{
  "markdown": "<div align=\"center\">\n\n<img src=\"docs/assets/cover.png\" alt=\"capx café — the safe way to let your AI run your X\" width=\"100%\">\n\n# capx café\n\n### The safe way to let your AI run your X.\n\n**One MCP server. Your X token never touches the agent — and every post clears an enforced guardrail before it ships.**\n\n![license](https://img.shields.io/badge/license-MIT%20client%20%2F%20AGPL--3.0%20server-4c8bf5?style=flat-square)\n![node](https://img.shields.io/badge/node-%E2%89%A5%2022.6-3fb950?style=flat-square)\n![agents](https://img.shields.io/badge/agents-Claude%20Code%20·%20Cursor%20·%20Codex%20·%20Windsurf-14b8a6?style=flat-square)\n![status](https://img.shields.io/badge/status-beta-f59e0b?style=flat-square)\n\n<br>\n\n<img src=\"landing/assets/demo.gif\" alt=\"20-second demo: a prompt-injected scam draft is BLOCKED by casserole with live reasons; a real build update passes and posts; the token never leaves the server vault\" width=\"820\">\n\n*The guardrail, live — every verdict above is produced by the real chokepoint code (`pnpm demo` replays it).*\n\n</div>\n\n---\n\n> **capx café is an agent-native X poster that installs as one MCP server into any coding agent** (Claude Code /\n> Cursor / Codex / Windsurf). A whitelisted user connects their X account once; after that they create /\n> schedule / post from inside their agent session. The whole product rests on one **security thesis**: the X\n> token, the guardrail (**casserole**), and the send are **one inseparable server-side unit** — the agent on\n> your laptop only ever holds a short-TTL session handle, never the token. That's why it structurally can't be\n> prompt-injected into tweeting a scam. **\"The AI writes; casserole decides what ships.\"**\n\n---\n\n## Why it's different\n\nEvery other \"let your AI post\" tool has the same flaw: to let an agent post, you paste your X token into a\nplaintext config **right next to an autonomous agent that reads untrusted web pages, issues, and code.** One\nprompt-injection and your account tweets a scam. **capx café is the only one that structurally can't be.**\n\n- 🔒 **Your X token never touches your machine.** OAuth completes on capx café's hosted callback; the token lives\n  **encrypted in a server-side vault.** Your agent holds only a short-TTL, revocable session handle.\n- 🛡️ **casserole** — a *deterministic (non-AI)* six-layer guardrail — runs **server-side at the only door to X**\n  and checks **every** post. A blocked post never even decrypts your token (proven by an adversarial test suite).\n- 🔗 **The token, the guard, and the send are one unit.** Skip the plugin and call the server directly — you\n  still hit the guard. The client's checks are cosmetic; the server's are load-bearing.\n- ✍️ **capx generates nothing.** *Your* agent's model writes; capx ships what clears the guard.\n\n→ Full threat model, architecture & the \"what we can/can't see\" table: **[docs/SECURITY.md](docs/SECURITY.md)**\n\n## How it works\n\n```mermaid\nflowchart LR\n    subgraph M[\"🖥️  your machine · untrusted\"]\n        A[\"agent model<br/>writes the draft\"]\n        S[\"capx skills\"]\n        C[\"capx MCP client<br/>holds a session handle · NO token\"]\n    end\n    subgraph K[\"🔒  capx chokepoint · hosted · AGPL-3.0\"]\n        AD[\"admission<br/>allowlist · kill-switch\"]\n        CAS[\"casserole<br/>6-layer guardrail\"]\n        V[\"vault<br/>the token lives here\"]\n        XA[\"x-adapter<br/>the only egress\"]\n    end\n    X[\"🐦 X · /2/tweets\"]\n    A --> C\n    S --> C\n    C -->|\"short-TTL handle<br/>crosses — never the token\"| AD\n    AD --> CAS\n    CAS -->|PASS| V --> XA --> X\n    CAS -.->|blocked / held| C\n```\n\nThe token, the guardrail, and the send live together behind a trust boundary; your agent can only *ask*.\n\n## The guardrail: casserole\n\nSix deterministic layers on every post. Worst result wins — **pass / rewrite / hold / block** — and a blocked\npost never even decrypts the token.\n\n```mermaid\nflowchart TD\n    D[\"draft\"] --> AD{\"admitted?<br/>allowlisted · not killed\"}\n    AD -->|no| R[\"rejected\"]\n    AD -->|yes| CAS[\"casserole<br/>L1 eligibility · L2 rate · L3 anti-slop<br/>L4 authenticity · L5 kill-switch · L6 audit\"]\n    CAS --> VER{\"verdict\"}\n    VER -->|block| B[\"blocked — never sent<br/>🔒 token never decrypted\"]\n    VER -->|hold| H[\"held for your review\"]\n    VER -->|rewrite| RW[\"ask the agent to fix\"]\n    VER -->|pass| SEND[\"vault → x-adapter → X  ✅\"]\n```\n\n## 60-second quickstart\n\n```bash\nnpx -y capx-cafe          # runs the MCP server — add it to your agent's MCP config\n```\n\nThen, inside your agent:\n\n```text\n\"connect my X account\"              → opens a browser once; the token stays on the server\n\"post: shipping the thing today\"    → clears casserole, or tells you exactly why not\n\"turn my last week of commits into a build-in-public thread\"   → drafts + queues it\n```\n\nSet `CAPX_EMAIL` (your whitelisted email) and, for the BYO lane, `X_CLIENT_ID` (your own X app) in\n`~/.capx/config.json` or your agent's MCP env. A guided setup page hands you the exact callback URL to paste.\n\n### Install matrix\n\n| Agent | How |\n|---|---|\n| **Claude Code** | `/plugin marketplace add vb-tyagi/capx-cafe` → `/plugin install capx-cafe` (MCP + slash commands + skills) |\n| **Cursor** | add to `.cursor/mcp.json`; skill rules in `plugins/capx-cafe/adapters/cursor/` |\n| **Codex** | add to your MCP config; prompt pack in `plugins/capx-cafe/adapters/codex/` |\n| **Windsurf** | add to MCP config; workflows in `plugins/capx-cafe/adapters/windsurf/` |\n| **Any MCP agent** | point it at `npx -y capx-cafe` |\n| **Docker Desktop** | `docker mcp catalog pull ghcr.io/vb-tyagi/capx-catalog:latest` → MCP Toolkit → enable **capx café** |\n\n## What your agent can do\n\n| Tool | What it does |\n|---|---|\n| `connect_x` | One-time browser OAuth — the token lands in the server vault, never on your machine |\n| `post_now` | Post now (clears casserole first). Supports **reply-chains** and **media** |\n| `preview` | **Dry-run** a draft through the guardrail without sending — pass / hold / block + why |\n| `audit` | The durable record of what capx posted or attempted on your behalf, and its state |\n| `create_loop` · `list_loops` · … | **Scheduled posting** — a queue you wrote, sent on a schedule, **laptop-off** |\n| `upload_media` | Stream a local image/video to X and attach it (media you made with your own tools) |\n| `whoami` | The connected account + its status |\n\n## Skills — your work becomes your content\n\ncapx lives inside a *coding* agent, so it has what no social scheduler does: your **repo, commits, PRs,\nreleases.** Skills turn that into posts — automatically, and always through the guardrail.\n\n```mermaid\nflowchart LR\n    G[\"git commits\"] --> BIP[\"build-in-public<br/>drafts a week of posts\"]\n    BIP --> Q[\"loop queue\"]\n    Q -->|\"1/day · laptop-off\"| POST[\"posted to X\"]\n    Q -.->|\"runs low\"| GAP[\"gap-alert\"]\n    GAP -.->|\"top up from new commits\"| BIP\n```\n\n**The self-refilling content engine:** you code → commits accrue → the loop drains as it posts → gap-alert\ntops it up from the *new* commits. Your normal work *is* the pipeline.\n\n- 🏆 **build-in-public** · **ship-note** · **changelog-thread** · **repurpose** (blog/README → thread) · **launch-thread** · **til** · **fix-note**\n- **voice-match** (sound like you) · **draft-review** (lint against the guard) · **thread-builder** · **hook-rewrite**\n- **best-time** · **cadence-planner** · **gap-alert** · **audit-trail** · **connection-health** · **quickstart** · **self-host-guide**\n- **Media directors** — `image-director`, `video-director`, `prompt-engine`, `model-guide`: capx runs no models;\n  it guides *your* image/video tools (higgsfield, fal, kling, …) and uploads the result. casserole guards your\n  **caption**; you own the media.\n\n*One canonical `SKILL.md` per skill, generated for all four agents. capx never writes the content — it makes\ngood content easy and stops bad content regardless of which skill produced it.*\n\n## Two lanes\n\n- **BYO** — bring your own X developer app. You're X's customer and **pay X directly** — since Feb 2026\n  that means pre-loading credits (no free X tier for new apps) at ~$0.015/post, **$0.20 if the post\n  contains a link**. Free on capx café's side; heavy users can self-host the identical image.\n- **capx-app** (creator lane) — post through capx café's shared X app, no developer account needed. Opening as a\n  **paid beta** (waitlist): `Short $5` / `Tall $15` / `Grande $35` monthly tiers + top-up packs, quotas enforced\n  server-side at the gate. Full sheet + the math: **[docs/ECONOMICS.md](docs/ECONOMICS.md)** · policy\n  posture: [docs/X-COMPLIANCE.md](docs/X-COMPLIANCE.md).\n\n## Self-host\n\nThe chokepoint is open source (AGPL-3.0). Run the **identical image** with your own X app, keys, database, and\ndomain — `CAPX_DEPLOY_MODE=self-host`, zero telemetry to capx. See the `self-host-guide` skill and\n[docs/HANDOFF.md](docs/HANDOFF.md).\n\n## Licensing\n\n**MIT** for the client and everything it bundles (`apps/capx-mcp`, `core`, `config`, `platform-client`) plus\nskills & docs. **AGPL-3.0** for the server half (the chokepoint + `casserole`/`captain`/`counter`/`canteen`/\n`chef`). Full map: **[LICENSING.md](LICENSING.md)**.\n\n## Status\n\n**Private alpha, whitelist-only.** The first real post shipped **2026-07-19** — guardrail-cleared, token never\non the machine. Not yet open for public signups.\n\n## Dev\n\nNode ≥ 22.6 (TypeScript runs natively via `--experimental-strip-types` — no build step). `pnpm run verify` =\nunit tests across packages / services / apps + `tsc`. Contributions accepted under the project CLA.\n\n<div align=\"center\"><sub>capx café · <a href=\"docs/SECURITY.md\">security</a> · <a href=\"docs/HANDOFF.md\">architecture</a> · <a href=\"LICENSING.md\">license</a></sub></div>\n",
  "bytes": 9691,
  "sha": "dd1c7ef5eadb54a11fcb701eb61c6618368d6faacb75f1ab4ebd2771a7983d4a",
  "repo_slug": "vb-tyagi/capx-cafe",
  "fonte": "repo",
  "truncated": false,
  "api": "https://agentalog.com/api/listings/mcp_io_github_vb_tyagi_capx_cafe_1009a47c/readme"
}