Twitter MCP (twikit)
Searches Twitter and reads timelines via twikit without the paid API, using account credentials for access.
Delv Safety Grade: D
Score 42/100 · assessed 2026-04-28
This community MCP server bypasses Twitter's official API by using twikit, a scraping library that authenticates with your actual Twitter account credentials. The maintainer appears to be a solo developer with limited public profile. The server requires your Twitter username, email, and password as environment variables, which presents credential exposure risk if the MCP host or any other component is compromised. Installation is via git clone rather than a versioned package registry, making supply chain verification harder. The approach violates Twitter's terms of service, which could result in account suspension. While the code is open source and the functionality is straightforward (read-only Twitter operations), the combination of credential handling, ToS violation risk, and sparse maintenance creates meaningful safety concerns for production use.
Lethal Trifecta (prompt-injection exposure)
TWO OF THREEPublic tweets and replies are untrusted; outbound on every post. Account takes care of one private leg in some configs.
Green flags
- Open source code allows credential handling inspection
- Read-only operations limit potential damage scope
- No known security incidents or malicious behaviour
- Clear documentation of required credentials
Red flags
- Requires full Twitter account credentials stored in environment variables
- Violates Twitter ToS, risking account suspension or legal action
- Solo maintainer with limited public track record
- Git-only install bypasses package registry verification
- Scraping approach may break without warning if Twitter changes defences
Permissions requested
Install
uvx --from git+https://github.com/adhikasp/mcp-twikit mcp-twikit
TWITTER_USERNAMETWITTER_EMAILTWITTER_PASSWORDReview
Install this if you need occasional Twitter data and can't justify API costs. Skip it if you're doing production work, need high volume, or aren't comfortable sharing account credentials. A dedicated research account is essential.
Good at
- No API costs, which matters for occasional research or personal projects where Twitter's pricing doesn't make sense.
- Straightforward authentication via account credentials rather than navigating OAuth flows and developer portals.
- Handles common workflows like keyword search, user timelines, and thread retrieval without extra configuration.
- Useful for archival work where you need to snapshot conversations before deletion or account suspension.
Watch out
- Requires trusting the server process with your Twitter login credentials, which is a security trade-off.
- Rate limits hit faster than official API clients, typically around 300 tweets before temporary blocks kick in.
- Authentication can fail if Twitter triggers email verification or CAPTCHA, requiring manual browser login to clear flags.
- No graceful pagination handling, so large requests need manual chunking to avoid errors or blocks.
Use cases
- Twitter research
- sentiment analysis
- competitor tracking
- archival workflows
Getting started
Works with
Similar MCPs
- Bluesky Social MCPFull Bluesky control over the atproto client, covering profiles, feeds, posts, follows, and interactions.
- TwilioSend SMS, manage phone numbers, query call logs. The standard for voice/SMS workflows from inside an agent.
- GmailRead, search, send, label Gmail messages from Claude. Note: original repo archived March 2026; community forks may be more current.
- ResendResend's official MCP for transactional email. Send, list, schedule from Claude — straightforward, fast, well-documented.