@assemblyline-agents/x

Official Assembly Line direct X API connection plugin. It calls X API v2 from the runtime host and does not use MCP.

Install and configure

assembly-line add x agent

This creates connections/x.ts:

import { defineXConnection } from "@assemblyline-agents/x";

export default defineXConnection({
  // Reviewed reads and publishing are enabled by default.
});

Create a confidential OAuth 2.0 App in the X Developer Console. Enable User authentication with Authorization Code + PKCE, then set:

X_API_CLIENT_ID=your_client_id
X_API_CLIENT_SECRET=your_client_secret

Register the exact Assembly Line callback URL in the X App. It is the public runtime origin followed by /assembly-line/connections/callback. Set X_API_REDIRECT_URI only when the connection should override the runtime's derived callback URL.

The full reviewed surface requests bookmark.read, tweet.read, tweet.write, users.read, and offline.access. The host uses PKCE, authenticates the confidential client at X's token endpoint, and stores refreshable user grants outside agent files and model context.

Reviewed surface

Read tools return the connected account and its private bookmarks. Bookmark pages include author, referenced-post, note-post, article, and media context. The only write tool creates a text post or reply, with an optional provider reply setting. Arbitrary X mutations, bookmark changes, post deletion, and media upload remain unavailable until they receive an explicit tool contract and access classification.

Use the read-only preset to hide publishing and omit tweet.write from OAuth:

export default defineXConnection({ access: "read-only" });

Use access: "approval-required" to require approval for each post or reply. X API reads may be metered, so callers should avoid unnecessary repeated bookmark scans.

Official references:

• OAuth 2.0 Authorization Code with PKCE
• Get bookmarks
• Create a post

License

MIT