Skip to content

Environment Variables Fresh

Every environment variable XMCP reads from .env, grouped by purpose.

Required

These must be set or the server will not start.

VariableDefaultPurpose
X_OAUTH_CONSUMER_KEY-OAuth 1.0a consumer (API) key
X_OAUTH_CONSUMER_SECRET-OAuth 1.0a consumer secret
X_BEARER_TOKEN-App-only Bearer token (keep set even when using OAuth 1.0a)

OAuth 1.0a callback

VariableDefaultPurpose
X_OAUTH_CALLBACK_HOST127.0.0.1Host for the local OAuth callback server
X_OAUTH_CALLBACK_PORT8976Port for the callback server
X_OAUTH_CALLBACK_PATH/oauth/callbackPath the callback is served on
X_OAUTH_CALLBACK_TIMEOUT300Seconds to wait for the callback

The registered callback URL is http://<HOST>:<PORT><PATH> - with defaults, http://127.0.0.1:8976/oauth/callback.

Server settings

VariableDefaultPurpose
X_API_BASE_URLhttps://api.x.comBase URL for X API requests
X_API_TIMEOUT30API request timeout (seconds)
MCP_HOST127.0.0.1Host the MCP server binds to
MCP_PORT8000Port the MCP server binds to
X_API_DEBUG1Verbose API debug logging

Tool filtering

VariableDefaultPurpose
X_API_TOOL_ALLOWLIST-Comma-separated operation names to expose as tools

Example:

bash
X_API_TOOL_ALLOWLIST=getUsersByUsername,createPosts,searchPostsRecent

OAuth 1.0a debug output

VariableDefaultPurpose
X_OAUTH_PRINT_TOKENS-Set to 1 to print tokens to the console
X_OAUTH_PRINT_AUTH_HEADER-Set to 1 to print the signed Authorization header

Optional: OAuth 2.0 token generation

VariableDefaultPurpose
CLIENT_ID-OAuth 2.0 client ID
CLIENT_SECRET-OAuth 2.0 client secret
X_OAUTH_ACCESS_TOKEN-Generated OAuth 2.0 access token
X_OAUTH_ACCESS_TOKEN_SECRET-Token secret, if your flow returns one

Optional: Grok test client

VariableDefaultPurpose
XAI_API_KEY-xAI API key for the Grok test client
XAI_MODELgrok-4-1-fastGrok model to use
MCP_SERVER_URLhttp://127.0.0.1:8000/mcpURL the Grok client connects to

See also