Loading ToolBench
MCP server for interacting with Twitter/X using the twikit client library. Provides tools for searching tweets, retrieving user timelines, posting tweets, and managing tweet interactions.
This Twitter MCP server has moderate structural quality but significant gaps in schema completeness, parameter validation, and error handling guidance. All 7 tools are registered with FastMCP and have basic descriptions, but most lack rigorous input schema documentation, parameter constraints (enums, ranges), and actionable error recovery guidance. The server accepts credentials as environment variables (correct approach) but exposes them in Dockerfile comments (security anti-pattern). Output schemas are partially documented in code but not formally exposed. Error handling returns generic messages rather than recovery hints.
Delete a tweet by its ID.
Get tweets from your home timeline (Following).
Get Tweets replies of a specific tweet using tweet_id.
Get tweets from your home timeline (For You).
Search twitter with a query. Sort by 'Top' or 'Latest'
Get tweets from a specific user's timeline.
Post a tweet with optional media, reply, and tags.
No enum constraints on enumerated parameters. sort_by accepts 'Top'|'Latest' but is declared as free-form string; tweet_type accepts unknown set of values; no validation forces LLM to guess or hallucinate values.
Output schemas not formally documented. Tools return lists, dicts, or strings but response structure is not declared in tool metadata. LLM cannot plan downstream calls or extract required fields (e.g., tweet_id from response for delete_tweet).
Parameter formats under-specified. tweet_id, media_paths, and reply_to lack format descriptions (numeric vs hex vs string? local file vs URL? max sizes?). LLM cannot validate inputs before passing them.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 49 | <=2025-11-25 | v2 |
| 2026-03-09 | F | 47 | - | v1 |
Error handling returns generic failures without recovery guidance. get_tweets returns empty list on error (silent); post_tweet and delete_tweet return 'Failed to X: {error}'. No actionable guidance ('Try search_users() first') or error classification (retryable vs user-fixable).
Destructive operation (delete_tweet) lacks confirmation or dry-run pattern. Description is too short (27 chars) and does not warn of irreversibility. No safeguard against accidental deletion by agentic retry.
Inconsistent return types. Some tools return List[Dict] (get_tweets, get_user_tweets, get_replies_for_tweet), others return str (post_tweet, delete_tweet, get_timeline, get_latest_timeline). LLM cannot reliably parse or chain outputs. Structured responses preferred.
Unbounded numeric parameters. count param in get_tweets (default 20, no max stated), get_user_tweets (default 10), get_replies_for_tweet (default 30), get_timeline (default 20), get_latest_timeline (default 20), LLM could pass 10000+ and cause timeout or memory exhaustion. No min/max constraints documented.
Duplicate tools with unclear distinction. get_timeline (For You) and get_latest_timeline (Following) both fetch 20 tweets by default. Should be a single tool with a timeline_type enum parameter or clearer naming distinction. LLM may conflate them.
Credentials exposed in Dockerfile comments. Dockerfile contains ENV TWITTER_USERNAME='@example', ENV TWITTER_EMAIL='me@example.com', ENV TWITTER_PASSWORD='secret' in plain text. If this image is committed to a repo, secrets may leak. Best practice: inject via runtime secrets management (Docker secrets, Kubernetes, HashiCorp Vault), not Dockerfile.
Missing pagination guidance for result lists. get_tweets, get_user_tweets, get_replies_for_tweet return lists without offset/page/cursor or total count. If results exceed count param, no way to fetch next batch. Large result sets blow context window without pagination.