API Surface Fresh

XMCP exposes the X API v2 as MCP tools. To use those tools well, you need to understand the underlying API: how to authenticate, how rate limits work, and which endpoint groups exist. This section covers the parts of the X API that matter most when driving it through MCP.

What this section covers

Page	What it covers
Authentication	OAuth 1.0a, OAuth 2.0 (PKCE), and app-only Bearer tokens
Rate Limits	15-minute windows, app vs user limits, headers, and 429 handling
Endpoint Groups	The X API v2 resources that become MCP tools

The core data model

Posts, Users, and Spaces are the core objects of the X API v2. Most tools operate on one of these, with supporting groups for Direct Messages, Lists, Media, Communities, Trends, and more.

flowchart TD
    XMCP[XMCP tools] --> Posts[Posts]
    XMCP --> Users[Users]
    XMCP --> DMs[Direct Messages]
    XMCP --> Lists[Lists]
    XMCP --> Media[Media]
    XMCP --> Spaces[Spaces]
    XMCP --> More[Communities, Trends,
Bookmarks, News, Usage...]
    Posts --> API[(X API v2)]
    Users --> API
    DMs --> API
    Lists --> API
    Media --> API
    Spaces --> API
    More --> API

Two access contexts

• App-only (Bearer token): read public data. Subject to per-app rate limits.
• User context (OAuth 1.0a or OAuth 2.0): act on behalf of an account - create posts, like, follow, message. Subject to per-user rate limits.

XMCP requires a Bearer token and OAuth 1.0a consumer credentials so it can serve both read and write tools.

See also

• Authentication
• Rate Limits
• Endpoint Groups
• Tool Catalog