The hosted Model Context Protocol — the open standard letting AI agents call external tools — exposes posts, search, and bookmarks to AI tools but blocks writes, framing X as a real time data layer rather than a posting surface.
X's new hosted Model Context Protocol server reads posts, search results, bookmarks, and user data from the platform and hands them straight to AI tools. It cannot post, reply, repost, or like on a user's behalf. That gap is not a safety afterthought. It is the design.
The two-endpoint setup, announced the week of June 29, positions X as a real-time data layer that AI systems consume rather than a surface they act through. MCP, short for Model Context Protocol, is the open standard that lets a large language model call external tools and read structured data through one consistent interface. Hosted MCP servers from GitHub, Slack, Notion, Stripe, and Salesforce have already made the pattern table stakes for any SaaS that wants to stay useful to AI agents. mcp.directory's catalog now lists X in that official lineup.
X ships two servers in this launch. The X MCP at api.x.com/mcp exposes posts, search, users, bookmarks, trends, news, and Articles. A separate Docs MCP at docs.x.com/mcp lets agents search X's developer documentation. Transport is Streamable HTTP on MCP protocol version 2025-06-18; the server identifier is xmcp. Authentication runs through the open-source xurl mcp bridge, which handles OAuth and injects a per-call Bearer token drawn from the user's own X account permissions, so an AI agent acts as the user, not as a generic bot. Named compatible clients at launch include Grok Build, Cursor, Claude, and VS Code, plus any tool that speaks MCP.
Before this launch, wiring an AI agent to X's data meant writing a custom connector against the X API for each model client. The hosted MCP collapses that into a one-line configuration: point the agent at api.x.com/mcp, authenticate through xurl mcp, and the agent can query posts, search, and bookmarks under the user's own permissions. The agent becomes a reader of X. It cannot write.
X told TechCrunch that the hosted MCP is incompatible with the Write API. Agents cannot use it to post, reply, repost, or like autonomously. The architectural read is that X is positioning itself as an information network: a source of real-time public signal that AI tools read, not an engagement surface they act through. That framing separates X from the wider agentic-web pattern, where platforms are racing to let AI assistants post, reply, and amplify on a user's behalf.
Read-only also protects X's most valuable AI-side asset: the real-time public firehose. Search engines, assistants, agentic research tools, and any bot that needs to know what people are saying right now are the customers X is courting. By keeping the MCP read-only, X protects that data product from the trust and abuse problems that come with autonomous posting on a network where individual posts routinely move markets, shape policy debates, and dominate news cycles. X's Write API endpoints still exist elsewhere. X just is not handing them to agents through this channel.
The mcp.directory ecosystem list shows the official hosted-MCP roster growing fast, and X's launch puts a read-or-write choice in front of every other social platform with an AI roadmap. The watch item is whether Reddit, Meta, LinkedIn, or Bluesky ship their own hosted MCPs, and whether those include write endpoints. X has answered. Whether other platforms let AI speak for their users, or only listen, is the next move.