X (formerly Twitter) just released sits between your agent and the X MCP server, evaluating every tools/call against a YAML policy before it reaches the X API.
Here is a starter policy for the X MCP server:
version: "1"
description: "Policy for xdevplatform/xmcp"
default: "allow"
tools:
# === Block destructive tools entirely ===
deletePosts:
default: "deny"
deleteDirectMessagesEvents:
default: "deny"
deleteLists:
default: "deny"
deleteAllConnections:
default: "deny"
deleteCommunityNotes:
default: "deny"
# === Rate limit public-facing actions ===
createPosts:
rules:
- name: "post-rate-limit"
rate_limit: "5/hour"
on_deny: "Rate limit: max 5 posts per hour"
repostPost:
rules:
- name: "repost-rate-limit"
rate_limit: "10/hour"
on_deny: "Rate limit: max 10 reposts per hour"
likePost:
rules:
- name: "like-rate-limit"
rate_limit: "20/hour"
on_deny: "Rate limit: max 20 likes per hour"
# === Rate limit DMs and chat ===
createDirectMessagesByConversationId:
rules:
- name: "dm-rate-limit"
rate_limit: "10/hour"
on_deny: "Rate limit: max 10 DMs per hour"
createDirectMessagesByParticipantId:
rules:
- name: "dm-new-rate-limit"
rate_limit: "5/hour"
on_deny: "Rate limit: max 5 new DM conversations per hour"
sendChatMessage:
rules:
- name: "chat-rate-limit"
rate_limit: "10/hour"
on_deny: "Rate limit: max 10 chat messages per hour"
# === Rate limit social graph changes ===
followUser:
rules:
- name: "follow-rate-limit"
rate_limit: "10/hour"
on_deny: "Rate limit: max 10 follows per hour"
unfollowUser:
rules:
- name: "unfollow-rate-limit"
rate_limit: "10/hour"
on_deny: "Rate limit: max 10 unfollows per hour"
# === Global safety net ===
"*":
rules:
- name: "global-rate-limit"
rate_limit: "120/minute"
on_deny: "Global rate limit: max 120 tool calls per minute across all X tools"
This policy blocks all destructive tools outright, rate-limits public actions (posts, reposts, likes, DMs, follows), and applies a global cap to prevent runaway loops. Read operations pass through unrestricted.
Getting started
# Install Intercept
npm install -g @policylayer/intercept
# Run XMCP through Intercept with your policy
intercept -c x-policy.yaml -- python server.py
Save the YAML above as x-policy.yaml. Intercept proxies all MCP traffic through the policy engine — no changes to your agent or the XMCP server.
Adjust the limits to match your use case. A social media management agent might need higher post limits. A research agent that only reads trends and searches might not need write access at all — set default: "deny" and allowlist only the read tools.
The pattern is clear
Every major platform is shipping MCP servers. Stripe, GitHub, Slack, Cloudflare, and now X. None of them ship with access controls. The protocol does not require it, and the servers do not implement it.
X makes this pattern more visible because the consequences are public. A bad API call to Stripe affects your balance. A bad API call to X affects your reputation, in public, permanently.
The tools exist. The policies should too.
SOCIAL SHARE CARD GENERATOR