4 @@ This skill assumes an account is already connected. New connections are performe
 
 ## Related
 
-For the full 126-operation REST reference, including reads, analytics, extractions, and monitoring, see [x-twitter-scraper](../skills/x-twitter-scraper/SKILL.md) in the same repo.
+For all 127 REST operations, see [x-twitter-scraper](../skills/x-twitter-scraper/SKILL.md) in this repository.

package/task-guides/run-giveaway.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/search-tweets.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:
@@ -107,7 +107,7 @@ To export: `GET /extractions/{id}/export?format=csv` (or `xlsx`, `md`). Cap 50,0
 | 402 | `insufficient_credits` | Explain the account state and direct the user to the dashboard |
 | 429 | `x_api_rate_limited` | Exponential backoff, respect `Retry-After` |
 
-Read tier rate limit: 60 requests per 1s.
+Read tier rate limit: 300 requests per 1s.
 
 ## Tweet IDs are strings
 

package/task-guides/send-dms.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/top-replies.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/track-competitors.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/track-hashtags.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/track-mentions.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env:

package/task-guides/trending-news.md

@@ -5,7 +5,7 @@ license: MIT
 metadata:
   internal: true
   author: Xquik
-  version: "2.5.3"
+  version: "2.5.5"
   openclaw:
     requires:
       env: