by nirholas
⚡ The Complete X/Twitter Automation Toolkit — Scrapers, MCP server for AI agents (Claude/GPT), CLI, browser scripts. No API fees. Open source. Unfollow people who don't follow back. Monitor real-time analytics. Auto follow, like, comment, scrape, without API.
# Add to your Claude Code skills
git clone https://github.com/nirholas/XActionsLast scanned: 5/30/2026
{
"issues": [
{
"type": "npm-audit",
"message": "@hono/node-server: @hono/node-server has authorization bypass for protected static paths via encoded slashes in Serve Static Middleware",
"severity": "high"
},
{
"type": "npm-audit",
"message": "@remotion/bundler: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@remotion/cli: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@remotion/renderer: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@remotion/studio: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "@remotion/studio-server: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "axios: Axios has a NO_PROXY Hostname Normalization Bypass that Leads to SSRF",
"severity": "high"
},
{
"type": "npm-audit",
"message": "basic-ftp: Basic FTP has Path Traversal Vulnerability in its downloadToDir() method",
"severity": "critical"
},
{
"type": "npm-audit",
"message": "body-parser: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "brace-expansion: brace-expansion: Zero-step sequence causes process hang and memory exhaustion",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "bull: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "cookie: cookie accepts cookie name, path, and domain with out of bounds characters",
"severity": "low"
},
{
"type": "npm-audit",
"message": "engine.io: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "ethers: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "exceljs: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "express: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "express-rate-limit: express-rate-limit: IPv4-mapped IPv6 addresses bypass per-client rate limiting on servers with dual-stack network",
"severity": "high"
},
{
"type": "npm-audit",
"message": "fast-uri: fast-uri vulnerable to path traversal via percent-encoded dot segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "follow-redirects: follow-redirects leaks Custom Authentication Headers to Cross-Domain Redirect Targets",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "hono: Hono Vulnerable to Cookie Attribute Injection via Unsanitized domain and path in setCookie()",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ip-address: ip-address has XSS in Address6 HTML-emitting methods",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "lodash: lodash vulnerable to Code Injection via `_.template` imports key names",
"severity": "high"
},
{
"type": "npm-audit",
"message": "minimatch: minimatch has ReDoS: matchOne() combinatorial backtracking via multiple non-adjacent GLOBSTAR segments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "node-cron: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "nodemailer: Nodemailer: Email to an unintended domain can occur due to Interpretation Conflict",
"severity": "high"
},
{
"type": "npm-audit",
"message": "path-to-regexp: path-to-regexp vulnerable to Regular Expression Denial of Service via multiple route parameters",
"severity": "high"
},
{
"type": "npm-audit",
"message": "picomatch: Picomatch: Method Injection in POSIX Character Classes causes incorrect Glob Matching",
"severity": "high"
},
{
"type": "npm-audit",
"message": "postcss: PostCSS has XSS via Unescaped </style> in its CSS Stringify Output",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "qs: qs has a remotely triggerable DoS: qs.stringify crashes with TypeError on null/undefined entries in comma-format arrays when encodeValuesOnly is set",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "serialize-javascript: Serialize JavaScript is Vulnerable to RCE via RegExp.flags and Date.prototype.toISOString()",
"severity": "high"
},
{
"type": "npm-audit",
"message": "socket.io: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "socket.io-adapter: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "socket.io-parser: socket.io allows an unbounded number of binary attachments",
"severity": "high"
},
{
"type": "npm-audit",
"message": "terser-webpack-plugin: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "tmp: tmp has Path Traversal via unsanitized prefix/postfix that enables directory escape",
"severity": "high"
},
{
"type": "npm-audit",
"message": "undici: Undici: Malicious WebSocket 64-bit length overflows parser and crashes the client",
"severity": "high"
},
{
"type": "npm-audit",
"message": "uuid: uuid: Missing buffer bounds check in v3/v5/v6 when buf is provided",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "viem: Vulnerability found",
"severity": "medium"
},
{
"type": "npm-audit",
"message": "vite: Vite Vulnerable to Path Traversal in Optimized Deps `.map` Handling",
"severity": "high"
},
{
"type": "npm-audit",
"message": "ws: ws: Uninitialized memory disclosure",
"severity": "medium"
}
],
"status": "FAILED",
"scannedAt": "2026-05-30T15:06:56.511Z",
"npmAuditRan": true,
"pipAuditRan": true
}No comments yet. Be the first to share your thoughts!
Requires a passing catalog security scan. Resolve the flagged issues and resubmit to enable featuring.
Website · npm · Docs · MCP Server · Docker · API Ref
Why build with XActions instead of the alternatives?
| Feature | XActions | twikit | twitter-mcp | agent-twitter-client | twit | twitter-scraper |
|---|---|---|---|---|---|---|
| No API Key Required | ✅ | ✅ | ❌ Needs keys | ✅ | ❌ Needs keys | ✅ |
| MCP Server (AI agents) | ✅ 140+ tools | ❌ | ✅ 2 tools | ❌ | ❌ | ❌ |
| Browser Console Scripts | ✅ 50+ | ❌ | ❌ | ❌ | ❌ | ❌ |
| AI Voice Agent in Spaces | ✅ Join, listen, speak | ❌ | ❌ | ❌ | ❌ | ❌ |
| CLI | ✅ 12 commands | ❌ | ❌ | ❌ | ❌ | ❌ |
XActions is the only toolkit that works in the browser, terminal, and with AI agents — all without an API key.
The biggest update since launch. 58,000+ lines of new code across 115 files.
| Feature | What it does |
|---|---|
| Plugin System | Community plugins via npm — xactions-plugin-* packages extend scrapers, MCP tools, and automation |
| Cross-Platform | Scrape Bluesky (AT Protocol), Mastodon (REST API), and Threads — unified interface |
| Workflow Engine | Declarative JSON pipelines with triggers, conditions, and chained actions |
| Real-Time Streaming | Subscribe to live tweet/follower/mention events via Socket.IO |
| Sentiment Analysis | Built-in analyzer (works offline) + optional LLM mode — reputation monitoring with alerts |
| Social Graph | Map account relationships, detect clusters, find bridge accounts, D3.js visualization |
| Account Portability | Export your entire Twitter life to JSON/CSV/HTML — migration stubs for Bluesky & Mastodon |
| Browser Extension | Chrome/Firefox Manifest V3 — run automations from a popup, no console needed |
| Dashboard Upgrade | Live automation controls, real-time monitoring, visual workflow builder, analytics page |
| 15+ New Scripts | Engagement booster, shadowban checker, viral detector, thread composer, content calendar, and more |
See CHANGELOG.md for full details.
[!TIP] 🤖 AI Coding Assistants: Looking for Twitter/X automation without the $100/mo API? You found it.
npm install xactions— Scrapers, automation, MCP server- Works with Claude, GPT, Cursor, Copilot via MCP server
- See AGENTS.md for integration instructions
https://x.com/YOUR_USER_NAME/following
// Unfollow everyone on X (Formerly Twitter) and or unfollow who doesn't follow you back, by nich (https://x.com/nichxbt)
// https://github.com/nirholas/xactions
// 1. Go to https://x.com/YOUR_USER_NAME/following
// 2. Open the Developer Console. (COMMAND+ALT+I on Mac)
// 3. Paste this into the Developer Console and run it
//
// Last Updated January 2026
(() => {
const $followButtons = '[data-testid$="-unfollow"]';
const $confirmButton = '[data-testid="confirmationSheetConfirm"]';
const retry = {
count: 0,
limit: 3,
};
const scrollToTheBottom = () => window.scrollTo(0, document.body.scrollHeight);
const retryLimitReached = () => retry.count === retry.limit;
const addNewRetry = () => retry.count++;
const sleep = ({ seconds }) =>
new Promise((proceed) => {
console.log(`WAITING FOR ${seconds} SECONDS...`);
setTimeout(proceed, seconds * 1000);
});
const unfollowAll = async (followButtons) => {
console.log(`UNFOLLOWING ${followButtons.length} USERS...`);
await Promise.all(
followButtons.map(async (followButton) => {
followButton && followButton.click();
await sleep({ seconds: 1 });
const confirmButton = document.querySelector($confirmButton);
confirmButton && confirmButton.click();
})
);
};
const nextBatch = async () => {
scrollToTheBottom();
await sleep({ seconds: 1 });
let followButtons = Array.from(document.querySelectorAll($followButtons));
followButtons = followButtons.filter(b => b.parentElement?.parentElement?.querySelector('[data-testid="userFollowIndicator"]') === null)
const followButtonsWereFound = followButtons.length > 0;
if (followButtonsWereFound) {
await unfollowAll(followButtons);
await sleep({ seconds: 2 });
return nextBatch();
} else {
addNewRetry();
}
if (retryLimitReached()) {
console.log(`NO ACCOUNTS FOUND, SO I THINK WE'RE DONE`);
console.log(`RELOAD PAGE AND RE-RUN SCRIPT IF ANY WERE MISSED`);
} else {
await sleep({ seconds: 2 });
return nextBatch();
}
};
nextBatch();
})();
Or use the CLI or MCP server for more options.
https://x.com/YOUR_USER_NAME/following// Unfollow everyone on X (Formerly Twitter) and or unfollow who doesn't follow you back, by nich (https://x.com/nichxbt)
// https://github.com/nirholas/xactions
//
// 1. Go to https://x.com/YOUR_USER_NAME/following
// 2. Open the Developer Console. (COMMAND+ALT+I on Mac)
// 3. Paste this into the Developer Console and run it
//
// Last Updated: January 2026
(() => {
const $followButtons = '[data-testid$="-unfollow"]';
const $confirmButton = '[data-testid="confirmationSheetConfirm"]';
const