Skip to main content
Xquik API MCP supports 2 explicit tool modes. Code Mode uses docs, search, and execute. Native mode exposes docs plus one tool for each eligible OpenAPI operation. Active guest paid_reads keys see exactly 33 GET routes in either mode. Modern clients negotiate MCP 2026-07-28 through server/discover. Current SDKs add required request metadata and headers. See MCP 2026-07-28.

Native OpenAPI tools

Connect to https://xquik.com/mcp?codemode=false for ordinary MCP tools. Full credentials get 119 tools. Guest keys get 34 tools. Native names, schemas, and contracts come from OpenAPI. compose and estimateExtraction are read-only. Clients read each JSON Schema from tools/list. The server embeds no model prompt, routing, sample count, or endpoint preference. Use https://xquik.com/mcp for Code Mode. Choose native mode for one tool per operation. Binary downloads and credential lifecycle operations remain REST-only.

docs

Search canonical public documentation. docs is read-only and uses no credits. Input. Pass a non-empty query string of up to 500 characters. Search the authenticated API catalog. search makes no network calls and uses no credits. Full credentials search 118 routes. Guest keys search 33 GET routes. Input. Pass required code as an async arrow function of up to 10,000 characters. Read spec.paths. Return matching paths, methods, and relevant contract fields. Inspect inputs and response fields separately when an operation is large. Sandbox API. Inputs resolve inline. Response $ref values point into spec.components.schemas. The catalog includes only response schemas reachable from your allowed operations. Search retains operation-specific response descriptions. Date-only fields keep string types. Follow references to inspect shared fields and recursive types.
Examples.
Inspect an operation’s input contract
Inspect specific response properties in a separate search call. For example, #/components/schemas/PaginatedTweets identifies the shared pagination schema.

execute

Execute API calls allowed by the authenticated credential. Full account keys and OAuth tokens keep their existing account capabilities. Guest keys can execute only the 33 eligible GET reads. Authentication and required idempotency headers are injected automatically. Input. Pass code as an async arrow function of up to 10,000 characters. xquik is global and the function’s first argument. Pass optional result_id to load a saved result into xquik.result. Without it, xquik.result is null. Pass the function itself, not a promise or its result. Place API calls inside its body. Non-functions fail before any API request starts. Sandbox API.
Response contract. xquik.request() returns success, status, result, errors, and messages. status contains the HTTP status. result contains the endpoint body. A rejected request includes error.status when available. Existing string-path calls still return the body for compatibility. Hosted MCP injects a unique Idempotency-Key and reuses it for bounded transient retries. Verify unresolved writes. Retry only when safe_to_retry is true. Results use snake_case with Unix timestamps. CamelCase reads work, including favoriteCount for like_count. Errors stay structured. Pagination uses has_more and next_cursor. Compact extraction results retain like_count, retweet_count, reply_count, quote_count, view_count, and bookmark_count. They omit profile images and nested enrichment. MCP preserves every safe field that X supplies. Optional fields stay absent. See Read Data Richness for the REST field map. Missing response-field reads return undefined and produce warnings. Each warning maps a missing field to available response keys. Optional-field fallbacks remain valid. Warnings contain field names, never response values. With warnings, text and structured output both contain { result, warnings }. The combined output follows the existing 24,000-character limit. List and search responses use has_more and next_cursor, even when REST shows has_next_page or hasMore. Pass next_cursor unchanged as cursor for X reads, draws, extractions, and events. Never replace an extraction cursor with offset. Use after for /api/v1/radar and afterCursor for drafts. Hosted MCP preserves each requested limit. REST enforces documented bounds. Omit mode for tweet search, replies, followers, following, and verified followers. Those operations use automatic maximum coverage. Pass next_cursor back unchanged. Use mode=standard only for legacy pagination. Continue through empty filtered pages while has_more is true and the cursor advances. Stop when you reach the requested total or has_more becomes false. Treat a missing or repeated next_cursor while has_more is true as stalled pagination and return the partial count plus a clear stop reason. For advanced nested-reply diagnostics, call /api/v1/x/tweets/<tweet_id>/replies?mode=complete&limit=25000. Complete mode combines timelines, rankings, cursors, hidden branches, and search. Direct replies match inReplyToId. Keep nested_replies separate. Trust diagnostic.complete. HTTP 424 replies_incomplete preserves rows. MCP returns that documented body instead of a tool error. Inspect coveragePercentage, strategy results, cursor failures, missing modules, recommendedFallback, and X-dependent coverage limits. Errors use error.type, error.code, and error.message, with fields such as error.retryable or error.retry_after when available. Invalid routes stay blocked without suggesting or calling a different operation. Find the exact method and path in spec.paths before retrying. Dependency failures use HTTP 424 in this contract. Fix validation errors before retrying, and respect retry_after on 429. Write and media results follow the same contract. Read tweet_id, write_action_id, charged_credits, media_id, media_url, and message_id from response.result. Both search and execute return compact JSON within 24,000 characters. Whitespace inside strings stays unchanged. Native API tools apply the same limit to successful & failed responses. The limit bounds tool output, not catalog access or available results. Large schema selections can exceed it. Oversized output returns isError: true with a recoverable response_too_large diagnostic. It includes size, limit, and retry guidance, never partial JSON. An ordinary result containing an error field is not a tool failure. Output errors do not undo completed API actions or charges. Use REST, SDKs, or extraction exports to persist every row.

Cursor pages and response size

Cursor-based reads may return fewer rows than requested to fit each MCP response. Continue with next_cursor while has_more is true. Deferred rows remain available through that cursor, with their fields intact. Only rows delivered in each page incur result charges. Each API response within execute must fit within 2 MiB. A single larger row returns HTTP 413 response_item_too_large before result billing. Retrieve that row through REST. Projecting fields in execute cannot reduce the incoming API response size. The separate 24,000-character tool output limit still applies.

Recover oversized results

When saving succeeds, oversized API results include result_id and a resource link. Use either retrieval method:
  • Pass result_id to execute, then project or page xquik.result.
  • Read xquik://results/{result_id} through MCP resources/read.
Resources return complete { result, warnings? } JSON. Return selected fields, fewer rows, shorter strings, or an aggregate from saved data. Reading saved data makes no API requests and spends no extraction credits. Explicit xquik.request() calls still follow normal billing. Use the original account and credential scope. Another account or scope cannot retrieve the result. Missing or unavailable results return an error.
Recovery applies only when the response supplies result_id. Very large results or storage failures may prevent saving. Search catalog errors still require a smaller selection. Without a saved result, contact support before repeating paid requests. Verify completed writes before retrying them.

Scope and unavailable operations

The MCP operation boundary lists excluded operations. Guest wallet credential routes and file downloads use REST. Guest keys expose only eligible paid-read GET routes. A 402 creates no checkout. Report its payment_options, ask the user to choose an amount and option, then wait for explicit confirmation. Full account MCP sessions may call only an advertised account checkout action present in their catalog. Guest wallet creation and top-up remain direct REST after confirmation. Examples.
Summarize up to 100 tweets with guarded pagination (credits required)
Use q for keywords and X search operators, or pass a plain Tweet ID or X status URL when the agent receives a single stored link.
Summarize up to 100 followers with guarded pagination (credits required)
Scrape tweet replies to CSV, JSON, or XLSX (credits required)
Post a tweet or reply with public media URLs (credits required)
Hosted MCP injects the required Idempotency-Key. Direct REST callers must supply it themselves.
Upload media for a DM (credits required)
Store message_id with the uploaded media_id. Keep full DM bodies out of shared MCP outputs; return IDs, status, media references, and source filenames instead. Leave reply_to_message_id unset because the DM send endpoint rejects reply threading.
Download media and get gallery link (credits required)
Bulk download: search + download combined
Monitor a user + create webhook (monitor creation requires credits, webhook is free)
Poll stored monitor events (free)
Run an extraction with a resumable handoff (credits required)

Agent handoff patterns

Use extraction exports for generated files. Keep agent handoffs small. Include the job, route, stored row IDs, next cursor, and poll action. Avoid raw pages when later workers need durable rows.

Search tweets to JSON

Call GET /api/v1/x/tweets/search with keywords, operators, a Tweet ID, or an X status URL in q. Valid time bounds apply to every page. The start is inclusive and the end is exclusive. Store tweets[].id, tweets[].text, tweets[].author, tweets[].created, has_more, next_cursor, and the original q. Cost: 1 credit per tweet returned.

Scrape tweet replies to files

Call POST /api/v1/extractions with reply_extractor and targetTweetId. The create route handles required preflight. Poll GET /api/v1/extractions/{id}, export CSV/JSON/XLSX with GET /api/v1/extractions/{id}/export, and store reply rows plus has_more and next_cursor. Cost: 1 credit per reply extracted or returned.

Export followers to CRM

Call GET /api/v1/x/users/{id}/followers or POST /api/v1/extractions with follower_explorer. Store users[].id, users[].username, users[].name, users[].followers, has_more, and next_cursor. Cost: 1 credit per follower returned or extracted.

Post media tweets or replies

Call POST /api/v1/x/tweets with media: ["https://..."]. Store tweet_id or write_action_id, reply_to_tweet_id, account, charged_credits, and the original media URLs. Cost: 30 credits text-only, plus 2 credits per started MB across attached media.

Send DMs with media

Call POST /api/v1/x/media, then POST /api/v1/x/dm/{userId} with one media_ids value. Store media_id, media_url, message_id, user_id, account, and source URL or filename. Keep full DM bodies out of shared outputs and leave reply_to_message_id unset. Cost: 10 credits per media upload plus 10 credits per DM send.

Track tweet or reply writes

Call POST /api/v1/x/tweets, then GET /api/v1/x/write-actions/{id} when pending. Store tweet_id, reply_to_tweet_id, write_action_id, status, charged, charged_credits, and media. Cost: 30 credits text-only, plus 2 credits per started MB across attached media.

Monitor tweets to webhooks

Call POST /api/v1/monitors or POST /api/v1/monitors/keywords, then POST /api/v1/webhooks. Store monitor.id, event_types, next_billing_at, webhook.id, webhook URL, and the one-time webhook.secret; run POST /api/v1/webhooks/{id}/test before routing production events. Verify X-Xquik-Signature, de-dupe production payloads with deliveryId and streamEventId, and inspect GET /api/v1/webhooks/{id}/deliveries for retry status rows. Each payload contains one monitor event, so process multiple POSTs when one check catches multiple new matching tweets. Cost: 21 credits per active monitor-hour; webhook delivery is included.

Replay monitor events

Call GET /api/v1/events when a receiver missed webhook delivery or a downstream queue needs replay. Store event_id, type, monitor_id, monitor_type, occurred_at, has_more, and next_cursor. Use cursor for the next page.
Do not upload media before posting tweets or replies when the media is already public. POST /api/v1/x/tweets rejects media_ids with 400 unsupported_field; pass up to 4 public image URLs or exactly 1 public MP4 video URL up to 100 MB in media instead. Reserve uploaded media_id values for direct messages.
Look up known tweet IDs
GET /api/v1/x/tweets is available in both the full and paid_reads catalogs. Send at most 100 tweet IDs.
Subscribe (free, returns checkout or billing portal URL)
Run this mutation only after the user explicitly asks to subscribe or open billing.

API endpoints

The REST API documents 129 operations. The full MCP catalog exposes 118 across 10 categories:

Account, composition, and credits

20 MCP operations across account, composition, and credits: account info, subscribe, X identity, compose, styles, drafts, radar, balance checks, checkout creation, and checkout status.

Extractions and media

9 operations across extraction and media: giveaway draws, extraction jobs, estimates, and media download.

Monitoring and webhooks

19 operations in monitoring: account monitors, keyword monitors, stored events, webhooks, deliveries, and test delivery.

Support

5 operations in support: create, list, read, reply, and close tickets.

Tweets, profiles & followers

38 operations in twitter: batch and single tweet lookup, tweet search, article lookup, user lookup, follow checks, trends, bookmarks, notifications, timeline, DM history, likes, media, followers, replies, communities, and lists.

X accounts and writes

27 operations across x-accounts and x-write: connect accounts, resolve challenges, post tweets, like, retweet, follow, remove followers, send DMs, upload media, update profiles, and manage communities.
With a guest paid_reads key, search and execute expose exactly 33 twitter GET operations. The docs tool remains available. Use the guest paid-read route inventory as the public route list.

Cost summary

Always free discovery

docs and search are free. They return documentation and API contract details.

Free account and stored records

Compose, cached styles, drafts, radar, subscribe, account, support, credits, X account management, webhooks, stored monitors, stored events, and existing extraction or draw reads are free.

Metered reads and jobs

Tweet search, user lookup, follow checks, media download, trends, extraction creation, and draw creation are metered.

Monitor billing

Active monitors cost 21 credits per monitor-hour. Creating one requires enough available credits.

Write actions

Tweet, reply, like, retweet, follow, DM, profile, community, and media upload writes are metered.

Metered refreshes

Fresh style analysis after the 7-day cache window requires enough available credits.
Never combine free and paid endpoints in a single Promise.all. A 402 error on one call kills all results. Call free endpoints first, then paid ones separately.

Error handling

  • 402 / no_subscription / subscription_inactive. Report the billing state and available account actions. Existing available credits can still fund metered calls. Ask the user to choose and confirm before calling POST /api/v1/subscribe.
  • 402 / no_credits / insufficient_credits. Report payment_options. Full account sessions may create account checkout after confirmation. Guest sessions may explain the direct REST top-up flow, but MCP cannot execute it.
  • 429 / rate_limit_exceeded. Respect error.retry_after, then retry safe reads with backoff.
  • 424 dependency errors. Report error.code, preserve partial aggregates, and retry only when error.retryable allows it.
  • Validation errors. Fix the path, query, or body before retrying.
The MCP server never starts subscriptions, checkout, top-up, or other billing mutations in response to an API error. Guest credential routes are never executable through MCP.