XActions is Apache-2.0. This file records every outside project whose code or design shaped part of this repository, what was taken, and under which licence. It exists for two reasons: Apache-2.0 obliges us to keep upstream attribution with adapted code, and a project that borrows well should say so.
No third-party source tree is copied into this repository. The entries below
are either small adaptations written into our own modules, or designs we
reimplemented from scratch. Two exceptions are data rather than code, both MIT
and both recorded in the table: tests/fixtures/upstream/ holds excerpts of the
JSON that npm run sync:endpoints and npm run sync:user-agents read, kept so
their tests run offline, and each generated module carries the attribution in
its own header.
Our licence choice constrains what can be copied in. The rule is simple and non-negotiable:
| Upstream licence | What we may do |
|---|---|
| MIT, BSD, ISC, Apache-2.0, Unlicense, CC0 | Adapt the code, keeping the upstream copyright line and licence in the file that carries it, and add a row below |
| GPL, LGPL, AGPL, SSPL, MPL | Ideas only. Read it, understand the mechanism, write our own. Never paste a line, never a derivative file |
| CC-BY-SA and other share-alike | Ideas only, same as copyleft |
| No LICENSE file at all | Ideas only. No licence means no grant, whatever the README says |
Two practical notes. Facts are not expression: an endpoint path, a query ID, a header name, or a rate-limit number can be recorded from any source, because those are observations of X's behaviour rather than someone's creative work. And an interface is not an implementation: reading a project's public API to match a shape is fine everywhere on this table.
When in doubt, add the dependency instead of copying it, or write it yourself.
| Upstream | Licence | What we adapted | Where it lives |
|---|---|---|---|
| d60/twikit | MIT | GraphQL endpoint table, feature-flag defaults, and v1.1 REST paths, since verified and refreshed against x.com's own bundles | src/scrapers/twitter/http/endpoints.js, src/client/api/graphqlQueries.js |
| the-convocation/twitter-scraper | MIT | The public guest bearer token and parts of the media and timeline parsing shapes | src/scrapers/twitter/http/endpoints.js, src/scrapers/twitter/http/media.js |
| nirholas/xeepy | Apache-2.0 (same author) | Tool behaviours ported from the Python twin | src/mcp/server.js |
| fa0311/TwitterInternalAPIDocument | MIT | The GraphQL operation table (query ID, operation name, type), the feature-switch values and field-toggle names x.com's own client sends, and the v1.1 REST dispatch table, from docs/json/GraphQL.json and docs/json/v1.1.json on the develop branch. Regenerated by npm run sync:endpoints |
src/scrapers/twitter/http/x-endpoints.generated.js, scripts/sync-x-endpoints.mjs, tests/fixtures/upstream/x-endpoints/ |
| fa0311/latest-user-agent | MIT | Current browser User-Agent strings and the request headers that accompany them, including the Sec-CH-UA brand lists, from output.json and header.json. Regenerated by npm run sync:user-agents |
src/client/auth/userAgents.generated.js, scripts/sync-user-agents.mjs, tests/fixtures/upstream/user-agents/ |
| Lqm1/x-client-transaction-id | MIT (Copyright 2025 Lami) | The x-client-transaction-id algorithm: key-byte index extraction from the ondemand.s chunk, the cubic-bezier animation key, and the SHA-256 plus XOR payload assembly. Ported to plain regex reads so no DOM library is pulled in, and to the chunk resolver query-ID discovery already has. Verified byte-identical against the upstream package |
src/scrapers/twitter/http/transactionId.js |
| Upstream | Licence | The idea we took | Our implementation |
|---|---|---|---|
| vladkens/twscrape | MIT | An account pool that leases the least-recently-used session and parks one until its rate-limit window resets | src/scrapers/twitter/http/accountPool.js |
| ihuzaifashoukat/x-use | MIT | Holding every write as a draft for human approval, and daily per-account action caps that survive a restart | src/mcp/drafts.js, src/mcp/action-caps.js |
| xdevplatform/xmcp | No LICENSE file, ideas only | Trimming a large tool list with an allowlist so a client's context is not flooded | src/mcp/tool-groups.js |
| steipete/bird | Ideas only | Refreshing GraphQL query IDs from x.com's own JavaScript bundles rather than pinning them | src/scrapers/twitter/http/queryIds.js |
| Altimis/Scweet | MIT | Saving a cursor per run so an interrupted scrape resumes where it stopped | src/scrapers/twitter/http/checkpoint.js |
| Stripe and GitHub webhook conventions | Documentation | Signing <timestamp>.<body> so a captured delivery cannot be replayed |
src/notifications/webhook.js |
| fa0311/x-client-transaction-id-pair-dict | MIT | Publishing known-good {animationKey, verification} pairs so a cold start can sign a request without parsing x.com's bundles. We read the published dictionary at runtime and vendor none of it |
src/scrapers/twitter/http/transactionId.js |
| d60/twikit | MIT | The live_pipeline session shape: one long-lived event connection, a session id handed back in the first frame, and mid-session subscription changes keyed by that id. Endpoint paths, topic strings and frame keys are observations of x.com, verified against the live service; the client, its normalised events, backoff and fallback are ours | src/streaming/livePipeline.js |
| vercel-labs/skills | MIT | Nothing from their CLI: xactions skills install stays. What we took is the discovery contract it implements, the Agent Skills specification, so any third-party installer resolves our catalogue. Our tree was audited field by field against that spec |
skills/*/SKILL.md, docs/skills.md |
| karanb192/reddit-mcp-buddy | MIT | Shipping the MCP server as a drag-and-drop .mcpb release artifact whose manifest collects its secrets at install time, so nobody hand-edits a JSON config. Written against Anthropic's published MCPB manifest spec and packed with the official @anthropic-ai/mcpb CLI |
scripts/build-mcpb.mjs, .github/workflows/release-mcpb.yml |
| cosinusalpha/webctl | No LICENSE file, ideas only | Running a CLI lane beside the MCP lane, and telling the agent when one shell call is cheaper than loading a large tool list. Their comparison is the argument for the lane; the decision table, the flags and the recipes are ours | AGENTS.md, docs/mcp-setup.md |
These solve problems we care about, and their licences do not allow their code in an Apache-2.0 project. Where we want the capability, we write our own.
| Upstream | Licence | Why it is ideas-only for us |
|---|---|---|
| mikf/gallery-dl | GPL-2.0 | Copyleft. Its media coverage is a benchmark to match, not a source to copy |
| alkihis/twitter-archive-reader | CC-BY-SA-4.0 | Share-alike. Our archive importer was written from the file format, not from its code |
| gitroomhq/postiz-app | AGPL-3.0 | Strong copyleft. Scheduling ideas only |
| mahrtayyab/tweety | No LICENSE file | No grant, so no code |
If you adapt third-party code, do three things in the same change: keep the upstream copyright and licence notice in the file you put it in, add a row to the table above, and say in the pull request which upstream file it came from. If you only took the idea, add a row to the second table instead. If the upstream is copyleft, share-alike, or unlicensed, do not send the code at all.