capx café

The safe way to let your AI run your X.

One MCP server. Your X token never touches the agent — and every post clears an enforced guardrail before it ships.

The guardrail, live — every verdict above is produced by the real chokepoint code (pnpm demo replays it).

capx café is an agent-native X poster that installs as one MCP server into any coding agent (Claude Code / Cursor / Codex / Windsurf). A whitelisted user connects their X account once; after that they create / schedule / post from inside their agent session. The whole product rests on one security thesis: the X token, the guardrail (casserole), and the send are one inseparable server-side unit — the agent on your laptop only ever holds a short-TTL session handle, never the token. That's why it structurally can't be prompt-injected into tweeting a scam. "The AI writes; casserole decides what ships."

Why it's different

Every other "let your AI post" tool has the same flaw: to let an agent post, you paste your X token into a plaintext config right next to an autonomous agent that reads untrusted web pages, issues, and code. One prompt-injection and your account tweets a scam. capx café is the only one that structurally can't be.

• 🔒 Your X token never touches your machine. OAuth completes on capx café's hosted callback; the token lives encrypted in a server-side vault. Your agent holds only a short-TTL, revocable session handle.
• 🛡️ casserole — a deterministic (non-AI) six-layer guardrail — runs server-side at the only door to X and checks every post. A blocked post never even decrypts your token (proven by an adversarial test suite).
• 🔗 The token, the guard, and the send are one unit. Skip the plugin and call the server directly — you still hit the guard. The client's checks are cosmetic; the server's are load-bearing.
• ✍️ capx generates nothing. Your agent's model writes; capx ships what clears the guard.

→ Full threat model, architecture & the "what we can/can't see" table: docs/SECURITY.md

How it works

flowchart LR
    subgraph M["🖥️  your machine · untrusted"]
        A["agent model<br/>writes the draft"]
        S["capx skills"]
        C["capx MCP client<br/>holds a session handle · NO token"]
    end
    subgraph K["🔒  capx chokepoint · hosted · AGPL-3.0"]
        AD["admission<br/>allowlist · kill-switch"]
        CAS["casserole<br/>6-layer guardrail"]
        V["vault<br/>the token lives here"]
        XA["x-adapter<br/>the only egress"]
    end
    X["🐦 X · /2/tweets"]
    A --> C
    S --> C
    C -->|"short-TTL handle<br/>crosses — never the token"| AD
    AD --> CAS
    CAS -->|PASS| V --> XA --> X
    CAS -.->|blocked / held| C

The token, the guardrail, and the send live together behind a trust boundary; your agent can only ask.

The guardrail: casserole

Six deterministic layers on every post. Worst result wins — pass / rewrite / hold / block — and a blocked post never even decrypts the token.

flowchart TD
    D["draft"] --> AD{"admitted?<br/>allowlisted · not killed"}
    AD -->|no| R["rejected"]
    AD -->|yes|

... [View full README on GitHub](https://github.com/vb-tyagi/capx-cafe#readme)