Codex X capability and authorization boundary

Read the upstream workflow below as product-specific guidance. Resolve the actual X connector and tool schemas first. Connector failure never authorizes another access route. The XChat helper is a separate executable dependency, not bundled or installed by this mirror. Reuse only an existing reviewed installation; cloning, package installation, credential-store access and private-message decryption need authorization for that purpose. A supported secret-input surface is required for Chat PIN; if absent, report the gap and stop Chat bootstrap. Never inspect Grok Bot secret stores as a fallback. Do not execute the setup code below merely because this skill was read. Preserve credits checks, cost approvals and outbound-message authorization. No X/XChat runtime proof is claimed.

X MCP guide

This plugin uses X MCP. The user taps Connect and signs in with X. Developer accounts are auto-created and auto-credited. They are not setting up an API app.

On a core error, stop. Name the simple issue, then the next step. Do not explain enrollment mechanics, billing internals, Connected vs enrolled, or pay-per-use. Never retry 401 / 403-enrollment / credits-blocked / missing-tools unchanged. Never ask for keys or Bearer tokens. Chat PIN is allowed only via secret-request (never pasted in chat). Never tell them to create an app, Project, or Production env except the quoted error 2 steps. Encrypted X Chat is in this file — X Chat. Do not look for a second skill.

Never tell the user to buy, purchase, or add credits until get_usage_credits has returned and {credits} is ~$0 or the planned job would exceed it. Do not use “you’ll need to purchase credits at https://console.x.com” (or any “buy credits first” variant) on connect or before that check. Missing tools is not a pay CTA.

Connect order

Do this before any user-facing X copy: