A command that guides you through setting up X, formerly called Twitter, API login using OAuth 2.0 with PKCE. OAuth is a standard way for an application to access an account without handling its password.

Use it to connect an application or automation to the X API with read-and-write access.

It provides a repeatable setup process for creating the developer app, configuring permissions, and storing authentication details.

setup — Command by rockyco

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

agentmods

npx agentmods add commands/rockyco/claude-x-plugin/setup

Clone the repo

git clone --depth 1 https://github.com/rockyco/claude-x-plugin

Per session 20 Only the description is in the session, so the agent can decide to use it. The body loads when it is invoked.

When invoked 675 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. Scan, not verified.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5	$0.00020	$0.00675
Opus 5	$0.00010	$0.00338
Sonnet 5	$0.00004	$0.00135
Haiku 4.5	$0.00002	$0.00068

Measured yesterday against content hash d84b85abfdc0, method: parsed. Prices are Anthropic first-party input rates as of 2026-08-30, from the pricing page.

Security

Grade A, and why

setup scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured yesterday.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

commands/setup.md · 76 lines

How it starts

The opening of the file, as written. The whole thing — 76 lines — stays where its author put it; the contents beside it link to each section on GitHub.

X OAuth Setup

Guide the user through setting up X API authentication. This is a one-time process.

Step 1: Check existing settings

Read ~/.claude/x.local.md to see if already authenticated. If the file exists and has a valid refresh token, inform the user they are already set up and ask if they want to re-authenticate.

Step 2: X Developer App

If the user does not have credentials, walk them through creating an X Developer App:

Tell the user to go to https://developer.x.com/en/portal/dashboard and sign in
If they don't have a developer account, they need to sign up for the Free tier
Create a new project and app:
- Go to Projects & Apps in the sidebar
- Click "Add App" or create a new project
- App name: anything descriptive
In the app settings, go to Keys and tokens:
- Copy the OAuth 2.0 Client ID and Client Secret
- These are under "OAuth 2.0 Client ID and Client Secret" section
In User authentication settings, click "Set up":
- App permissions: Read and write
- Type of App: Web App, Automated App or Bot
- Callback URI: http://localhost:9877/callback
- Website URL: any valid URL (e.g. https://github.com/your-username)
- Click Save

Use AskUserQuestion to collect the Client ID and Client Secret from the user.

Step 3: Run OAuth flow

Once you have the client_id and client_secret, run the OAuth server:

python3 ${CLAUDE_PLUGIN_ROOT}/scripts/oauth-server.py "<client_id>" "<client_secret>"

This will:

Generate a PKCE code verifier and challenge
Print an authorization URL and open the user's browser
Wait for the OAuth callback on localhost:9877
Exchange the authorization code for access + refresh tokens
Fetch the user's profile
Save everything to ~/.claude/x.local.md

Tell the user to authorize the app in their browser when it opens.

Step 4: Verify

After the script completes, read ~/.claude/x.local.md and confirm to the user:

Their display name and @username
Token expiration (2 hours, auto-refreshed)
Refresh token status

Read the full file on GitHub · 76 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

yesterday First seen · 76 lines · 20 tokens per session scan A d84b85abfdc0

Subscribe to this mod's changes

setup is a command published in the GitHub repository rockyco/claude-x-plugin (1 stars, last pushed 2mo ago), licensed MIT. It adds 20 tokens to every session and 675 once invoked, about $0.0001 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Backend and APIs Languages Security claude-code claude-code-plugin oauth2 pkce python social-media

x-post

Draft (or take) a tweet/thread, optionally attach an image, score it against a built-in bookmarkability rubric, preview the cost, and post to X — ONLY after you explicitly confirm. Never auto-publishes. Can also SCHEDULE for later via vibedraft (single posts may carry one image or mp4 video; bulk is text-only)…

rcmiskin10/x-poster · 107 tokens

setup