PilotMyX guide
Connect an Agent to X Data with MCP
PilotMyX exposes authorized X account data and scheduling actions through a Model Context Protocol server. A compatible agent can query posts and analytics without receiving your X credentials. Each PilotMyX token belongs to one account, carries explicit scopes, can expire, and can be revoked from the dashboard.
Last updated: July 20, 2026
How does PilotMyX MCP access work?
The MCP client sends a PilotMyX token, and the server limits every request to that token's account and scopes.
The dashboard displays the MCP server URL and creates the token secret once. Add both values to your compatible client, keep the token outside prompts and source control, then verify the connection by reading account status.
Your X OAuth credentials stay on PilotMyX and are never handed to the MCP client.
Read scopes
Read permissions can be granted without allowing any draft or publishing change.
Account reads return identity, connection state, freshness, and available metric context. Post and reply reads are paginated and filterable. Analytics reads return aggregates and rankings from synchronized data rather than silently triggering an external request for every tool call.
- Account and synchronization status
- Paginated posts and replies with type filters
- Period analytics and metric-based rankings
- Draft and scheduled-publication lists
Write scopes
Writing is separated from reading so an agent receives only the control it needs.
A workflow can receive drafts:write to create, update, or delete drafts and manage their media without permission to schedule or publish. Scheduling, rescheduling, and cancellation require the dangerous schedules:write scope because scheduled posts are sent to X automatically. Immediate publication separately requires the dangerous publish:write scope. The Web calendar and MCP expose the same validated content and publication operations.
Pagination, retries, and safe automation
MCP clients should follow returned cursors and reuse an idempotency key when retrying the same write.
Pagination keeps large timelines responsive. Signed cursors bind continuation to the account and filters that created them. Idempotency prevents a network retry from creating a second draft or schedule entry, while optimistic version checks protect against overwriting a newer edit.
Token security checklist
Treat a PilotMyX MCP token like a password with narrowly defined authority.
- Create separate tokens for separate clients
- Grant only the scopes the workflow needs
- Set an expiry for temporary integrations
- Never paste token secrets into post content or shared logs
- Revoke and replace a token immediately after suspected exposure
Put the workflow to work