XActions

<div align="center"> <pre align="center"> ██╗ ██╗ █████╗ ██████╗████████╗██╗ ██████╗ ███╗ ██╗███████╗ ╚██╗██╔╝██╔══██╗██╔════╝╚══██╔══╝██║██╔═══██╗████╗ ██║██╔════╝ ╚███╔╝ ███████║██║ ██║ ██║██║ ██║██╔██╗ ██║███████╗ ██╔██╗ ██╔══██║██║ ██║ ██║██║ ██║██║╚██╗██║╚════██║ ██╔╝ ██╗██║ ██║╚██████╗ ██║ ██║╚██████╔╝██║ ╚████║███████║ ╚═╝ ╚═╝╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═╝ ╚═════╝ ╚═╝ ╚═══╝╚══════╝ </pre> <p> <img src=".github/xactions-ascii.svg" alt="XActions, the complete X/Twitter automation toolkit" width="720"> </p> <h3>The complete X/Twitter automation toolkit</h3> <p> Scrapers &nbsp;·&nbsp; MCP Server for AI Agents &nbsp;·&nbsp; CLI &nbsp;·&nbsp; Browser Scripts &nbsp;·&nbsp; Browser Extension<br> <strong>No API keys. No monthly fees. 100% open source.</strong> </p> <p> <a href="https://www.npmjs.com/package/xactions"><img src="https://img.shields.io/npm/v/xactions.svg?style=flat-square&color=cb3837&label=npm" alt="npm version"></a>&nbsp; <a href="https://www.npmjs.com/package/xactions"><img src="https://img.shields.io/npm/dm/xactions.svg?style=flat-square&color=cb3837&label=downloads" alt="npm downloads"></a>&nbsp; <a href="LICENSE"><img src="https://img.shields.io/badge/license-Apache_2.0-green?style=flat-square" alt="Apache 2.0 License"></a>&nbsp; <a href="https://github.com/nirholas/xactions"><img src="https://img.shields.io/github/stars/nirholas/xactions?style=flat-square&color=f5c542&label=stars" alt="Stars"></a> </p> <p> <a href="docs/mcp-setup.md"><img src="https://img.shields.io/badge/MCP_Tools-152-8B5CF6?style=flat-square&logo=data:image/svg+xml;base64,PHN2Zz48L3N2Zz4=" alt="154 MCP Tools"></a>&nbsp; <a href="https://smithery.ai/server/xactions"><img src="https://smithery.ai/badge/xactions" alt="Smithery"></a>&nbsp; <a href="https://registry.modelcontextprotocol.io"><img src="https://img.shields.io/badge/MCP_Registry-deployed-6366f1?style=flat-square&logo=data:image/svg+xml;base64,PHN2Zz48L3N2Zz4=" alt="MCP Registry"></a>&nbsp; <a href="Dockerfile"><img src="https://img.shields.io/badge/Docker-ready-2496ED?style=flat-square&logo=docker&logoColor=white" alt="Docker"></a>&nbsp; <a href="types/index.d.ts"><img src="https://img.shields.io/badge/TypeScript-types_included-3178C6?style=flat-square&logo=typescript&logoColor=white" alt="TypeScript"></a> </p> <p> <a href="https://x.com/nichxbt"><img src="https://img.shields.io/badge/follow-@nichxbt-000000?style=flat-square&logo=x&logoColor=white" alt="Follow @nichxbt"></a>&nbsp; <a href="https://x.ai"><img src="https://img.shields.io/badge/built_with-Grok_🤖-1DA1F2?style=flat-square" alt="Built with Grok"></a> </p>

https://xactions.app

<br>

Website  ·  npm  ·  Docs  ·  MCP Server  ·  Docker  ·  API Ref

</div>

---

<div align="center">

⚡ Try it in 30 seconds

</div>

npx xactions profile nasa

⚡ @NASA

  Name:      NASA
  Bio:       Making the seemingly impossible, possible. ✨
  Location:  Pale Blue Dot
  Website:   http://www.nasa.gov/
  Joined:    2007-12-19
  Following: 117  Followers: 92.4M
  Tweets:    74.2K  Listed:    0
  ✓ Verified

No API key. No account. No browser. Real data in about a second.

npx xactions tweets nasa --limit 100 --output nasa.csv   # timeline to a spreadsheet
npx xactions login                                        # unlock search, followers, DMs
npx xactions search "your brand" --limit 50               # what people are saying

<div align="center">

⚡ See it in action

<picture> <source media="(prefers-color-scheme: dark)" srcset="public/demo.svg"> <source media="(prefers-color-scheme: light)" srcset="public/demo.svg"> <img alt="XActions CLI demo: profile lookup, tweet search, non-follower detection" src="public/demo.svg" width="720"> </picture>

<video src="https://raw.githubusercontent.com/nirholas/XActions/main/public/demo.mp4" controls width="720"></video>

</div>

---

🏆 How XActions Compares

Why build with XActions instead of the alternatives?

| Feature | XActions | twikit | twscrape | x-use | xmcp (official) | bird | twitter-cli | Agent-Reach | |---------|:---:|:---:|:---:|:---:|:---:|:---:|:---:|:---:| | No API Key Required | ✅ | ✅ Cookies | ✅ Account pool | ✅ Browser | ❌ X API keys | ✅ Cookies | ❌ X API keys | ✅ | | MCP Server (AI agents) | ✅ 154 tools | ❌ | ❌ | ✅ (33-tool server) | ✅ (140-tool, metered) | ❌ | ❌ | ❌ Skills, not MCP | | Browser Console Scripts | ✅ 95 | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | AI Voice Agent in Spaces | ✅ Join, listen, speak | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | CLI | ✅ 56 commands | ❌ | ✅ | ❌ | ❌ | ✅ | ✅ | ✅ | | Human approval gate on writes | ✅ Every write held as a draft | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ | | Daily action caps that survive a restart | ✅ Per account, on disk | ❌ | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ | | Account pool with rotation | ✅ SQLite, per-operation windows | ❌ | ✅ | ❌ | ❌ | ❌ | ❌ | ❌ | | Resumable long scrapes | ✅ Cursor checkpoints | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | Cookies from your installed browser | ✅ --from-browser, --cookies-file | ❌ | ❌ | ❌ | ❌ | ✅ | ✅ | ❌ | | Official X archive import | ✅ xactions archive | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | ❌ | | Language | JavaScript | Python | Python | TypeScript | TypeScript | TypeScript | Python | Python |

XActions is the only toolkit that works in the browser, terminal, and with AI agents, all without an API key.

Competitor columns come from the competitive audit, which names each project and what it does better than us. Where a rival led, we built it: the approval gate and the daily caps follow x-use, the account pool follows twscrape, cursor resume follows Scweet, and browser cookie import follows bird and twitter-cli.

---

🆕 What's New

| Area | What changed | |------|-------------| | Delete every reply you sent one account | scripts/searchSweep.js turns any X search into a bulk action. Open x.com/search?q=from:you @someone&f=live, paste it, and delete, like, repost, or reply to every result, with a floating panel, a dry run, filters that protect posts that did numbers, and multiple passes because X search returns a slice at a time. Deletes only ever touch your own posts. Docs. | | Sweep a whole profile | scripts/engageProfile.js likes, reposts, and replies to every post on an account from the console, with a floating panel, dry run, resume, undo, and replies from your templates or from an LLM given a one-line brief (Grok works straight from the console; any provider through the extension). xactions engage USERNAME --like --repost --comment --prompt "..." does the same from the terminal with any provider. Docs. | | A CLI you can find your way around | All 56 commands are now grouped by task instead of listed alphabetically. xactions quickstart gives a guided first run that adapts to what you already have set up. | | Tab completion | xactions completion bash\|zsh\|fish prints a completion script generated from the live command tree, so every command, sub-command, and flag completes. | | Log in without touching DevTools | xactions login --from-browser reads x.com cookies straight out of an installed Chrome, Chromium, Brave, Edge, Arc or Firefox profile. --cookies-file imports a Netscape cookies.txt, a Cookie-Editor or EditThisCookie JSON export, or a Playwright / Puppeteer storageState. A full cookie jar beats a bare auth_token, because it carries the ct0 every write needs. | | Query IDs that heal themselves | X rotates its GraphQL query IDs and every pinned client 404s at once. Ours are discovered from x.com's own bundles and cached, so a rotation is invisible. xactions doctor reports the cache age. | | Requests signed like the real client | Every GraphQL call carries an x-client-transaction-id header computed the way x.com's own web client computes it, so reads get the answer the browser gets. | | An account pool, and scrapes that resume | Sessions live in a SQLite database with their own proxy and a per-operation rate-limit window read from X's own headers. The pooled client rotates on a 429 and locks an account on a 401. A checkpoint written after every page means a 50,000-follower scrape that dies at page 400 restarts from its cursor, not from page one. | | Daily action caps | Every MCP write is charged against a rolling 24 hour per-account budget stored on disk. The cap survives a restart, a crash, and a fresh npx xactions-mcp, and a call that would go over is refused before it reaches X. Defaults follow X's own published limits. | | Writes a human releases | XACTIONS_MCP_REQUIRE_APPROVAL=1 turns every write tool into a draft. Review with xactions drafts list, release with xactions drafts approve <id>, or use the x_list_drafts / x_approve_draft / x_discard_draft tools. | | MCP tool groups | The tool list is filterable: --tools read,analytics or XACTIONS_MCP_TOOLS=read advertises only what the session needs, and a filtered tool is neither advertised nor callable. Groups: read, write, dm, lists, spaces, analytics, ai, grok, automation, monitoring, workflows, persona, graph, data, x402, drafts, auth. | | MCP over HTTP | xactions-mcp --http serves the Streamable HTTP transport on /mcp for remote and hosted clients, with optional bearer auth via XACTIONS_MCP_TOKEN. stdio is still the default. | | One-drag install for Claude Desktop | The .mcpb bundle carries the server and its dependencies and prompts for the session cookie and tool groups at install time, so nothing is typed into a config file. Attached to every release. | | Skills you can install | xactions skills install --all copies the 50 bundled skills into Claude Code, Cursor, Codex, Windsurf, or the current project. xactions skills show <name> reads one without installing it. | | Bring your X archive | xactions archive summary\|export\|migrate reads the official X data export zip: counts, date range, busiest year and top hashtags; a rewrite to JSON, CSV, Markdown and a browsable HTML viewer; or a migration to Bluesky or Mastodon. Docs. | | Live event streaming | src/streaming/livePipeline.js reads x.com's own event pipeline: engagement counters, DM updates and typing indicators, pushed rather than polled, with subscriptions changed mid-session. It is a chunked newline-delimited JSON response, not a WebSocket, because x.com never answers that endpoint with a 101. | | Signed webhooks | Outbound deliveries carry an HMAC-SHA256 signature, a timestamp, an event type and a stable delivery id, retry three times with backoff, and land in a replayable delivery log. Receivers verify with the exported verifyWebhookSignature. | | --compact and --fields | Global on every read command. --compact prints one record per line as tab-separated key=value pairs with no colours or spinners; --fields id,text,likes narrows that to the columns you name. Built for agents and pipes. | | --json everywhere | Every read command accepts --json and puts data on stdout and nothing else. It outranks --output, so a pipe is never silently turned into a file write. | | Reliability | Public reads no longer need a browser at all. Profiles and timelines come from the internal GraphQL API in about a second, with no Chromium download. | | Honest failures | Nothing reports empty results as success anymore. A read that cannot complete says why, and says what to do about it. | | Archive every photo and video | `xactions download @nichxbt:all --