X Just Shipped an MCP Server. It Exposes 131 Tools With Zero Access Control. (opens in new tab)

X (formerly Twitter) just released xmcp, an official MCP server that wraps the entire X API v2. It is the largest social media platform to ship a first-party MCP integration, and it exposes 131 tools to any connected agent. That includes createPosts, sendChatMessage, followUser, repostPost, deletePosts, and createDirectMessagesByParticipantId. Every one of those tools is available to every connected agent, with no permissions model, no scoping, and no rate limiting at the MCP layer. What the ...