Switch X plugin to OAuth user sign-in with write scopes

[maloneya]

Summary

The X plugin is no longer read-only. It now signs users in with OAuth instead of asking for an app-only Bearer token.

• mcp.json now uses an auth block (same shape as the Salesforce plugin) with the shipped client ID NGdZYmo4VVp2T1BnRG55NlExOGQ6MTpjaQ and these scopes: tweet.read, users.read, follows.read, space.read, mute.read, like.read, list.read, list.write, block.read, block.write, bookmark.read, bookmark.write, billing.write, offline.access.
• Removed the X_BEARER_TOKEN variable from plugin.json — there is no credential to paste anymore.
• Bumped the version to 2.0.0 and updated the description, README, and changelog to drop the read-only wording. The README notes that posting is still not possible since tweet.write is not requested.

Testing

• node scripts/validate-plugins.mjs passes ("All plugins validated successfully").

  

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

Bugbot Autofix prepared a fix for the issue found in the latest run.

• ✅ Fixed: Invalid billing.write OAuth scope
  • Removed the nonexistent billing.write scope from the OAuth scopes list in mcp.json and from the matching documentation in README.md and CHANGELOG.md, since X's OAuth 2.0 scope catalog has no such scope and it matched no documented plugin capability.

Or push these changes by commenting:

@cursor push 7f21913e48

Preview (7f21913e48)

diff --git a/third_party/x/CHANGELOG.md b/third_party/x/CHANGELOG.md
--- a/third_party/x/CHANGELOG.md
+++ b/third_party/x/CHANGELOG.md
@@ -5,7 +5,7 @@
 ## 2.0.0 — OAuth user sign-in, no longer read-only
 
 - Replaced the `X_BEARER_TOKEN` app-only route with OAuth user sign-in using X's client ID `NGdZYmo4VVp2T1BnRG55NlExOGQ6MTpjaQ`.
-- Requested scopes: `tweet.read`, `users.read`, `follows.read`, `space.read`, `mute.read`, `like.read`, `list.read`, `list.write`, `block.read`, `block.write`, `bookmark.read`, `bookmark.write`, `billing.write`, `offline.access`.
+- Requested scopes: `tweet.read`, `users.read`, `follows.read`, `space.read`, `mute.read`, `like.read`, `list.read`, `list.write`, `block.read`, `block.write`, `bookmark.read`, `bookmark.write`, `offline.access`.
 - Agents can now manage lists, bookmarks, blocks, and mutes in your user context. Posting is still not possible (`tweet.write` is not requested).
 - Removed the `X_BEARER_TOKEN` plugin variable — no credential to paste anymore.
 

diff --git a/third_party/x/README.md b/third_party/x/README.md
--- a/third_party/x/README.md
+++ b/third_party/x/README.md
@@ -35,7 +35,6 @@
           "block.write",
           "bookmark.read",
           "bookmark.write",
-          "billing.write",
           "offline.access"
         ]
       }
@@ -67,7 +66,7 @@
 
 ## Scopes requested
 
-`tweet.read`, `users.read`, `follows.read`, `space.read`, `mute.read`, `like.read`, `list.read`, `list.write`, `block.read`, `block.write`, `bookmark.read`, `bookmark.write`, `billing.write`, `offline.access`
+`tweet.read`, `users.read`, `follows.read`, `space.read`, `mute.read`, `like.read`, `list.read`, `list.write`, `block.read`, `block.write`, `bookmark.read`, `bookmark.write`, `offline.access`
 
 ## X documentation search
 

diff --git a/third_party/x/mcp.json b/third_party/x/mcp.json
--- a/third_party/x/mcp.json
+++ b/third_party/x/mcp.json
@@ -18,7 +18,6 @@
           "block.write",
           "bookmark.read",
           "bookmark.write",
-          "billing.write",
           "offline.access"
         ]
       }

_{You can send follow-ups to the cloud agent here.}

^{Reviewed by Cursor Bugbot for commit 6a39659. Configure here.}

[cursor]

Invalid billing.write OAuth scope

High Severity · Logic Bug

billing.write is not a documented X OAuth 2.0 scope. Requesting it on sign-in can cause X to reject the consent request, so the new user OAuth flow fails before any MCP tools run. It also does not match any capability this plugin documents.

Additional Locations (2)

• third_party/x/README.md#L37-L38
• third_party/x/CHANGELOG.md#L7-L8

 

^{Reviewed by Cursor Bugbot for commit 6a39659. Configure here.}