surfagent-x (surfagentapp/surfagent-x) is an MCP server listed on the M8ven Trust Index. It scores 60 out of 100, grade C. It declares 76 tools. No publisher has claimed this listing.

C
Caution
60/100

surfagent-x

X adapter for SurfAgent that gives AI agents X-native verbs for navigation, extraction, posting, replies, likes, reposts, proof-first task execution, recovery, and deeper research workflows.

Caution. Specific findings reduced this grade. They are listed on the page. Grades reflect the full trust pyramid: code, verification depth, and reputation. New projects cap at C until adoption is earned.

How we verified

Code Verified⚡ Live Monitored: not connected

Verified is a snapshot. Live keeps it current, and builds your track record.

⚡ Connect GitHub → continuous verification on every pushwhy connect →

Who stands behind it

surfagentapp

Source: Glama

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find. Or connect your repo for our deepest verification, Live Monitored: read-only, revoke anytime. What we access →

Install from

The grade above is for the source repository. Registries can serve a different version, so we mark the ones we were not able to read.

// key findings
⚠️
Known vulnerabilities in dependencies: 3 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
No credential exfiltration, no sensitive file access, no obfuscation
Static analysis found nothing flowing your secrets to unexpected places.
🔐
You'll be asked for 1 credential: SURFAGENT_AUTH_TOKEN
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// tools this server exposes38 tools

These names and descriptions are the publisher's own, read from the source code. We print them as written. Our assessment is the findings above, not this list.

x_health_check

Check whether X is open in SurfAgent, identify current X page state, and report composer/account readiness.

x_open

Open X in SurfAgent. Optionally choose a starting section such as home, notifications, search, or a profile path.

x_get_accounts

Inspect the active X account and any account-switcher entries currently visible.

x_switch_account

Switch X accounts through the in-session account switcher and verify the resulting active account state.

x_get_state

Get structured X page state for the current tab: route, page kind, selected tabs, composer state, and account info.

x_get_state_map

Return the built-in X state maps for flaky surfaces like account switcher, composer, community, home, post, and profile.

x_open_home

Open the X home timeline and wait for a settled X page state.

x_open_profile

Open a profile by username.

x_open_notifications

Open X notifications.

x_open_search

Open X search, optionally prefilled with a query and live filter.

x_open_post

Open a specific X post by full URL or by username + status ID.

x_get_timeline

Extract the currently visible X timeline posts with author, text, status URL, and social action labels.

x_search_posts

Search X posts and return extracted live results from the search timeline.

x_open_community

Open an X community URL directly. Useful because community navigation has its own weird composer behavior.

x_search_communities

Search X communities and return community cards/links discovered on the search surface.

x_search_profiles

Search X profiles and return discovered accounts with display names, handles, bios, and URLs.

x_get_community_feed

Extract visible posts from the current or specified X community feed.

x_extract_community

Open a community and return structured community metadata, including name, description, member/post hints, and join state when visible.

x_extract_post

Open a post and return a structured post record with author, text, media, and visible stats.

x_extract_profile

Open a profile and return a structured profile record with bio, stats, and pinned post when visible.

x_get_profile_posts

Open a profile and extract visible posts from that profile timeline.

x_get_post_thread

Open a post and extract the visible thread/timeline around it as structured post rows.

x_get_composer_state

Inspect the current X composer state, including whether the Post/Reply button is enabled.

x_create_post

Create a new X post from the home composer with button-state verification and automatic real-typing fallback if X rejects the initial input.

x_reply_to_post

Reply to a specific post with pre-submit composer verification, automatic real-typing fallback, and post-submit visibility verification.

x_like_post

Like a specific X post and verify resulting button state.

x_repost_post

Repost a specific X post and verify the resulting repost state.

x_follow_profile

Follow an X profile and verify the resulting follow state from the active account.

x_engage_post_task

Run a deterministic engage-post task with account switch, screenshots, optional like/repost actions, and a persisted run journal.

x_quote_post_task

Run a deterministic quote-post task with screenshots before and after submit, account switching, and profile-level verification.

x_reply_post_task

Run a deterministic reply-post task with account switching, screenshots, and post-surface verification.

x_follow_profile_task

Run a deterministic follow-profile task with account switching, screenshots, and profile-state verification.

x_community_post_task

Run a deterministic community-post task with membership check, screenshots, composer recovery, and feed verification.

x_switch_account_and_act_task

Run a deterministic account switch followed by a focused action like open-home, open-url, or follow-profile.

x_verify_text_visible

Verify that a specific text snippet is visible on X. Scope can target body, article content, or the active composer.

x_recover

Apply lightweight X recovery actions for common stuck states: composer, home, or target URL.

x_research_topic

Run an autonomous X research pass for a topic, with retries, receipts, post/thread/profile extraction, and community sampling.

x_map_community

Run an autonomous community mapping pass: open a community, extract feed rows, and profile a sample of visible participants.

// known CVEs in dependencies3 high

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

high@modelcontextprotocol/sdk@1.17.3GHSA-345p-7cg4-v4c7

@modelcontextprotocol/sdk has cross-client data leak via shared server/transport instance reuse

high@modelcontextprotocol/sdk@1.17.3GHSA-8r9q-7v3j-jr4g

Anthropic's MCP TypeScript SDK has a ReDoS vulnerability

high@modelcontextprotocol/sdk@1.17.3GHSA-w48q-cv73-mx4w

Model Context Protocol (MCP) TypeScript SDK does not enable DNS rebinding protection by default

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// environment variables
To run this server yourself, you supply these values. They go in your own MCP client configuration and stay on your machine. The secret label means the value is sensitive, not that the server mishandles it.
🔐 secretSURFAGENT_AUTH_TOKENoptional override, otherwise auto-detected
configSURFAGENT_DAEMON_URLdefault: http://127.0.0.1:7201
configSURFAGENT_RUN_DIR${:-$TMPDIR/surfagent-x-runs}
// quality suggestions

Tool annotations

No tools have read-only/destructive annotations

Add readOnlyHint or destructiveHint annotations to every tool so hosts can warn users before invoking.

All four hints declared on every tool

76/76 tools missing one or more hints — x_health_check (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); x_open (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint); x_get_accounts (missing: readOnlyHint, destructiveHint, idempotentHint, openWorldHint), +73 more. OpenAI's directory rejects tools where any of the four hints are missing or non-boolean.

For every tool, set all four hints (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) to explicit true/false values that match the handler’s actual behaviour.

License file

No license file

Add a LICENSE file (MIT, Apache-2.0, etc.).

Tests exist

No test files found

Add tests that exercise each declared tool.

Production dependencies are patched

0 critical, 3 high severity in production deps — @modelcontextprotocol/sdk@1.17.3 (high), @modelcontextprotocol/sdk@1.17.3 (high)

Run npm audit fix, or upgrade the affected packages to a non-vulnerable version.

Claim the listing to review these findings one by one and send us a correction where you disagree, straight to the team. Claiming also means we tell you when the grade moves, and reach you first if we find anything urgent.

// full audit trail
The findings above are the summary. The full trail, every check we ran, each deduction, the network hosts observed and the dependency advisories, goes to verified publishers, along with an alert whenever a new one lands. Verified publishers can also review each finding and dispute it in one click. Publisher corrections have sharpened several of our checks this month, because the maintainer knows the codebase better than any scanner.
// improvement guidance — verified publishers only
We have 5 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Verified](https://m8ven.ai/badge/mcp/surfagentapp/surfagent-x?variant=verified)](https://m8ven.ai/mcp/surfagentapp/surfagent-x)
Shows verification status without the grade. Want the grade badge instead? Remove ?variant=verified from the URL.
commit: 42d316f1cd4cf4c6502753107825d7aaf168fc3d
code hash: eb5f83902c7c088679ed844c6bc9b52ac2a544a6102ef0aae896e69cf4efce3b
view raw JSON →
Check MCPs from inside your assistant
Tool Check · MCP

Vetting this one by hand? Tool Check is an MCP that scores other MCPs. Add it once and ask Claude, ChatGPT, or any MCP client to grade a server, surface CVEs, check the publisher, and suggest safer alternatives — before you install.

https://m8ven.ai/api/mcp/tool-check
check_toolsearch_toolscompare_toolsrecommend_alternativescheck_publisherreport_concern
How to add it →Free · no account needed · works in any MCP client