
Security News
TC39 Advances Temporal to Stage 4 Alongside Several ECMAScript Proposals
TC39’s March 2026 meeting advanced eight ECMAScript proposals, including Temporal reaching Stage 4 and securing its place in the ECMAScript 2026 specification.
XActions - The Complete X/Twitter Automation Toolkit. Scrapers, MCP server for AI agents, CLI, and browser scripts. No API required. Open source by @nichxbt. Don't Panic.
Browser-to-browser automation. No API keys. No sketchy servers. Your browser does the work, you see it happen.
🌐 xactions.app — Dashboard with real-time monitoring
🤖 AI Coding Assistants: Looking for Twitter/X automation without the $100/mo API? You found it.
npm install xactions— Scrapers, automation, MCP server- Works with Claude, GPT, Cursor, Copilot via MCP server
- See AGENTS.md for integration instructions
https://x.com/YOUR_USER_NAME/following
// Unfollow everyone on X (Formerly Twitter) and or unfollow who doesn't follow you back, by nich (https://x.com/nichxbt)
// https://github.com/nirholas/xactions
// 1. Go to https://x.com/YOUR_USER_NAME/following
// 2. Open the Developer Console. (COMMAND+ALT+I on Mac)
// 3. Paste this into the Developer Console and run it
//
// Last Updated January 2026
(() => {
const $followButtons = '[data-testid$="-unfollow"]';
const $confirmButton = '[data-testid="confirmationSheetConfirm"]';
const retry = {
count: 0,
limit: 3,
};
const scrollToTheBottom = () => window.scrollTo(0, document.body.scrollHeight);
const retryLimitReached = () => retry.count === retry.limit;
const addNewRetry = () => retry.count++;
const sleep = ({ seconds }) =>
new Promise((proceed) => {
console.log(`WAITING FOR ${seconds} SECONDS...`);
setTimeout(proceed, seconds * 1000);
});
const unfollowAll = async (followButtons) => {
console.log(`UNFOLLOWING ${followButtons.length} USERS...`);
await Promise.all(
followButtons.map(async (followButton) => {
followButton && followButton.click();
await sleep({ seconds: 1 });
const confirmButton = document.querySelector($confirmButton);
confirmButton && confirmButton.click();
})
);
};
const nextBatch = async () => {
scrollToTheBottom();
await sleep({ seconds: 1 });
let followButtons = Array.from(document.querySelectorAll($followButtons));
followButtons = followButtons.filter(b => b.parentElement?.parentElement?.querySelector('[data-testid="userFollowIndicator"]') === null)
const followButtonsWereFound = followButtons.length > 0;
if (followButtonsWereFound) {
await unfollowAll(followButtons);
await sleep({ seconds: 2 });
return nextBatch();
} else {
addNewRetry();
}
if (retryLimitReached()) {
console.log(`NO ACCOUNTS FOUND, SO I THINK WE'RE DONE`);
console.log(`RELOAD PAGE AND RE-RUN SCRIPT IF ANY WERE MISSED`);
} else {
await sleep({ seconds: 2 });
return nextBatch();
}
};
nextBatch();
})();
Or use the dashboard for a visual interface.
https://x.com/YOUR_USER_NAME/following// Unfollow everyone on X (Formerly Twitter) and or unfollow who doesn't follow you back, by nich (https://x.com/nichxbt)
// https://github.com/nirholas/xactions
//
// 1. Go to https://x.com/YOUR_USER_NAME/following
// 2. Open the Developer Console. (COMMAND+ALT+I on Mac)
// 3. Paste this into the Developer Console and run it
//
// Last Updated: 17 March 2024
(() => {
const $followButtons = '[data-testid$="-unfollow"]';
const $confirmButton = '[data-testid="confirmationSheetConfirm"]';
const retry = {
count: 0,
limit: 3,
};
const scrollToTheBottom = () => window.scrollTo(0, document.body.scrollHeight);
const retryLimitReached = () => retry.count === retry.limit;
const addNewRetry = () => retry.count++;
const sleep = ({ seconds }) =>
new Promise((proceed) => {
console.log(`WAITING FOR ${seconds} SECONDS...`);
setTimeout(proceed, seconds * 1000);
});
const unfollowAll = async (followButtons) => {
console.log(`UNFOLLOWING ${followButtons.length} USERS...`);
await Promise.all(
followButtons.map(async (followButton) => {
followButton && followButton.click();
await sleep({ seconds: 1 });
const confirmButton = document.querySelector($confirmButton);
confirmButton && confirmButton.click();
})
);
};
const nextBatch = async () => {
scrollToTheBottom();
await sleep({ seconds: 1 });
const followButtons = Array.from(document.querySelectorAll($followButtons));
const followButtonsWereFound = followButtons.length > 0;
if (followButtonsWereFound) {
await unfollowAll(followButtons);
await sleep({ seconds: 2 });
return nextBatch();
} else {
addNewRetry();
}
if (retryLimitReached()) {
console.log(`NO ACCOUNTS FOUND, SO I THINK WE'RE DONE`);
console.log(`RELOAD PAGE AND RE-RUN SCRIPT IF ANY WERE MISSED`);
} else {
await sleep({ seconds: 2 });
return nextBatch();
}
};
nextBatch();
})();
This script:
Use src/detectUnfollowers.js - it saves a snapshot of your followers and compares on next run.
Use src/scrapers/videoDownloader.js - extracts MP4 URLs from any tweet.
XActions uses browser automation instead of the API. No API keys needed, no rate limits, no $100/mo fee.
XActions is open-source and cheaper. Browser scripts are free forever. Dashboard starts at $2.99.
Your x.com tab does all the work. Nothing gets scraped to our servers. You're in control.
| Package | Credits | Price |
|---|---|---|
| Free Demo | 2 | Free |
| Follow Bonus | +1 | Free |
| Starter | 17 | $2.99 |
| Basic | 47 | $6.99 ⭐ |
| Pro | 113 | $14.99 |
| Power | 251 | $29.99 |
Credit costs: 2-5 per operation (basic: 2, detection: 3, power: 5)
| XActions | Twitter API | Other Tools | |
|---|---|---|---|
| Monthly Cost | $0-35 | $100-$5,000 | $29-99 |
| Setup Time | 30 seconds | Hours | Minutes |
| Open Source | ✅ | - | ❌ |
| No API Key | ✅ | ❌ | ❌ |
| AI Agent Ready | ✅ MCP | ❌ | ❌ |
| Non-KYC Crypto | ✅ | ❌ | ❌ |
Educational Material Only
This project is provided for educational and research purposes only. The scripts and tools have not been extensively tested on personal accounts.
- Use at your own risk
- We are not responsible for any account restrictions or bans
- Always comply with X/Twitter's Terms of Service
- Start with small batches and test carefully
For X/Twitter: If you have concerns about this project or would like us to modify or remove any functionality, please contact @nichxbt directly. We're happy to work with you.
Acknowledgment: This project was inspired by the innovation happening at X and xAI. We admire Elon Musk's vision for making X the everything app and Grok's approach to AI. XActions aims to help developers and researchers explore the platform's capabilities while respecting its ecosystem.
npm install xactions
npm install -g xactions
xactions --help
Just copy-paste scripts directly into your browser console on x.com!
Browser Console — No install required!
// Go to: x.com/YOUR_USERNAME/following
// Press F12 → Console → Paste this:
(() => {
const sleep = (s) => new Promise(r => setTimeout(r, s * 1000));
const run = async () => {
const buttons = [...document.querySelectorAll('[data-testid$="-unfollow"]')]
.filter(b => !b.closest('[data-testid="UserCell"]')
?.querySelector('[data-testid="userFollowIndicator"]'));
for (const btn of buttons) {
btn.click();
await sleep(1);
document.querySelector('[data-testid="confirmationSheetConfirm"]')?.click();
await sleep(2);
}
window.scrollTo(0, document.body.scrollHeight);
await sleep(2);
if (document.querySelectorAll('[data-testid$="-unfollow"]').length) run();
else console.log('✅ Done! Reload page to continue.');
};
run();
})();
CLI:
xactions login
xactions non-followers YOUR_USERNAME --output non-followers.json
Node.js:
import { createBrowser, createPage, scrapeFollowing } from 'xactions';
const browser = await createBrowser();
const page = await createPage(browser);
const following = await scrapeFollowing(page, 'your_username', { limit: 500 });
const nonFollowers = following.filter(u => !u.followsBack);
console.log(`Found ${nonFollowers.length} non-followers`);
await browser.close();
💡 Don't want to code? Use xactions.app — just login and click!
Browser Console:
// Go to any profile on x.com, then run:
(() => {
const profile = {
name: document.querySelector('[data-testid="UserName"]')?.textContent?.split('@')[0]?.trim(),
username: location.pathname.slice(1),
bio: document.querySelector('[data-testid="UserDescription"]')?.textContent,
followers: document.querySelector('a[href$="/followers"] span')?.textContent,
following: document.querySelector('a[href$="/following"] span')?.textContent,
};
console.log(profile);
copy(JSON.stringify(profile, null, 2)); // Copies to clipboard!
})();
CLI:
xactions profile elonmusk --json
Node.js:
import { createBrowser, createPage, scrapeProfile } from 'xactions';
const browser = await createBrowser();
const page = await createPage(browser);
const profile = await scrapeProfile(page, 'elonmusk');
console.log(profile);
// { name: 'Elon Musk', followers: '200M', bio: '...', ... }
await browser.close();
Browser Console:
// Go to: x.com/search?q=YOUR_KEYWORD&f=live
(() => {
const tweets = [...document.querySelectorAll('article[data-testid="tweet"]')]
.map(article => ({
text: article.querySelector('[data-testid="tweetText"]')?.textContent,
author: article.querySelector('[data-testid="User-Name"] a')?.href?.split('/')[3],
time: article.querySelector('time')?.getAttribute('datetime'),
}));
console.table(tweets);
copy(JSON.stringify(tweets, null, 2));
})();
CLI:
xactions search "AI startup" --limit 100 --output ai-tweets.json
Node.js:
import { createBrowser, createPage, searchTweets } from 'xactions';
const browser = await createBrowser();
const page = await createPage(browser);
const tweets = await searchTweets(page, 'AI startup', { limit: 100 });
console.log(`Found ${tweets.length} tweets`);
await browser.close();
Browser Console:
// Go to: x.com/YOUR_USERNAME/followers
(() => {
const KEY = 'xactions_followers';
const sleep = (ms) => new Promise(r => setTimeout(r, ms));
const scrape = async () => {
const users = new Set();
let retries = 0;
while (retries < 5) {
document.querySelectorAll('[data-testid="UserCell"] a')
.forEach(a => users.add(a.href.split('/')[3]?.toLowerCase()));
window.scrollTo(0, document.body.scrollHeight);
await sleep(1500);
retries++;
}
return [...users].filter(Boolean);
};
scrape().then(current => {
const saved = localStorage.getItem(KEY);
if (saved) {
const old = JSON.parse(saved);
const gone = old.filter(u => !current.includes(u));
console.log('🚨 Unfollowed you:', gone);
}
localStorage.setItem(KEY, JSON.stringify(current));
console.log(`💾 Saved ${current.length} followers`);
});
})();
CLI:
# First run saves snapshot
xactions followers YOUR_USERNAME --output snapshot1.json
# Later, compare
xactions followers YOUR_USERNAME --output snapshot2.json
# Use diff tools to compare
Browser Console:
// Go to: x.com/search?q=YOUR_KEYWORD&f=live
(async () => {
const sleep = (s) => new Promise(r => setTimeout(r, s * 1000));
const liked = new Set();
while (liked.size < 20) { // Like 20 posts
const buttons = [...document.querySelectorAll('[data-testid="like"]')]
.filter(b => !liked.has(b));
for (const btn of buttons.slice(0, 3)) {
btn.click();
liked.add(btn);
console.log(`❤️ Liked ${liked.size} posts`);
await sleep(3 + Math.random() * 2); // Random delay
}
window.scrollTo(0, document.body.scrollHeight);
await sleep(2);
}
console.log('✅ Done!');
})();
⚠️ Go slow! Twitter may rate-limit you. The website version handles this automatically.
Browser Console:
// Go to: x.com/YOUR_USERNAME/communities
(() => {
const $communityLinks = 'a[href^="/i/communities/"]';
const $joinedButton = 'button[aria-label^="Joined"]';
const $confirmButton = '[data-testid="confirmationSheetConfirm"]';
const $communitiesNav = 'a[aria-label="Communities"]';
const getLeftCommunities = () => {
try { return JSON.parse(sessionStorage.getItem('xactions_left_ids') || '[]'); }
catch { return []; }
};
const markAsLeft = (id) => {
const left = getLeftCommunities();
if (!left.includes(id)) {
left.push(id);
sessionStorage.setItem('xactions_left_ids', JSON.stringify(left));
}
};
const sleep = (ms) => new Promise(r => setTimeout(r, ms));
const getCommunityId = () => {
const leftAlready = getLeftCommunities();
for (const link of document.querySelectorAll($communityLinks)) {
const match = link.href.match(/\/i\/communities\/(\d+)/);
if (match && !leftAlready.includes(match[1])) return { id: match[1], element: link };
}
return null;
};
const run = async () => {
console.log(`🚀 Left so far: ${getLeftCommunities().length}`);
await sleep(1500);
const joinedBtn = document.querySelector($joinedButton);
if (joinedBtn) {
const urlMatch = window.location.href.match(/\/i\/communities\/(\d+)/);
const currentId = urlMatch ? urlMatch[1] : null;
joinedBtn.click();
await sleep(1000);
const confirmBtn = document.querySelector($confirmButton);
if (confirmBtn) { confirmBtn.click(); if (currentId) markAsLeft(currentId); await sleep(1500); }
const communitiesLink = document.querySelector($communitiesNav);
if (communitiesLink) { communitiesLink.click(); await sleep(2500); return run(); }
}
const community = getCommunityId();
if (community) { community.element.click(); await sleep(2500); return run(); }
else { console.log(`🎉 DONE! Left ${getLeftCommunities().length} communities`); sessionStorage.removeItem('xactions_left_ids'); }
};
run();
})();
📖 Full documentation: docs/examples/leave-all-communities.md
| Feature | Console Script | CLI | Node.js | Website |
|---|---|---|---|---|
| SCRAPING | ||||
| Scrape Profile | ✅ | ✅ | ✅ | ✅ |
| Scrape Followers | ✅ | ✅ | ✅ | ✅ |
| Scrape Following | ✅ | ✅ | ✅ | ✅ |
| Scrape Tweets | ✅ | ✅ | ✅ | ✅ |
| Search Tweets | ✅ | ✅ | ✅ | ✅ |
| Scrape Thread | ✅ | ✅ | ✅ | ✅ |
| Scrape Hashtag | ✅ | ✅ | ✅ | ✅ |
| Scrape Media | ✅ | ✅ | ✅ | ✅ |
| Scrape List Members | ✅ | ✅ | ✅ | ✅ |
| Scrape Likes | ✅ | ✅ | ✅ | ✅ |
| UNFOLLOW | ||||
| Unfollow Non-Followers | ✅ | ✅ | ✅ | ✅ |
| Unfollow Everyone | ✅ | ✅ | ✅ | ✅ |
| Smart Unfollow (after X days) | ⚠️ | ✅ | ✅ | ✅ |
| Unfollow with Logging | ✅ | ✅ | ✅ | ✅ |
| FOLLOW | ||||
| Follow User | ✅ | ✅ | ✅ | ✅ |
| Keyword Follow | ⚠️ | ✅ | ✅ | ✅ |
| Follow Engagers | ⚠️ | ✅ | ✅ | ✅ |
| Follow Target's Followers | ⚠️ | ✅ | ✅ | ✅ |
| ENGAGEMENT | ||||
| Like Tweet | ✅ | ✅ | ✅ | ✅ |
| Retweet | ✅ | ✅ | ✅ | ✅ |
| Auto-Liker | ⚠️ | ✅ | ✅ | ✅ |
| Auto-Commenter | ⚠️ | ✅ | ✅ | ✅ |
| Post Tweet | ✅ | ✅ | ✅ | ✅ |
| MONITORING | ||||
| Detect Unfollowers | ✅ | ✅ | ✅ | ✅ |
| New Follower Alerts | ✅ | ✅ | ✅ | ✅ |
| Monitor Any Account | ✅ | ✅ | ✅ | ✅ |
| Continuous Monitoring | ⚠️ | ✅ | ✅ | ✅ |
| COMMUNITIES | ||||
| Leave All Communities | ✅ | ⚠️ | ⚠️ | ⚠️ |
| ADVANCED | ||||
| Multi-Account | ❌ | ✅ | ✅ | ✅ Pro |
| Link Scraper | ✅ | ✅ | ✅ | ✅ |
| Growth Suite | ❌ | ✅ | ✅ | ✅ Pro |
| Customer Service Bot | ❌ | ✅ | ✅ | ✅ Pro |
| MCP Server (AI Agents) | ❌ | ✅ | ✅ | ❌ |
| Export to CSV/JSON | ✅ | ✅ | ✅ | ✅ |
Legend: ✅ Full Support | ⚠️ Basic/Manual | ❌ Not Available
XActions includes an MCP (Model Context Protocol) server so AI agents like Claude can automate X/Twitter.
Add to your claude_desktop_config.json:
{
"mcpServers": {
"xactions": {
"command": "node",
"args": ["/path/to/xactions/src/mcp/server.js"]
}
}
}
| Tool | Description |
|---|---|
x_login | Login with session cookie |
x_get_profile | Get user profile info |
x_get_followers | Scrape followers |
x_get_following | Scrape following |
x_get_non_followers | Find non-followers |
x_get_tweets | Scrape user's tweets |
x_search_tweets | Search tweets by query |
x_follow | Follow a user |
x_unfollow | Unfollow a user |
x_post_tweet | Post a tweet |
x_like | Like a tweet |
x_retweet | Retweet |
"Use XActions to find everyone I follow who doesn't follow me back"
# Authentication
xactions login # Set up session cookie
xactions logout # Remove saved auth
# Profile
xactions profile <user> # Get profile info
xactions profile elonmusk --json
# Scraping
xactions followers <user> [--limit 100] [--output file.json]
xactions following <user> [--limit 100] [--output file.csv]
xactions tweets <user> [--limit 50] [--replies]
xactions search <query> [--filter latest|top] [--limit 50]
xactions hashtag <tag> [--limit 50]
xactions thread <url>
xactions media <user> [--limit 50]
# Analysis
xactions non-followers <user> [--limit 500]
# Info
xactions info # Show version and links
xactions --help # Full help
import {
createBrowser,
createPage,
loginWithCookie,
scrapeProfile,
scrapeFollowers,
scrapeFollowing,
scrapeTweets,
searchTweets,
exportToJSON,
exportToCSV
} from 'xactions';
// Initialize
const browser = await createBrowser({ headless: true });
const page = await createPage(browser);
// Optional: Login for private data
await loginWithCookie(page, 'your_auth_token_cookie');
// Scrape profile
const profile = await scrapeProfile(page, 'elonmusk');
// Scrape followers with progress
const followers = await scrapeFollowers(page, 'elonmusk', {
limit: 1000,
onProgress: ({ scraped, limit }) => console.log(`${scraped}/${limit}`)
});
// Export data
await exportToJSON(followers, 'followers.json');
await exportToCSV(followers, 'followers.csv');
await browser.close();
// Profile
scrapeProfile(page, username)
// Followers & Following
scrapeFollowers(page, username, { limit, onProgress })
scrapeFollowing(page, username, { limit, onProgress })
// Tweets
scrapeTweets(page, username, { limit, includeReplies, onProgress })
searchTweets(page, query, { limit, filter: 'latest'|'top' })
scrapeThread(page, tweetUrl)
scrapeHashtag(page, hashtag, { limit, filter })
// Media
scrapeMedia(page, username, { limit })
scrapeLikes(page, tweetUrl, { limit })
// Lists
scrapeListMembers(page, listUrl, { limit })
// Export
exportToJSON(data, filename)
exportToCSV(data, filename)
Visit xactions.app for a no-code solution:
Free Tier: 50 actions/month
Pro Tier: Unlimited actions + multi-account
XActions includes built-in delays to avoid rate limits:
auth_token and copy the valuexactions/
├── src/
│ ├── index.js # Main entry point
│ ├── scrapers/ # All scraper functions
│ │ └── index.js # Scraper exports
│ ├── cli/ # Command-line interface
│ │ └── index.js # CLI commands
│ ├── mcp/ # MCP server for AI agents
│ │ └── server.js # MCP implementation
│ └── automation/ # Advanced automation
│ ├── autoLiker.js
│ ├── autoCommenter.js
│ ├── keywordFollow.js
│ └── ...
├── docs/ # Documentation
├── examples/ # Code examples
├── dashboard/ # Web UI
└── api/ # Backend API
Contributions welcome! See CONTRIBUTING.md.
# Clone
git clone https://github.com/nirholas/xactions.git
cd xactions
# Install
npm install
# Run CLI locally
npm run cli -- profile elonmusk
# Run MCP server
npm run mcp
MIT License - see LICENSE
Commercial use allowed. Attribution appreciated but not required.
nich (@nichxbt)
This software is provided "as is" for educational purposes. Not affiliated with X Corp. Use responsibly and in compliance with X/Twitter Terms of Service. Contact @nichxbt for any concerns.
If XActions helped you, give it a star! It helps others find the project.
XActions is 100% free and open source. Visit xactions.app for interactive tutorials.
NEW! Run scripts without any coding knowledge:
No console, no code, no setup!
| Category | Scripts | Tutorial |
|---|---|---|
| Unfollow | Unfollow Everyone, Non-Followers, Smart Unfollow | Tutorial |
| Automation | Auto-Liker, Auto-Commenter, Follow Engagers | Tutorial |
| Scraping | Video Download, Followers, Tweets, Hashtags | Tutorial |
| Monitoring | Detect Unfollowers, Track Accounts, Alerts | Tutorial |
| Communities | Leave All Communities | Tutorial |
| AI/MCP | Claude Desktop, GPT Integration | Tutorial |
| Feature | Documentation |
|---|---|
| Unfollow Everyone | unfollow-everyone.md |
| Unfollow Non-Followers | unfollow-non-followers.md |
| Detect Unfollowers | detect-unfollowers.md |
| Auto-Liker | auto-liker.md |
| Auto-Commenter | auto-commenter.md |
| Follow Engagers | follow-engagers.md |
| Video Downloader | video-downloader.md |
| Followers Scraping | followers-scraping.md |
| Tweet Scraping | tweet-scraping.md |
| Leave Communities | leave-all-communities.md |
| MCP Server | mcp-server.md |
| Monitor Account | monitor-account.md |
| New Follower Alerts | new-follower-alerts.md |
⚡ XActions — The Complete X/Twitter Automation Toolkit
100% Free & Open Source
xactions.app •
GitHub •
@nichxbt
FAQs
XActions - The Complete X/Twitter Automation Toolkit. Scrapers, MCP server for AI agents, CLI, and browser scripts. No API required. Open source by @nichxbt. Don't Panic.
The npm package xactions receives a total of 84 weekly downloads. As such, xactions popularity was classified as not popular.
We found that xactions demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
TC39’s March 2026 meeting advanced eight ECMAScript proposals, including Temporal reaching Stage 4 and securing its place in the ECMAScript 2026 specification.

Research
/Security News
Since January 31, 2026, we identified at least 72 additional malicious Open VSX extensions, including transitive GlassWorm loader extensions targeting developers.

Research
Six malicious Packagist packages posing as OphimCMS themes contain trojanized jQuery that exfiltrates URLs, injects ads, and loads FUNNULL-linked redirects.