
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@xquik/tweetclaw
Advanced tools
OpenClaw plugin for Twitter search, follower exports, monitoring, media, and approved X automation through structured Xquik endpoints. Not affiliated with X Corp.
Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.
TweetClaw connects OpenClaw to Xquik for Twitter search, follower exports, monitoring, media, and approved X actions. Use Xquik MCP with remote MCP clients and an SDK in application code.
Use explore before every live call. It returns the current supported route.
| Customer Question | Catalog Query | Next Step |
|---|---|---|
| How can I search tweets? | search tweets by query | Call the listed read route. |
| How can I read an X timeline? | list recent tweets posted by a user | Approve private timelines. |
| How can I export followers? | run extraction | Choose followers, then approve. |
| How can I scrape following accounts? | run extraction | Choose following, then approve. |
| How can I monitor an account or keyword? | create monitor | Approve recurring usage. |
| How can I post or reply? | create tweet | Approve each write. |
TweetClaw keeps every allowed Xquik response field. Optional fields remain absent
when X omits them. Request next_cursor while has_next_page is true.
Fetching-account bookmark, like, follow, block, mute, and notification state stays private.
See Read Data Richness for exact tweet, profile, and media fields.
openclaw plugins install clawhub:@xquik/tweetclaw
OpenClaw records the verified ClawHub publisher scope and package as the update source.
Use openclaw plugins install npm:@xquik/tweetclaw when you need the npm fallback.
For normal upgrades, reuse the tracked install source:
openclaw plugins update tweetclaw
For reproducible production installs, pin a published npm version:
openclaw plugins install npm:@xquik/tweetclaw@<version> --pin
Pinned installs stay pinned during updates. Run
openclaw plugins update @xquik/tweetclaw to return to the stable release line.
Source builds require OpenClaw 2026.7.1 or newer.
If your OpenClaw install runs with OPENCLAW_NIX_MODE=1, plugin lifecycle
mutators are disabled. Install or update TweetClaw through your Nix OpenClaw
source instead of openclaw plugins install or openclaw plugins update.
Install TweetClaw before adding credentials if needed. The free explore
catalog works immediately; live calls return setup guidance.
Agents with skill directories can install the packaged SKILL.md through
Skills.sh. Use the OpenClaw command
above for the plugin runtime.
npx skills add xquik-dev/tweetclaw
TweetClaw is an OpenClaw plugin, not an MCP server. For remote MCP clients, add
https://xquik.com/mcp, then follow the current client compatibility
path. OAuth-capable
clients complete OAuth 2.1. Clients that support custom bearer headers can use
an Xquik API key. ChatGPT custom apps require OAuth.
Codex OAuth compatibility: Affected Codex releases discard the RFC 9207
isscallback value even though Xquik returns it. If Codex reportsAuthorization server response missing required issuer: expected https://xquik.com, useXQUIK_API_KEYthrough the Codexbearer_token_env_varsetting. Follow the Codex OAuth troubleshooting guide and track openai/codex#31573.
TweetClaw uses Xquik billing for account-backed automation and optional MPP reads. See Billing & Pricing. Check it for current plans, eligible endpoints, and live prices.
Create an API key at dashboard.xquik.com, then store it through OpenClaw:
openclaw config set plugins.entries.tweetclaw.config.apiKey "$XQUIK_API_KEY"
Keep the key out of chats, documentation, logs, and shell history.
Top up credits from the Xquik dashboard. An API key can spend prepaid credits across 33 public paid-read routes without a subscription. TweetClaw does not create checkout sessions or charge saved payment methods from the agent.
Machine Payments Protocol (MPP) covers 7 direct MPP routes without an account,
API key, or subscription. Create an MPP account with mppx account create.
npm i mppx@0.8.12 viem@2.55.4
openclaw config set plugins.entries.tweetclaw.config.tempoSigningKey "$MPP_SIGNING_KEY"
Keep the signing key in local OpenClaw config. Never put it in prompts or logs.
Direct MPP covers tweet lookup, user lookup, follower check, article lookup, trends, X trends, and community info. Other paid reads use prepaid credits. Media downloads and galleries require account-backed access.
OpenClaw always loads the local explore catalog. The tweetclaw API tool is
optional because it can read private data, spend credits, or change X accounts.
Add both tools without replacing the current profile:
openclaw config set tools.alsoAllow '["explore", "tweetclaw"]'
Verify runtime registration and packed releases with the OpenClaw setup guide.
openclaw config set plugins.entries.tweetclaw.config.baseUrl "https://xquik.com"
openclaw config set plugins.entries.tweetclaw.config.pollingEnabled true
openclaw config set plugins.entries.tweetclaw.config.pollingInterval 60
Only change baseUrl for a self-hosted Xquik-compatible API. TweetClaw requires an HTTPS base URL with no embedded credentials.
TweetClaw uses 2 OpenClaw gates:
explore is always safe local catalog search, while
tweetclaw stays optional until the user allows it with tools.alsoAllow.These gates prevent unattended publishing. Examples include Twitter search before drafting, reply review before draws, follower exports, approved media posts, user-created monitors, and reviewed webhook automation.
explore (free, no network)Search the bundled API catalog without a network request.
tweetclaw (invoke API endpoints)Invoke catalog-listed endpoints with structured fields. The runtime injects
authentication. X writes also require idempotencyKey.
This tool is optional in OpenClaw. If your agent can see the skill but cannot call TweetClaw tools, add explore and tweetclaw to tools.alsoAllow so your normal tool profile stays intact.
OpenClaw approval prompts are enforced before write-like tweetclaw tool calls. Review the structured request before approving any post, delete, follow, DM, monitor, extraction, webhook, or profile-change action. Risky calls offer one-time approval or deny so future social-account actions still require review.
Instant responses, no LLM needed:
| Command | Description |
|---|---|
/xstatus | Account info, subscription status, usage, credit balance |
/xtrends | Curated topics with an API key. Worldwide X trends with MPP. |
/xtrends tech | API-key mode: curated topics in one category. |
/xtrends 23424977 | MPP mode: X trends for one WOEID. |
When polling is enabled, TweetClaw checks user-created monitors every 60 seconds and delivers new tweet, reply, quote, or retweet events.
Set up a monitor first:
You: "Monitor @elonmusk for new tweets, replies, and retweets"
102 agent-callable endpoints across 9 categories. Dashboard-only flows stay blocked.
| Category | Examples | Access |
|---|---|---|
| Account | Account status | Account-backed |
| Composition | Compose, drafts, writing styles, radar | Account-backed |
| Credits | Check balance | Account-backed |
| Extraction | 23 extraction tools, giveaway draws, exports | Account-backed |
| Media | Upload media via URL, authenticated media download, gallery links | Account-backed |
| Monitoring | Create monitors, view events, manage webhooks | Account-backed |
| Search, lookups, timelines, articles, trends, bookmarks, notifications | Account-backed or MPP where eligible | |
| X Accounts | List connected account handles for explicit user-selected actions | Account-backed |
| X Write | Post, reply, like, retweet, follow, remove follower, DM, profile, communities | Account-backed with approval |
MIT
Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.
FAQs
OpenClaw plugin for Twitter search, follower exports, monitoring, media, and approved X automation through structured Xquik endpoints. Not affiliated with X Corp.
The npm package @xquik/tweetclaw receives a total of 185 weekly downloads. As such, @xquik/tweetclaw popularity was classified as not popular.
We found that @xquik/tweetclaw demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.