Publish MCP 2026-07-28 Skill release

.claude-plugin/marketplace.json

@@ -5,15 +5,15 @@
     "email": "support@xquik.com"
   },
   "metadata": {
-    "description": "Xquik Skill for 127 REST operations and 119 MCP catalog routes. Two MCP tools support 118 JSON or text operations. Not affiliated with X Corp.",
-    "version": "2.5.6"
+    "description": "Xquik Skill for 128 REST operations and 120 MCP catalog routes. Two MCP tools support 119 JSON or text operations. Not affiliated with X Corp.",
+    "version": "2.6.0"
   },
   "plugins": [
     {
       "name": "x-twitter-scraper",
       "source": "./",
-      "description": "127 REST operations, 119 MCP catalog routes, 23 extraction types, SDKs, webhooks, exports, and confirmation-gated writes. Two MCP tools support 118 JSON or text operations. Not affiliated with X Corp.",
-      "version": "2.5.6",
+      "description": "128 REST operations, 120 MCP catalog routes, 23 extraction types, SDKs, webhooks, exports, and confirmation-gated writes. Two MCP tools support 119 JSON or text operations. Not affiliated with X Corp.",
+      "version": "2.6.0",
       "author": {
         "name": "Xquik"
       },

.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "x-twitter-scraper",
-  "version": "2.5.6",
-  "description": "Xquik Skill and plugin bundle. Includes 127 REST operations. MCP has 119 catalog routes through 2 tools; 118 support JSON or text. Not affiliated with X Corp.",
+  "version": "2.6.0",
+  "description": "Xquik Skill and plugin bundle. Includes 128 REST operations. MCP has 120 catalog routes through 2 tools; 119 support JSON or text. Not affiliated with X Corp.",
   "author": {
     "name": "Xquik",
     "url": "https://github.com/Xquik-dev"

.codex-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "x-twitter-scraper",
-  "version": "2.5.6",
-  "description": "Xquik Skill and plugin bundle. Includes 127 REST operations. MCP has 119 catalog routes through 2 tools; 118 support JSON or text. Not affiliated with X Corp.",
+  "version": "2.6.0",
+  "description": "Xquik Skill and plugin bundle. Includes 128 REST operations. MCP has 120 catalog routes through 2 tools; 119 support JSON or text. Not affiliated with X Corp.",
   "author": {
     "name": "Xquik",
     "url": "https://github.com/Xquik-dev"
@@ -38,7 +38,7 @@
   "interface": {
     "displayName": "X Twitter Scraper",
     "shortDescription": "Use Xquik for X data, MCP, SDKs, and gated actions. Not affiliated with X Corp.",
-    "longDescription": "Guide agents through 127 Xquik REST operations, 119 MCP catalog routes, SDKs, webhooks, exports, and confirmed actions. Two MCP tools support 118 JSON or text operations. Not affiliated with X Corp.",
+    "longDescription": "Guide agents through 128 Xquik REST operations, 120 MCP catalog routes, SDKs, webhooks, exports, and confirmed actions. Two MCP tools support 119 JSON or text operations. Not affiliated with X Corp.",
     "developerName": "Xquik",
     "category": "Productivity",
     "composerIcon": "./assets/icon.svg",

CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+
+All notable public changes appear in this file.
+
+## [2.6.0] - 2026-07-30
+
+### Added
+
+- Document MCP `2026-07-28` negotiation through `server/discover`.
+- Add private cache guidance for discovery and tool catalogs.
+- Add complete safe tweet, profile, and media field guidance.
+- Add reply coverage and fallback guidance.
+
+### Changed
+
+- Update public metadata to 128 REST operations.
+- Update MCP metadata to 120 authenticated catalog routes.
+- Keep stateless 2025-era MCP clients compatible.
+- Require estimates and approval before bulk reply extraction.
+- Make incomplete-reply search fallback directly executable.
+- Default top-reply requests to 10 results when unspecified.
+- Align documented tweet authors with the public response contract.
+
+### Security
+
+- Exclude fetching-account action and permission state from general reads.
+- Return follow relationships only from explicit relationship checks.
+- Refresh SkillSpector v2.3.7 evidence with 0 findings.
+
+[2.6.0]: https://github.com/Xquik-dev/x-twitter-scraper/releases/tag/v2.6.0

README.md

@@ -33,9 +33,18 @@ This repository packages Xquik as an [AI agent Skill](https://skills.sh). It wor
 
 The npm package `x-developer` contains this Skill and plugin bundle. The separate `x-twitter-scraper` package is the TypeScript SDK.
 
-Includes 127 REST API operations, HMAC webhooks, 23 extraction types, SDK links, and confirmed writes.
-
-MCP v2.5.6 exposes 119 catalog routes through 2 tools. Of these, 118 support JSON or text. Binary support downloads use REST. Add `https://xquik.com/mcp`. Then follow the [client compatibility guide](https://docs.xquik.com/mcp/overview#client-compatibility). OAuth-capable clients use OAuth 2.1. API-key fallback depends on the client. ChatGPT custom apps require OAuth. Eight credential or session operations remain outside MCP.
+Includes 128 REST API operations, HMAC webhooks, 23 extraction types, SDK links, and confirmed writes.
+
+MCP v2.6.0 exposes 120 catalog routes through 2 tools.
+Of these, 119 support JSON or text. Binary support downloads use REST. Add
+`https://xquik.com/mcp`. Current clients negotiate MCP `2026-07-28` through
+`server/discover`. The SDK adds request metadata and headers automatically.
+Modern calls need no initialization session. Stateless 2025-era clients remain
+compatible. Follow the
+[client compatibility guide](https://docs.xquik.com/mcp/overview#client-compatibility).
+OAuth-capable clients use OAuth 2.1. API-key fallback depends on the client.
+ChatGPT custom apps require OAuth. Eight credential, checkout, or guest-wallet
+operations remain outside MCP.
 
 > **Codex OAuth compatibility:** Affected Codex releases discard the RFC 9207 `iss` callback value even though Xquik returns it. If Codex reports `Authorization server response missing required issuer: expected https://xquik.com`, use `XQUIK_API_KEY` through the Codex `bearer_token_env_var` setting. Follow the [Codex OAuth troubleshooting guide](https://docs.xquik.com/guides/troubleshooting#codex-oauth-issuer-validation-error) and track [openai/codex#31573](https://github.com/openai/codex/issues/31573).
 
@@ -200,14 +209,14 @@ When installed, this skill gives your AI coding assistant deep knowledge of the
 - **Tweet composition**: Algorithm-optimized tweet composer with scoring
 - **Usage guardrails**: Check balance and estimate usage; dashboard handles plan and credit changes
 - **Support tickets**: Open and manage support tickets via API
-- **MCP server**: MCP v2.5.6 exposes 119 catalog routes through 2 tools. 118 support JSON or text
+- **MCP server**: MCP v2.6.0 supports `server/discover`, 120 catalog routes, and 119 JSON or text routes
 
 ## Capabilities
 
 | Area | Details |
 |------|---------|
-| **REST API** | 127 OpenAPI-backed operations with pagination and documented errors |
-| **MCP Server** | 119 catalog routes through `explore` and `xquik`. 118 support JSON or text |
+| **REST API** | 128 OpenAPI-backed operations with pagination and documented errors |
+| **MCP Server** | 120 catalog routes through `explore` and `xquik`. 119 support JSON or text |
 | **Data Extraction** | 23 bulk extraction tools (replies, retweets, quotes, favoriters, threads, articles, user likes, user media, communities, lists, Spaces, people search, tweet search, mentions, posts) |
 | **X Lookups** | Tweet, user, article, search, user tweets, user likes, user media, favoriters, mutual followers, and confirmation-gated private reads |
 | **Write Actions** | Confirmation-gated post/delete tweets, like/unlike, retweet, follow/unfollow, remove followers, DM, profile update, avatar/banner, media upload, community actions |

docker-mcp-registry/cyrus-submission-steps.md

@@ -22,7 +22,7 @@ Skills appear to be indexed from GitHub repos via a curation process. Options:
    - **Skill path**: skills/x-twitter-scraper/SKILL.md
    - **Install command**: `npx skills@1.5.3 add Xquik-dev/x-twitter-scraper`
    - **Category**: Development (or Data & APIs)
-   - **Description**: X data platform Skill for developers and agents. 127 REST operations and 119 MCP catalog routes through 2 tools. 118 support JSON or text. Includes HMAC webhooks.
+   - **Description**: X data platform Skill for developers and agents. 128 REST operations and 120 MCP catalog routes through 2 tools. 119 support JSON or text. Includes HMAC webhooks.
 
 ### Option B: Open GitHub Issue
 

docker-mcp-registry/xquik-remote/server.yaml

@@ -13,7 +13,7 @@ meta:
     - remote
 about:
   title: Xquik
-  description: X data platform with 127 REST operations and 119 MCP catalog routes through 2 tools. 118 support JSON or text. Not affiliated with X Corp.
+  description: X data platform with 128 REST operations and 120 MCP catalog routes through 2 tools. 119 support JSON or text. Not affiliated with X Corp.
   icon: https://www.google.com/s2/favicons?domain=xquik.com&sz=64
 source:
   project: https://github.com/Xquik-dev/x-twitter-scraper

docker-mcp-registry/xquik-remote/tools.json

@@ -12,7 +12,7 @@
   },
   {
     "name": "xquik",
-    "description": "Send confirmed Xquik API requests across 119 MCP catalog routes. 118 support JSON or text. Covers search, lookup, extraction, writes, monitoring, draws, trends, and composition.",
+    "description": "Send confirmed Xquik API requests across 120 MCP catalog routes. 119 support JSON or text. Covers search, lookup, extraction, writes, monitoring, draws, trends, and composition.",
     "arguments": [
       {
         "name": "code",

mcpize/SUBMISSION-STEPS.md

@@ -10,8 +10,8 @@ that points at the existing endpoint.
 - Server URL: `https://xquik.com/mcp`
 - Transport: Streamable HTTP
 - Repository: `https://github.com/Xquik-dev/x-twitter-scraper`
-- Version: `2.5.6`
-- Description: `X data platform with 127 REST operations and 119 MCP catalog routes through 2 tools. 118 support JSON or text. Includes webhooks, SDKs, and confirmed writes. Not affiliated with X Corp.`
+- Version: `2.6.0`
+- Description: `128 REST operations. 120 MCP routes; 119 JSON/text ops. OAuth 2.1. Not affiliated with X Corp.`
 - Categories: Social Media, Automation, Search, Data, Monitoring, Web Scraping, AI Agents
 - Authentication: OAuth 2.1 discovery
 - Protected resource metadata: `https://xquik.com/.well-known/oauth-protected-resource/mcp`

openclaw.plugin.json

@@ -1,8 +1,8 @@
 {
   "id": "x-developer",
   "name": "X Developer API",
-  "description": "Xquik Skill with 127 REST operations and 119 MCP catalog routes. Two MCP tools support 118 JSON or text operations. Includes SDKs, webhooks, exports, and gated actions. Not affiliated with X Corp.",
-  "version": "2.5.6",
+  "description": "Xquik Skill with 128 REST operations and 120 MCP catalog routes. Two MCP tools support 119 JSON or text operations. Includes SDKs, webhooks, exports, and gated actions. Not affiliated with X Corp.",
+  "version": "2.6.0",
   "skills": ["./skills"],
   "providerAuthEnvVars": {
     "xquik": ["XQUIK_API_KEY"]

package.json

@@ -1,6 +1,6 @@
 {
   "name": "x-developer",
-  "version": "2.5.6",
+  "version": "2.6.0",
   "description": "Xquik agent skill & plugin bundle for REST, MCP, webhooks, exports & confirmation-gated X workflows. Not affiliated with X Corp.",
   "author": {
     "name": "Xquik",
@@ -59,6 +59,7 @@
     ".codex-plugin",
     ".claude-plugin",
     ".mcp.json",
+    "CHANGELOG.md",
     "assets",
     "commands",
     "context7.json",

scripts/release-guard/content-policy.mjs

@@ -21,9 +21,13 @@ export const contentChecks = [
   {
     path: "README.md",
     required: [
-      "127 REST API operations",
-      "MCP v2.5.6 exposes 119 catalog routes through 2 tools.",
-      "118 support JSON or text.",
+      "128 REST API operations",
+      "MCP v2.6.0 exposes 120 catalog routes through 2 tools.",
+      "119 support JSON or text.",
+      "MCP `2026-07-28` through",
+      "`server/discover`",
+      "Eight credential, checkout, or guest-wallet",
+      "operations remain outside MCP.",
       "## Agent Safety And Account Boundary",
       "Plan and credit changes stay in the Xquik dashboard.",
       "The npm package `x-developer` contains this Skill and plugin bundle. The separate `x-twitter-scraper` package is the TypeScript SDK.",
@@ -50,6 +54,19 @@ export const contentChecks = [
       blocked("M", "PP"),
     ],
   },
+  {
+    path: "CHANGELOG.md",
+    required: [
+      "## [2.6.0] - 2026-07-30",
+      "MCP `2026-07-28`",
+      "`server/discover`",
+      "120 authenticated catalog routes",
+      "fetching-account action and permission state from general reads",
+      "follow relationships only from explicit relationship checks",
+      "Refresh SkillSpector v2.3.7 evidence with 0 findings",
+    ],
+    forbidden: [dollarDenominatedPricing],
+  },
   {
     path: "package.json",
     required: [
@@ -61,14 +78,15 @@ export const contentChecks = [
       '"stub-server.mjs"',
       '"server.json"',
       '"skills.sh.json"',
+      '"CHANGELOG.md"',
     ],
     forbidden: [blocked("pay-", "per-use")],
   },
   {
     path: "skills/x-twitter-scraper/SKILL.md",
     required: [
       'Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.',
-      "127 OpenAPI-documented REST operations",
+      "128 OpenAPI-documented REST operations",
       "Some operations consume usage credits",
       "Read (300/1s), Write (120/60s), Delete (60/60s)",
       "Plan and credit changes are dashboard-only",
@@ -130,9 +148,11 @@ export const contentChecks = [
     required: [
       "https://xquik.com/mcp",
       "OpenAI Agents SDK",
-      "119 catalog routes through 2 structured API tools",
-      "118 support JSON or text",
-      "catalogs 119 of 127 documented REST operations",
+      "120 catalog routes through 2 structured API tools",
+      "119 support JSON or text",
+      "catalogs 120 of 128 documented REST operations",
+      "Current clients negotiate MCP `2026-07-28`",
+      "Modern calls need no `initialize` request or session ID.",
       "https://docs.xquik.com/mcp/overview#client-compatibility",
       "gemini mcp add --transport http xquik https://xquik.com/mcp",
       '"type": "http"',
@@ -153,8 +173,10 @@ export const contentChecks = [
       "| `explore` | Search the API endpoint catalog (read-only, no network calls) | Included |",
       "Included usage flag from endpoint metadata",
       "Find all included-usage endpoints",
-      "MCP v2.5.6 catalogs 119 of 127 REST operations",
-      "118 support JSON or text",
+      "MCP v2.6.0 catalogs 120 of 128 REST operations",
+      "119 support JSON or text",
+      "MCP v2.6.0 supports `2026-07-28` through `server/discover`.",
+      "These 8 credential, checkout, or guest-wallet operations remain outside MCP:",
       "Saved-payment top-ups",
       "Dashboard checkout redirects",
     ],
@@ -174,7 +196,7 @@ export const contentChecks = [
   },
   {
     path: ".claude-plugin/plugin.json",
-    required: ["119 catalog routes through 2 tools", "118 support JSON or text"],
+    required: ["120 catalog routes through 2 tools", "119 support JSON or text"],
     forbidden: [
       "113 endpoints",
       "112 endpoints",
@@ -186,9 +208,9 @@ export const contentChecks = [
   {
     path: ".codex-plugin/plugin.json",
     required: [
-      "127 REST operations",
-      "119 MCP catalog routes",
-      "118 JSON or text operations",
+      "128 REST operations",
+      "120 MCP catalog routes",
+      "119 JSON or text operations",
     ],
     forbidden: ["100+ endpoints", dollarDenominatedPricing],
   },
@@ -236,9 +258,9 @@ export const contentChecks = [
     path: "server.json",
     required: [
       '"title": "Xquik MCP Server"',
-      "127 REST operations",
-      "119 MCP routes",
-      "118 JSON/text ops",
+      "128 REST operations",
+      "120 MCP routes",
+      "119 JSON/text ops",
       '"websiteUrl": "https://docs.xquik.com/mcp/overview"',
     ],
     forbidden: [
@@ -251,8 +273,10 @@ export const contentChecks = [
   {
     path: "stub-server.mjs",
     required: [
-      "119 catalog routes",
-      "118 support JSON or text",
+      "120 catalog routes",
+      "119 support JSON or text",
+      '"server/discover"',
+      '"2026-07-28"',
       "This package stub returns setup guidance only.",
       "complete OAuth 2.1 for live API access",
       "included usage or requires account access",

scripts/release-guard/repository-checks.mjs

@@ -37,6 +37,16 @@ const publicContractFiles = [
 ];
 
 const stalePublicContractPatterns = [
+  [
+    "127-operation REST count",
+    /\b127 (?:OpenAPI-documented )?REST(?: API)? operations\b/u,
+  ],
+  [
+    "119-route MCP count",
+    /\b(?:119 MCP (?:catalog )?routes|119 catalog routes through|119-route API catalog|catalogs 119 of \d+)\b/iu,
+  ],
+  ["118 JSON or text count", /\b118 (?:support |JSON\/text|JSON or text)/u],
+  ["MCP v2.5.6", /\bMCP v2\.5\.6\b/u],
   ["126-operation REST count", /\b126 REST(?: API)? operations\b/u],
   ["ambiguous 118-operation MCP count", /\b118 (?:MCP )?operations\b/u],
   ["118-of-126 MCP count", /\b118 of 126\b/u],
@@ -153,6 +163,7 @@ function collectPackageFileDrifts() {
     ".mcp.json",
     ".claude-plugin/plugin.json",
     ".codex-plugin/plugin.json",
+    "CHANGELOG.md",
     "commands/post.md",
     "task-guides/search-tweets.md",
     "server.json",

server.json

@@ -2,13 +2,13 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "com.xquik/mcp",
   "title": "Xquik MCP Server",
-  "description": "127 REST operations. 119 MCP routes; 118 JSON/text ops. OAuth 2.1. Not affiliated with X Corp.",
+  "description": "128 REST operations. 120 MCP routes; 119 JSON/text ops. OAuth 2.1. Not affiliated with X Corp.",
   "repository": {
     "url": "https://github.com/Xquik-dev/x-twitter-scraper",
     "source": "github"
   },
   "websiteUrl": "https://docs.xquik.com/mcp/overview",
-  "version": "2.5.6",
+  "version": "2.6.0",
   "icons": [
     {
       "src": "https://xquik.com/icons/mcp/xquik.png",