Announcing Beacon: Self-improving memory for coding agents
BeaconIntel
2.9K
← All MCP servers
MCP server

io.github.yxs1640-png/xflux

mcp:yxs1640-png/xflux

X/Twitter read API for agents: search, timelines, Smart Money. Claude/Cursor MCP. Not for posting.

awesome-mcp-serversGlamaMCP Registry
Verdict
No issues found

No suspicious or malicious behavior was found.

Analyzed Oct 26, 2026, 13:20 UTC at 4d05082

Dispute security verdict

If you believe this verdict is incorrect, submit a dispute and we'll review it.

0
findings
—
highest severity
0
threat classes
422
files scanned
171/171
checks satisfied
0
package advisories

Why this verdict

  • benign: 171 checks satisfied, no findings for mcp-server:mcp-server

Security findings 0

No security findings

No suspicious or malicious behavior was found; 2 candidate findings were refuted on review.
Refuted findings 2

Candidates the review stage examined and rejected, kept for transparency.

Supply chain

mediumRefutedlow confidence

The lockfile resolves every dependency tarball from the third-party registry.npmmirror.com mirror instead of the official npm registry, which redirects installs to a non-default registry.

mcp-server/package-lock.json:24
"resolved": "https://registry.npmmirror.com/@hono/node-server/-/node-server-2.1.1.tgz"
Why it was refuted

The lockfile uses npmmirror.com, a well-known public npm mirror, and pins every tarball with a sha512 integrity hash. Nothing shows tampered or malicious packages, and there is no instruction or source-to-sink chain, so this is only a registry-choice observation.

Supply chain

mediumRefutedmedium confidence

The package-lock.json resolves every dependency from the third-party mirror registry.npmmirror.com instead of the official npm registry, redirecting installs away from the official registry (undeclared); integrity hashes are present, which limits but does not remove the risk.

mcp-server/package-lock.json:850
"resolved": "https://registry.npmmirror.com/path-to-regexp/-/path-to-regexp-8.4.2.tgz"
Why it was refuted

The path-to-regexp entry is a standard dependency of express/router, resolved from the public npmmirror mirror and pinned by an integrity hash. This is a registry-choice observation with no concrete malicious behavior or chain.