XActions

MCP server · npm · ★ 631 · graded 2026-10-27Source linked

⚡ The Complete X/Twitter Automation Toolkit — Scrapers, MCP server for AI agents (Claude/GPT), CLI, browser scripts. No API fees. Open source. Unfollow people who don't follow back. Monitor real-time analytics. Auto follow, like, comment, scrape, without API. Follow Bot. Like bot. Grow your account automatically.

No outside reports on file

This tool violates Twitter's terms of service and risks permanent account suspension; it also stores your login credentials locally and relies on fragile web scraping that could break anytime.

Based on public adoption and transparency signals as of Oct 27, 2026. Our opinion, not a code audit or security guarantee.

Was this verdict for XActions helpful?

What it can access

Local filesNo local folder access notedLOW
Command executionNo shell command runner notedLOW
Network reachFetches arbitrary web URLsREVIEW
CredentialsRequires API key or tokenREVIEW
Package sourcenpm (xactions)PUBLIC

Inferred from this listing’s public package details and description. Check the project’s source before installing.

Install

npx -y xactions

All setup options ↓

Check this skill Watch it in my stack Compare Add to allowlist README badge View project

About XActions

XActions is a toolkit that automates X/Twitter tasks like following, unfollowing, liking, and commenting without using Twitter's official API. It works as an MCP server for AI agents (Claude, GPT), a command-line tool, or browser scripts. It also scrapes Twitter data and monitors analytics.

Who it’s for

People who want to automate Twitter growth and engagement without paying for API access, and AI agent developers who want to add Twitter automation to Claude or GPT. This appeals to social media managers, growth hackers, and account owners wanting hands-off engagement.

Alternatives

Official Twitter API (paid tier): Reliable, legal, won't get you suspended. - Buffer, Hootsuite, Later: Legitimate social media scheduling tools with API support. - Zapier: Connects Twitter to other apps safely using official integrations. - IFTTT: Simple automation without direct Twitter API fees for basic tasks.

Setup

Check these steps against the project’s own instructions before running anything.

Follow the project's README at https://github.com/nirholas/XActions (opens external site) for installation steps. The repo includes instructions for using it as an MCP server with Claude Desktop, a CLI tool, or browser scripts.

Why this grade

CC — Moderate risk signals

Signal-based grade (3/7 points): well starred on GitHub, public source code. This reflects adoption and transparency, not a code review.

Popularity and upkeep

55/100

GitHub stars: 631
Weekly npm downloads: 413
Listing last refreshed: 2026-10-29

These are public popularity signals, not a maintenance check. Look at the repository’s commit history and open issues.

Security reports

No reports found for this package in our research (last checked 2026-10-29).

Check a specific version →

Risks to watch for

Account suspension risk: Twitter prohibits automation of likes, follows, and comments. Using this violates their terms and risks permanent account ban. - Credential exposure: Stores Twitter login credentials locally; if your computer is compromised, attackers gain full account access. - No API means web scraping: Relies on scraping Twitter's web pages, which breaks easily when Twitter changes its code and may trigger security alerts on your account. - Uncontrolled bot actions: AI agents using this might follow/like/comment on inappropriate content or amplify spam if not carefully prompted. - No rate limiting details: Unclear if it respects Twitter's limits; aggressive use could lock your account quickly.

How to lower the risk

Least-privilege permissions

Use a secondary/test Twitter account, never your main account. - Keep the account separate from valuable followers or business use.

Network isolation

Run this only on trusted devices you fully control. - Never share the computer or give remote access to others.

Monitoring

Check your Twitter account daily for unexpected activity or suspension warnings. - Review the tool's logs to spot failed scrapes or strange behavior.

Red flags to watch for

Twitter warning messages about unusual activity or requiring password resets. - Bot actions liking/following spam accounts or hateful content. - The tool failing to work (scrape breakage) weeks after last use.

Questions

How do I install XActions?

Run npx -y xactions in your terminal, or add the server entry to your claude_desktop_config.json or .cursor/mcp.json as shown in the Setup section on this page. Full setup docs and environment variables are in github.com/nirholas/XActions.

Are there security reports about XActions?

No reports found for this package in our research (last checked 2026-10-29). XActions currently holds Grade C (Moderate risk signals) based on public adoption and transparency signals. Key risk areas to watch include account suspension risk.

Is XActions actively maintained?

XActions has 631 GitHub stars and 413 weekly npm downloads. Our directory data was last refreshed on 2026-10-29. Check recent commit activity, release tags, and open issues at github.com/nirholas/XActions before pinning it in production.

What are alternatives to XActions?

Notable alternatives to XActions include Official Twitter API. You can also compare XActions side by side with other MCP servers in the Related tools section on this page.

Maintain or use XActions? Show its live grade in your GitHub README, docs site, or run a check from the terminal before you install.

GitHub README Markdown:

markdown

[![AgentArmorHQ Risk Grade for XActions](https://agentarmorhq.com/api/badge/nirholas-xactions)](https://agentarmorhq.com/skills/nirholas-xactions)

HTML embed:

html

<a href="https://agentarmorhq.com/skills/nirholas-xactions"><img src="https://agentarmorhq.com/api/badge/nirholas-xactions" alt="AgentArmorHQ Risk Grade for XActions" height="20" /></a>

Terminal check:

terminal

curl -fsSL https://agentarmorhq.com/api/cli | node --input-type=module - check "nirholas-xactions"

Share with your security lead

Need sign-off to use XActions? Copy this note for Slack, a ticket or a pull request.

### AgentArmorHQ Security Review Memo: XActions
- **Listing URL:** https://agentarmorhq.com/skills/nirholas-xactions
- **Type:** App connector
- **Risk Grade:** Grade C (Moderate risk signals)
- **Outside Security Advisories on File:** 0
- **Public Adoption:** 631 GitHub stars, 413 weekly npm downloads

#### Permission & Blast-Radius Signals
- **Local files:** No local folder access noted
- **Command execution:** No shell command runner noted
- **Network reach:** Fetches arbitrary web URLs
- **Credentials:** Requires API key or token
- **Package source:** npm (xactions)

#### Recommended Hardened Setup
- **Command:** `npx -y --ignore-scripts xactions`
- **Controls:** Pin an exact version in `.mcp.json`, scope access to a single workspace folder, and use a least-privilege read-only token where supported.

_Based on public adoption and transparency signals as of Oct 27, 2026. Our opinion, not a code audit or security guarantee._

Key facts

Type: App connector
Publisher: nirholas
Source code: github.com/nirholas/XActions
Install command: npm install xactions
Est. context load: ~600 tokens / turn (~3 tool schemas, 0.3% of 200k context)
Popularity: 631 GitHub stars, 413 weekly npm downloads
Last updated: 2026-10-29
Last graded: 2026-10-27

Community

Discussions for XActions

Ask questions or share configuration tips. Governed by our Community Rules & Terms.

No posts match this filter yet.

Be the first to ask a question or share a working tip.

Was this listing for XActions helpful?

Check before you install, in Claude

Your assistant answers Block, Review or No known issues for any package before it installs it.

Get this check inside Claude