Appearance
Limitations Fresh
Known constraints of the XMCP server. Plan around these before building.
XMCP limitations
| Limitation | Detail | Implication |
|---|---|---|
| No streaming or webhook endpoints | These require persistent connections that do not fit the MCP request/response model | Use the X API directly (or the official SDKs) for filtered stream, volume streams, and Account Activity webhooks |
| Spec fetched at startup | The OpenAPI spec is loaded once when the server starts | Restart the server to pick up any API spec updates |
| Tokens stored in memory | OAuth tokens are not persisted across restarts | You re-run the OAuth consent flow each time the server starts |
What gets excluded from tools
XMCP excludes streaming and webhook operations when generating tools:
- Endpoints with
/streamor/webhooksin the path are excluded. - Operations tagged
StreamorWebhooks, or marked withx-twitter-streaming: true, are excluded.
flowchart TD
Spec[OpenAPI spec] --> Filter{Streaming or webhook?}
Filter -->|Yes| Excluded[Excluded from tools]
Filter -->|No| Allow{In allow-list, if set?}
Allow -->|Yes / no list| Tool[Becomes an MCP tool]
Allow -->|No| Skipped[Not loaded]Real-time data alternatives
Because streaming is excluded from MCP, use these mechanisms directly for live data:
| Need | Mechanism |
|---|---|
| Real-time matching posts | Filtered Stream |
| High-volume sampling | Volume Streams |
| Account events (DMs, follows, etc.) | Account Activity webhooks / X Activity (XAA) |
Operational constraints
- Rate limits apply to every tool call just as they do to direct API requests. See Rate Limits.
- Auth context matters - app-only Bearer tokens cannot perform user-context actions; you need OAuth 1.0a or OAuth 2.0 for writes.
- Compliance - respect the X Developer Agreement and Display Requirements; do not automate prohibited behavior.
Spec host note
The hosted documentation references the spec at https://api.x.com/2/openapi.json. The XMCP server fetches it from the equivalent https://api.twitter.com/2/openapi.json host at startup. Both serve the same X API v2 contract.