XActions v3.5.0: Complete Feature Inventory

Every surface this repository ships, with the file that implements each one. Package: xactions on npm | Author: nichxbt (@nichxbt) Apache-2.0 | Node.js >= 20 (CI runs 20, 22 and 24) | Vitest suite runs offline

The counted tables below (MCP tools, CLI commands, skills) are transcribed from the code that defines them: src/mcp/server.js, src/cli/help-groups.js and skills/index.json. npm run docs:audit recomputes those counts from the same sources on every run and fails on a number that has drifted, so a stale figure here is a build failure rather than a surprise for a reader.

Table of Contents

1. Architecture Overview
2. Browser Console Scripts (src/)
3. Automation Framework (src/automation/)
4. Scrapers (src/scrapers/)
5. Puppeteer Manager Modules (src/*.js ES exports)
6. MCP Server (src/mcp/)
7. CLI (src/cli/)
8. DevTools Console Scripts (scripts/twitter/)
9. Skills Reference (skills/)
10. API Backend (api/)
11. Transport and sessions (src/scrapers/twitter/http/)
12. Delivery: streams, notifications, webhooks
13. Portability: the X archive, export, migrate

1. Architecture Overview

XActions delivers features through 5 delivery modes:

Most public reads no longer need Puppeteer at all: src/scrapers/twitter/http/ talks to X's internal GraphQL API with a guest token, discovers its query IDs from x.com's own bundles, and signs every request with an x-client-transaction-id header. Puppeteer is the fallback for the surfaces that genuinely need a browser.

Key Dependencies: puppeteer + puppeteer-extra-plugin-stealth, @modelcontextprotocol/sdk, commander, chalk, ora, inquirer, express, prisma, bull, redis, socket.io, stripe

Package Exports (all 15, from package.json):

Binaries: xactions (CLI), xactions-mcp (MCP server), xactions-agent (thought leader agent).

2. Browser Console Scripts

How to use: Navigate to the listed x.com page → Open DevTools (F12) → Console tab → Paste entire script → Enter

2.1 Unfollow Management

2.2 Content Cleanup

2.3 Blocking & Muting

2.4 Follower Monitoring

2.5 Analytics

2.6 Content Creation

2.7 Direct Messages

2.8 Communities

2.9 Lists & Profile

2.10 Data Export & Backup

3. Automation Framework

How to use: Paste core.js into DevTools first (it defines selectors, utilities, rate limiting). Then paste any automation script.

3.1 Foundation

3.2 Auto-Engagement

3.3 Follow Automation

3.4 Growth & Business

3.5 Safety & Utilities

4. Scrapers

How to use (Puppeteer library): import { createBrowser, scrapeProfile } from 'xactions/scrapers' How to use (browser scripts): Paste into DevTools on the listed page

4.1 Puppeteer Scraper Library

4.2 Browser Console Scrapers

5. Puppeteer Manager Modules

How to use: import { functionName } from 'xactions': these are ES module exports from src/index.js. All take a Puppeteer page as first argument.

5.1 Profile & Settings

5.2 Content Creation & Management

5.3 Engagement & Interaction

5.4 Discovery & Search

5.5 Spaces & Communities

5.6 Analytics & Business

5.7 AI Integration

6. MCP Server

How to use: npx xactions-mcp or configure in Claude Desktop / Cursor settings Config: XACTIONS_MODE (local|remote), XACTIONS_SESSION_COOKIE, X402_PRIVATE_KEY, X402_NETWORK

6.1 Server Architecture

Transports. stdio by default. --http (or MCP_TRANSPORT=http) serves Streamable HTTP on /mcp for remote and hosted clients; set XACTIONS_MCP_TOKEN to require Authorization: Bearer <token> on it.

Tool groups. XACTIONS_MCP_TOOLS (allowlist) and XACTIONS_MCP_EXCLUDE (denylist), or --tools and --exclude on the command line, filter the advertised list by group. A filtered tool is neither advertised nor callable, so the schema cost drops with it. Groups: read, write, dm, lists, spaces, analytics, ai, grok, automation, monitoring, workflows, persona, graph, data, x402, drafts, auth.

Approval gate. XACTIONS_MCP_REQUIRE_APPROVAL=1 turns every write tool into a draft. Release or bin drafts with the x_list_drafts, x_approve_draft, x_discard_draft and x_draft_status tools, or from the shell with xactions drafts list|show|approve|discard.

Daily caps. Independent of the gate and always on. Every write is charged against a rolling 24 hour per-account budget written to action-ledger.json under XACTIONS_HOME (default ~/.xactions), so it survives a restart, and a call that would exceed it is refused before anything reaches X.

Bundle. node scripts/build-mcpb.mjs produces the .mcpb a user drags onto Claude Desktop > Settings > Extensions; it prompts for the session cookie and tool groups at install time.

6.2 Complete MCP Tool List (153 tools)

Grouped by tool group, alphabetical within each group. "Write" marks the tools the approval gate holds and the daily caps charge.

7. CLI

How to use: npx xactions <command>, or npm run cli -- <command> from a clone. Auth: stored under ~/.xactions (override with XACTIONS_HOME).

56 commands, grouped by task exactly as xactions with no arguments prints them, plus 85 subcommands. Two more are registered but ungrouped: completion, which prints a shell completion script generated from the live command tree, and ask.

Global output flags

Every read command takes these:

--compact wins when both it and --json are passed.

Logging in

Public reads need no account at all: profile, tweets, thread, media, analyze, hashtag. Search, followers, following, non-followers, likes, bookmarks and DMs need a session.

Every command

Start here

Read an account

Followers and audience

Search and monitor

Write and grow

Automate

Move data

Low level

8. DevTools Console Scripts

scripts/ holds 95 browser console scripts you paste into DevTools on x.com, and scripts/twitter/ holds 110 standalone .js variants of the same ideas. The full catalogue with a description and the page each one runs on is generated from the script headers themselves into browser-scripts.md by npm run docs:scripts. A hand-kept list of a hundred files is a list that is wrong within a month, so this section covers only what is unique to scripts/twitter/.

8.1 Scripts UNIQUE to scripts/twitter/ (not in src/)

8.2 Scripts that MIRROR src/ features (shared as standalone versions)

unfollow-everyone.js, unfollow-non-followers.js, unfollow-with-log.js, smart-unfollow.js, detect-unfollowers.js, monitor-account.js, continuous-monitor.js, new-followers-alert.js, auto-liker.js, auto-commenter.js, follow-engagers.js, follow-target-users.js, keyword-follow.js, protect-active-users.js, growth-suite.js, multi-account.js, audit-followers.js, block-bots.js, mass-block.js, mass-unblock.js, mass-unmute.js, mute-by-keywords.js, report-spam.js, clear-all-bookmarks.js, clear-all-likes.js, clear-all-retweets.js, leave-all-communities.js, join-communities.js, send-direct-message.js, backup-account.js, best-time-to-post.js, competitor-analysis.js, engagement-analytics.js, hashtag-analytics.js, bookmark-exporter.js, thread-unroller.js, video-downloader.js, viral-tweets-scraper.js, link-scraper.js

9. Skills Reference (skills/)

50 skills, one directory each, following the Agent Skills specification: a SKILL.md with name and description frontmatter, plus references/ where a skill needs more than one file. Each names the exact script, page and arguments for its job, and the mistakes to avoid.

xactions skills list                            # every skill and where it is installed
xactions skills show follower-monitoring        # read one without installing it
xactions skills install --all --global          # ~/.claude/skills/<id>/
xactions skills install --all --target cursor   # or project, codex, windsurf

The machine-readable index is skills/index.json, and the narrative catalogue is skills.md.

10. API Backend (api/)

Express.js SaaS backend for the web dashboard.

11. Transport and sessions

The layer under every read. src/scrapers/twitter/http/ talks to X's internal GraphQL API directly, so a profile or a timeline needs no browser and no account.

Session sources. xactions connect drives a real browser. xactions login --from-browser [chrome\|chromium\|brave\|edge\|arc\|firefox] reads x.com cookies out of an installed browser profile. xactions login --cookies-file <path> imports a Netscape cookies.txt, a Cookie-Editor or EditThisCookie JSON export, a Playwright or Puppeteer storageState, or a raw auth_token=...; ct0=... string. Prefer a full jar over a bare auth_token: it carries the ct0 every write needs.

12. Delivery: streams, notifications, webhooks

13. Portability: the X archive, export, migrate

xactions archive summary ~/Downloads/twitter-2026.zip
xactions archive export  ~/Downloads/twitter-2026.zip --out ./archive
xactions archive migrate ~/Downloads/twitter-2026.zip --to bluesky --execute
xactions export YOUR_USERNAME --format json,csv,md,html
xactions diff exports/january exports/february

Migration targets Bluesky and Mastodon, and is a dry run unless --execute is passed. Full guide: portability.md.

Quick Stats

Every figure below is a count of files or of declarations in the code, so it can be rechecked rather than believed. npm run docs:audit recomputes the starred rows on every run and fails the build when one has drifted.

Counts marked * move whenever a tool, command, skill or route lands. Re-run npm run docs:audit after any such change; it names the file and line of every number that no longer matches the tree.

X/Twitter DOM Selectors Reference

Used across all scripts. The maintained set, kept current, is dom-selectors.md; the table below is the subset these scripts rely on: