Security
Your credentials, your control
Three access channels, each with defense in depth. xbird never stores plaintext credentials — every path is encrypted or local-only.
MCP Local
IDE Integration
Not needed
Auto-detected from browser, never leave your machine
CredentialsAuto-detected locally
Paymentx402 authorize
Twitter IPYour residential IP
ForClaude Code, Cursor, Windsurf
1Auto-detect browser cookies
2Local exec from your IP
3x402 payment to server
4Result returned locally
Credentials never leave your machine
REST API
Fully Stateless
AES-256-GCM
Credentials encrypted inside token, server stores nothing
CredentialsEncrypted in token
Paymentx402 USDC on Base
Twitter IPServer (datacenter)
ForAI agents, developers
1xbird login encrypts locally
2Token = key + ciphertext + IV
3Request + stateless token
4Decrypt, execute, discard
Zero server storage — nothing to breach
ACP Marketplace
End-to-End Encrypted
ECDH + AES-256-GCM
Ephemeral key exchange, relay sees nothing
CredentialsE2E encrypted in transit
PaymentVirtuals Protocol
Twitter IPServer (datacenter)
ForAgent-to-agent commerce
1Fetch server public key
2ECDH derive shared secret
3Encrypt credentials client-side
4Relay sees only ciphertext
Even the protocol relay can't read credentials
What happens if...
Threat scenarios across all channels
ThreatMCPRESTACP
Server breachedN/ANo data storedN/A
Network interceptedlocalhost onlyHTTPS + derived keyECDH encrypted
Server compromisedNot affectedMemory-only windowMemory-only window
All channels use defense in depth. No single point of compromise exposes credentials.
How it works
Three steps. Zero config.
No Twitter developer account needed. No OAuth tokens. No rate limit management. xbird handles everything.
Claude Code
$ claude mcp add xbird -- npx @checkra1n/xbird
Cursor · Windsurf · Claude Desktop
$ npx @checkra1n/xbird
as MCP command01
Install
One command. No API keys, no OAuth, no developer portal.
Any MCP client
Same server, same tools. Claude Code gets a dedicated CLI command, everything else uses npx as the MCP command.
Available tools
search_tweetsget_tweetget_userpost_tweetlike_tweetupload_media+ 24 more tools
x402 payment flow
1Agent
MCP tool call
xbird2xbird
HTTP 402 + price
Agent3Agent
Signed payment
xbird4xbird
Execute + return
TwitterAll automatic. Sub-second latency.
02
Your agent calls tools
xbird exposes 34 MCP tools. Your agent picks the right one automatically.
03
x402 handles payment
Each call costs fractions of a cent. Payment happens inline via HTTP 402 — zero friction.