xactions

https://xactions.app

Website  ·  npm  ·  Docs  ·  MCP Server  ·  Docker  ·  API Ref

---

⚡ Try it in 30 seconds

npx xactions profile nasa

⚡ @NASA

  Name:      NASA
  Bio:       Making the seemingly impossible, possible. ✨
  Location:  Pale Blue Dot
  Website:   http://www.nasa.gov/
  Joined:    2007-12-19
  Following: 117  Followers: 92.4M
  Tweets:    74.2K  Listed:    0
  ✓ Verified

No API key. No account. No browser. Real data in about a second.

npx xactions tweets nasa --limit 100 --output nasa.csv   # timeline to a spreadsheet
npx xactions login                                        # unlock search, followers, DMs
npx xactions search "your brand" --limit 50               # what people are saying

⚡ See it in action

---

🏆 How XActions Compares

Why build with XActions instead of the alternatives?

Feature	XActions	twikit	twscrape	x-use	xmcp (official)	bird	twitter-cli	Agent-Reach
No API Key Required	✅	✅ Cookies	✅ Account pool	✅ Browser	❌ X API keys	✅ Cookies	❌ X API keys	✅
MCP Server (AI agents)	✅ 154 tools	❌	❌	✅ (33-tool server)	✅ (140-tool, metered)	❌	❌	❌ Skills, not MCP
Browser Console Scripts	✅ 95	❌	❌	❌	❌	❌	❌	❌
AI Voice Agent in Spaces	✅ Join, listen, speak	❌	❌	❌	❌	❌	❌	❌
CLI	✅ 56 commands	❌	✅	❌	❌	✅	✅	✅
Human approval gate on writes	✅ Every write held as a draft	❌	❌	✅	❌	❌	❌	❌
Daily action caps that survive a restart	✅ Per account, on disk	❌	❌	✅	❌	❌	❌	❌
Account pool with rotation	✅ SQLite, per-operation windows	❌	✅	❌	❌	❌	❌	❌
Resumable long scrapes	✅ Cursor checkpoints	❌	❌	❌	❌	❌	❌	❌
Cookies from your installed browser	✅ --from-browser, --cookies-file	❌	❌	❌	❌	✅	✅	❌
Official X archive import	✅ xactions archive	❌	❌	❌	❌	❌	❌	❌
Language	JavaScript	Python	Python	TypeScript	TypeScript	TypeScript	Python	Python

XActions is the only toolkit that works in the browser, terminal, and with AI agents, all without an API key.

Competitor columns come from the competitive audit, which names each project and what it does better than us. Where a rival led, we built it: the approval gate and the daily caps follow x-use, the account pool follows twscrape, cursor resume follows Scweet, and browser cookie import follows bird and twitter-cli.

---

🆕 What's New

Area	What changed
Delete every reply you sent one account	scripts/searchSweep.js turns any X search into a bulk action. Open x.com/search?q=from:you @someone&f=live, paste it, and delete, like, repost, or reply to every result, with a floating panel, a dry run, filters that protect posts that did numbers, and multiple passes because X search returns a slice at a time. Deletes only ever touch your own posts. Docs.
Sweep a whole profile	scripts/engageProfile.js likes, reposts, and replies to every post on an account from the console, with a floating panel, dry run, resume, undo, and replies from your templates or from an LLM given a one-line brief (Grok works straight from the console; any provider through the extension). xactions engage USERNAME --like --repost --comment --prompt "..." does the same from the terminal with any provider. Docs.
A CLI you can find your way around	All 56 commands are now grouped by task instead of listed alphabetically. xactions quickstart gives a guided first run that adapts to what you already have set up.
Tab completion	xactions completion bash|zsh|fish prints a completion script generated from the live command tree, so every command, sub-command, and flag completes.
Log in without touching DevTools	xactions login --from-browser reads x.com cookies straight out of an installed Chrome, Chromium, Brave, Edge, Arc or Firefox profile. --cookies-file imports a Netscape cookies.txt, a Cookie-Editor or EditThisCookie JSON export, or a Playwright / Puppeteer storageState. A full cookie jar beats a bare auth_token, because it carries the ct0 every write needs.
Query IDs that heal themselves	X rotates its GraphQL query IDs and every pinned client 404s at once. Ours are discovered from x.com's own bundles and cached, so a rotation is invisible. xactions doctor reports the cache age.
Requests signed like the real client	Every GraphQL call carries an x-client-transaction-id header computed the way x.com's own web client computes it, so reads get the answer the browser gets.
An account pool, and scrapes that resume	Sessions live in a SQLite database with their own proxy and a per-operation rate-limit window read from X's own headers. The pooled client rotates on a 429 and locks an account on a 401. A checkpoint written after every page means a 50,000-follower scrape that dies at page 400 restarts from its cursor, not from page one.
Daily action caps	Every MCP write is charged against a rolling 24 hour per-account budget stored on disk. The cap survives a restart, a crash, and a fresh npx xactions-mcp, and a call that would go over is refused before it reaches X. Defaults follow X's own published limits.
Writes a human releases	XACTIONS_MCP_REQUIRE_APPROVAL=1 turns every write tool into a draft. Review with xactions drafts list, release with xactions drafts approve <id>, or use the x_list_drafts / x_approve_draft / x_discard_draft tools.
MCP tool groups	The tool list is filterable: --tools read,analytics or XACTIONS_MCP_TOOLS=read advertises only what the session needs, and a filtered tool is neither advertised nor callable. Groups: read, write, dm, lists, spaces, analytics, ai, grok, automation, monitoring, workflows, persona, graph, data, x402, drafts, auth.
MCP over HTTP	xactions-mcp --http serves the Streamable HTTP transport on /mcp for remote and hosted clients, with optional bearer auth via XACTIONS_MCP_TOKEN. stdio is still the default.
One-drag install for Claude Desktop	The .mcpb bundle carries the server and its dependencies and prompts for the session cookie and tool groups at install time, so nothing is typed into a config file. Attached to every release.
Skills you can install	xactions skills install --all copies the 50 bundled skills into Claude Code, Cursor, Codex, Windsurf, or the current project. xactions skills show <name> reads one without installing it.
Bring your X archive	xactions archive summary|export|migrate reads the official X data export zip: counts, date range, busiest year and top hashtags; a rewrite to JSON, CSV, Markdown and a browsable HTML viewer; or a migration to Bluesky or Mastodon. Docs.
Live event streaming	src/streaming/livePipeline.js reads x.com's own event pipeline: engagement counters, DM updates and typing indicators, pushed rather than polled, with subscriptions changed mid-session. It is a chunked newline-delimited JSON response, not a WebSocket, because x.com never answers that endpoint with a 101.
Signed webhooks	Outbound deliveries carry an HMAC-SHA256 signature, a timestamp, an event type and a stable delivery id, retry three times with backoff, and land in a replayable delivery log. Receivers verify with the exported verifyWebhookSignature.
--compact and --fields	Global on every read command. --compact prints one record per line as tab-separated key=value pairs with no colours or spinners; --fields id,text,likes narrows that to the columns you name. Built for agents and pipes.
--json everywhere	Every read command accepts --json and puts data on stdout and nothing else. It outranks --output, so a pipe is never silently turned into a file write.
Reliability	Public reads no longer need a browser at all. Profiles and timelines come from the internal GraphQL API in about a second, with no Chromium download.
Honest failures	Nothing reports empty results as success anymore. A read that cannot complete says why, and says what to do about it.