{
  "schemaVersion": "1.0",
  "item": {
    "slug": "xpoz-setup",
    "name": "Xpoz Setup",
    "source": "tencent",
    "type": "skill",
    "category": "开发工具",
    "sourceUrl": "https://clawhub.ai/atyachin/xpoz-setup",
    "canonicalUrl": "https://clawhub.ai/atyachin/xpoz-setup",
    "targetPlatform": "OpenClaw"
  },
  "install": {
    "downloadMode": "redirect",
    "downloadUrl": "/downloads/xpoz-setup",
    "sourceDownloadUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=xpoz-setup",
    "sourcePlatform": "tencent",
    "targetPlatform": "OpenClaw",
    "installMethod": "Manual import",
    "extraction": "Extract archive",
    "prerequisites": [
      "OpenClaw"
    ],
    "packageFormat": "ZIP package",
    "includedAssets": [
      "SKILL.md",
      "scripts/oauth-remote.sh"
    ],
    "primaryDoc": "SKILL.md",
    "quickSetup": [
      "Download the package from Yavira.",
      "Extract the archive and review SKILL.md first.",
      "Import or place the package into your OpenClaw setup."
    ],
    "agentAssist": {
      "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
      "steps": [
        "Download the package from Yavira.",
        "Extract it into a folder your agent can access.",
        "Paste one of the prompts below and point your agent at the extracted folder."
      ],
      "prompts": [
        {
          "label": "New install",
          "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
        },
        {
          "label": "Upgrade existing",
          "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
        }
      ]
    },
    "sourceHealth": {
      "source": "tencent",
      "status": "healthy",
      "reason": "direct_download_ok",
      "recommendedAction": "download",
      "checkedAt": "2026-05-07T17:22:31.273Z",
      "expiresAt": "2026-05-14T17:22:31.273Z",
      "httpStatus": 200,
      "finalUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=afrexai-annual-report",
      "contentType": "application/zip",
      "probeMethod": "head",
      "details": {
        "probeUrl": "https://wry-manatee-359.convex.site/api/v1/download?slug=afrexai-annual-report",
        "contentDisposition": "attachment; filename=\"afrexai-annual-report-1.0.0.zip\"",
        "redirectLocation": null,
        "bodySnippet": null
      },
      "scope": "source",
      "summary": "Source download looks usable.",
      "detail": "Yavira can redirect you to the upstream package for this source.",
      "primaryActionLabel": "Download for OpenClaw",
      "primaryActionHref": "/downloads/xpoz-setup"
    },
    "validation": {
      "installChecklist": [
        "Use the Yavira download entry.",
        "Review SKILL.md after the package is downloaded.",
        "Confirm the extracted package contains the expected setup assets."
      ],
      "postInstallChecks": [
        "Confirm the extracted package includes the expected docs or setup files.",
        "Validate the skill or prompts are available in your target agent workspace.",
        "Capture any manual follow-up steps the agent could not complete."
      ]
    },
    "downloadPageUrl": "https://openagent3.xyz/downloads/xpoz-setup",
    "agentPageUrl": "https://openagent3.xyz/skills/xpoz-setup/agent",
    "manifestUrl": "https://openagent3.xyz/skills/xpoz-setup/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/xpoz-setup/agent.md"
  },
  "agentAssist": {
    "summary": "Hand the extracted package to your coding agent with a concrete install brief instead of figuring it out manually.",
    "steps": [
      "Download the package from Yavira.",
      "Extract it into a folder your agent can access.",
      "Paste one of the prompts below and point your agent at the extracted folder."
    ],
    "prompts": [
      {
        "label": "New install",
        "body": "I downloaded a skill package from Yavira. Read SKILL.md from the extracted folder and install it by following the included instructions. Tell me what you changed and call out any manual steps you could not complete."
      },
      {
        "label": "Upgrade existing",
        "body": "I downloaded an updated skill package from Yavira. Read SKILL.md from the extracted folder, compare it with my current installation, and upgrade it while preserving any custom configuration unless the package docs explicitly say otherwise. Summarize what changed and any follow-up checks I should run."
      }
    ]
  },
  "documentation": {
    "source": "clawhub",
    "primaryDoc": "SKILL.md",
    "sections": [
      {
        "title": "Xpoz Setup",
        "body": "Automatic MCP server setup and authentication for Xpoz — the social intelligence platform.\n\nThis skill is a prerequisite for all Xpoz skills. It configures the Xpoz MCP server and handles OAuth login so your agent can access Twitter, Instagram, TikTok, and Reddit data."
      },
      {
        "title": "Agent Instructions",
        "body": "If you're an agent reading this, follow these steps in order. The user should not need to run any commands."
      },
      {
        "title": "Step 1: Check if already authenticated",
        "body": "mcporter call xpoz.checkAccessKeyStatus\n\nIf hasAccessKey: true → STOP. Xpoz is ready. Return to the skill that sent you here.\nIf it fails, returns false, or the server isn't configured → continue."
      },
      {
        "title": "Step 2: Check if mcporter is available",
        "body": "which mcporter\n\nIf not found, stop and inform the user. mcporter is included with OpenClaw — if it's missing, the OpenClaw installation may be incomplete. Do not install mcporter independently. Tell the user:\n\n\"mcporter is required but not found. It's included with OpenClaw — please ensure OpenClaw is properly installed.\""
      },
      {
        "title": "Step 3: Add the Xpoz MCP server",
        "body": "mcporter config add xpoz https://mcp.xpoz.ai/mcp --auth oauth\n\nThis registers Xpoz as a remote HTTP MCP server with OAuth authentication. mcporter auto-discovers the OAuth endpoints from https://mcp.xpoz.ai/.well-known/oauth-authorization-server.\n\nIf the server already exists but auth failed, skip this step."
      },
      {
        "title": "Step 4: Detect environment (local vs remote)",
        "body": "Determine whether you're running on a local machine with a browser or a remote/headless server:\n\n# Check for display server (Linux) or macOS\necho \"DISPLAY=${DISPLAY:-unset} WAYLAND=${WAYLAND_DISPLAY:-unset} OS=$(uname)\"\n\nLocal machine = any of these is true:\n\n$DISPLAY is set (Linux with X11)\n$WAYLAND_DISPLAY is set (Linux with Wayland)\nuname returns Darwin (macOS)\n\nRemote/headless = none of the above.\n\nThen follow the appropriate flow:"
      },
      {
        "title": "Step 4a: LOCAL — Browser flow (automatic)",
        "body": "mcporter config login xpoz\n\nmcporter opens the user's default browser, the user authorizes, the callback completes automatically. Tell the user:\n\n\"I'm connecting you to Xpoz for social media intelligence. A browser window should open — just sign in with your Google account and click Authorize. That's all you need to do!\"\n\nThen skip to Step 5."
      },
      {
        "title": "Step 4b: REMOTE — Manual code flow",
        "body": "On a headless server, mcporter config login xpoz will crash trying to open a browser. Instead, handle the OAuth flow manually:\n\n4b-i. Build the authorization URL\n\nRun this script to generate the OAuth authorization URL with PKCE:\n\nbash \"$(dirname \"$0\")/../xpoz-setup/scripts/oauth-remote.sh\" get-url\n\nOr if the script isn't available, build it manually:\n\nimport secrets, hashlib, base64, urllib.parse, os\n\nos.makedirs(os.path.expanduser('~/.cache/xpoz-oauth'), exist_ok=True)\n\n# Generate PKCE\nverifier = secrets.token_urlsafe(64)\nchallenge = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b'=').decode()\nstate = secrets.token_urlsafe(32)\n\nparams = {\n    'response_type': 'code',\n    'code_challenge': challenge,\n    'code_challenge_method': 'S256',\n    'redirect_uri': 'https://www.xpoz.ai/oauth/openclaw',\n    'state': state,\n    'scope': 'mcp:tools',\n    'resource': 'https://mcp.xpoz.ai/',\n}\n\n# Step 1: Dynamic client registration\nimport json, urllib.request\nreg_req = urllib.request.Request(\n    'https://mcp.xpoz.ai/oauth/register',\n    data=json.dumps({\n        'client_name': 'OpenClaw Agent',\n        'redirect_uris': ['https://www.xpoz.ai/oauth/openclaw'],\n        'grant_types': ['authorization_code'],\n        'response_types': ['code'],\n        'token_endpoint_auth_method': 'none',\n    }).encode(),\n    headers={'Content-Type': 'application/json'},\n)\nreg_resp = json.loads(urllib.request.urlopen(reg_req).read())\nparams['client_id'] = reg_resp['client_id']\n\nauth_url = 'https://mcp.xpoz.ai/oauth/authorize?' + urllib.parse.urlencode(params)\n\n# Save state for later token exchange\nwith open(os.path.expanduser('~/.cache/xpoz-oauth/state.json'), 'w') as f:\n    json.dump({'verifier': verifier, 'state': state, 'client_id': reg_resp['client_id'], 'redirect_uri': params['redirect_uri']}, f)\n\nprint(auth_url)\n\n4b-ii. Send the URL to the user\n\nSend the authorization URL to the user via the active chat channel with a message like:\n\n\"I need to connect to Xpoz for social media search. Please open this link and sign in with your Google account:\n[authorization URL]\nAfter you authorize, Xpoz will show you an authorization code. Just paste it back to me here!\"\n\n4b-iii. WAIT for the user's reply\n\nSTOP here and wait. Do not proceed until the user replies with the authorization code. The user needs time to open the link, sign in, and authorize. Only continue once they paste the code back in chat.\n\n4b-iv. Extract the code from the user's reply\n\nThe user will paste back either:\n\nJust the code: AUTH_CODE_HERE\nOr a full URL: https://www.xpoz.ai/oauth/openclaw?code=AUTH_CODE_HERE&state=...\n\nIf they pasted a URL, extract the code parameter. If they pasted a raw string, use it directly.\n\n4b-v. Exchange the code and configure mcporter\n\nRun the exchange script with the code. This exchanges the code for a token and configures mcporter in one step — the token is never printed or exposed:\n\nbash \"$(dirname \"$0\")/../xpoz-setup/scripts/oauth-remote.sh\" exchange AUTH_CODE_HERE\n\nExpected output: OK: Xpoz configured successfully\n\nSecurity notes:\n\nThe access token is never printed to stdout or logs\nThe OAuth state file (~/.cache/xpoz-oauth/state.json) is automatically deleted after exchange\nTokens are stored only in the mcporter config\n\nThen proceed to Step 5 to verify."
      },
      {
        "title": "Step 5: Verify authentication",
        "body": "mcporter call xpoz.checkAccessKeyStatus\n\nConfirm hasAccessKey: true. If not:\n\nLocal: Retry mcporter config login xpoz\nRemote: Ask the user if they completed authorization, resend the link if needed"
      },
      {
        "title": "Step 6: Return to the calling skill",
        "body": "Setup is complete. Go back to the skill that referenced this one and continue fulfilling the user's request. Don't make the user wait — they asked you to do something, auth was just a prerequisite."
      },
      {
        "title": "What Is Xpoz?",
        "body": "Xpoz is a remote MCP server for social media intelligence:\n\nPlatforms: Twitter, Instagram, TikTok, Reddit\nScale: 1.5B+ posts indexed\nFeatures: Search posts by keyword, find people by topic, profile lookup, engagement filtering, CSV export\nAuth: OAuth 2.1 with dynamic client registration (PKCE, public clients)\nSetup: Fully remote — no npm packages, no local installation, no API keys to copy\n\nFree tier available — no credit card required.\n\nWebsite: xpoz.ai"
      },
      {
        "title": "OAuth Discovery",
        "body": "Xpoz publishes a standard OAuth 2.1 authorization server metadata document:\n\nGET https://mcp.xpoz.ai/.well-known/oauth-authorization-server\n\nKey endpoints:\n\nAuthorization: https://mcp.xpoz.ai/oauth/authorize\nToken: https://mcp.xpoz.ai/oauth/token\nDynamic registration: https://mcp.xpoz.ai/oauth/register\nPKCE: S256 supported\nPublic clients: token_endpoint_auth_methods_supported includes none\n\nmcporter handles all of this automatically — you don't need to call these endpoints directly."
      },
      {
        "title": "Server Configuration",
        "body": "After setup, the mcporter config will contain:\n\n{\n  \"xpoz\": {\n    \"transport\": \"http\",\n    \"url\": \"https://mcp.xpoz.ai/mcp\"\n  }\n}\n\nOAuth tokens are managed by mcporter separately from the server config."
      },
      {
        "title": "Troubleshooting",
        "body": "ProblemSolutionmcporter not foundEnsure OpenClaw is properly installed (mcporter is included)Browser doesn't openHeadless server — capture the URL from stdout and send to user\"Unauthorized\" after loginmcporter config login xpoz --resetAuth times outUser may not have completed the browser flow — resend the URLServer already existsSkip Step 3, just run Step 4"
      },
      {
        "title": "Plans & Pricing",
        "body": "PlanPriceIncludesFree$0/moLimited searches, all platformsPro$20/moUnlimited searchesMax$200/moUnlimited + priority + bulk export\n\nDetails: xpoz.ai\n\nBuilt for ClawHub • Prerequisite for all Xpoz skills"
      }
    ],
    "body": "Xpoz Setup\n\nAutomatic MCP server setup and authentication for Xpoz — the social intelligence platform.\n\nThis skill is a prerequisite for all Xpoz skills. It configures the Xpoz MCP server and handles OAuth login so your agent can access Twitter, Instagram, TikTok, and Reddit data.\n\nAgent Instructions\n\nIf you're an agent reading this, follow these steps in order. The user should not need to run any commands.\n\nStep 1: Check if already authenticated\nmcporter call xpoz.checkAccessKeyStatus\n\nIf hasAccessKey: true → STOP. Xpoz is ready. Return to the skill that sent you here.\nIf it fails, returns false, or the server isn't configured → continue.\nStep 2: Check if mcporter is available\nwhich mcporter\n\n\nIf not found, stop and inform the user. mcporter is included with OpenClaw — if it's missing, the OpenClaw installation may be incomplete. Do not install mcporter independently. Tell the user:\n\n\"mcporter is required but not found. It's included with OpenClaw — please ensure OpenClaw is properly installed.\"\n\nStep 3: Add the Xpoz MCP server\nmcporter config add xpoz https://mcp.xpoz.ai/mcp --auth oauth\n\n\nThis registers Xpoz as a remote HTTP MCP server with OAuth authentication. mcporter auto-discovers the OAuth endpoints from https://mcp.xpoz.ai/.well-known/oauth-authorization-server.\n\nIf the server already exists but auth failed, skip this step.\n\nStep 4: Detect environment (local vs remote)\n\nDetermine whether you're running on a local machine with a browser or a remote/headless server:\n\n# Check for display server (Linux) or macOS\necho \"DISPLAY=${DISPLAY:-unset} WAYLAND=${WAYLAND_DISPLAY:-unset} OS=$(uname)\"\n\n\nLocal machine = any of these is true:\n\n$DISPLAY is set (Linux with X11)\n$WAYLAND_DISPLAY is set (Linux with Wayland)\nuname returns Darwin (macOS)\n\nRemote/headless = none of the above.\n\nThen follow the appropriate flow:\n\nStep 4a: LOCAL — Browser flow (automatic)\nmcporter config login xpoz\n\n\nmcporter opens the user's default browser, the user authorizes, the callback completes automatically. Tell the user:\n\n\"I'm connecting you to Xpoz for social media intelligence. A browser window should open — just sign in with your Google account and click Authorize. That's all you need to do!\"\n\nThen skip to Step 5.\n\nStep 4b: REMOTE — Manual code flow\n\nOn a headless server, mcporter config login xpoz will crash trying to open a browser. Instead, handle the OAuth flow manually:\n\n4b-i. Build the authorization URL\n\nRun this script to generate the OAuth authorization URL with PKCE:\n\nbash \"$(dirname \"$0\")/../xpoz-setup/scripts/oauth-remote.sh\" get-url\n\n\nOr if the script isn't available, build it manually:\n\nimport secrets, hashlib, base64, urllib.parse, os\n\nos.makedirs(os.path.expanduser('~/.cache/xpoz-oauth'), exist_ok=True)\n\n# Generate PKCE\nverifier = secrets.token_urlsafe(64)\nchallenge = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b'=').decode()\nstate = secrets.token_urlsafe(32)\n\nparams = {\n    'response_type': 'code',\n    'code_challenge': challenge,\n    'code_challenge_method': 'S256',\n    'redirect_uri': 'https://www.xpoz.ai/oauth/openclaw',\n    'state': state,\n    'scope': 'mcp:tools',\n    'resource': 'https://mcp.xpoz.ai/',\n}\n\n# Step 1: Dynamic client registration\nimport json, urllib.request\nreg_req = urllib.request.Request(\n    'https://mcp.xpoz.ai/oauth/register',\n    data=json.dumps({\n        'client_name': 'OpenClaw Agent',\n        'redirect_uris': ['https://www.xpoz.ai/oauth/openclaw'],\n        'grant_types': ['authorization_code'],\n        'response_types': ['code'],\n        'token_endpoint_auth_method': 'none',\n    }).encode(),\n    headers={'Content-Type': 'application/json'},\n)\nreg_resp = json.loads(urllib.request.urlopen(reg_req).read())\nparams['client_id'] = reg_resp['client_id']\n\nauth_url = 'https://mcp.xpoz.ai/oauth/authorize?' + urllib.parse.urlencode(params)\n\n# Save state for later token exchange\nwith open(os.path.expanduser('~/.cache/xpoz-oauth/state.json'), 'w') as f:\n    json.dump({'verifier': verifier, 'state': state, 'client_id': reg_resp['client_id'], 'redirect_uri': params['redirect_uri']}, f)\n\nprint(auth_url)\n\n4b-ii. Send the URL to the user\n\nSend the authorization URL to the user via the active chat channel with a message like:\n\n\"I need to connect to Xpoz for social media search. Please open this link and sign in with your Google account:\n\n[authorization URL]\n\nAfter you authorize, Xpoz will show you an authorization code. Just paste it back to me here!\"\n\n4b-iii. WAIT for the user's reply\n\nSTOP here and wait. Do not proceed until the user replies with the authorization code. The user needs time to open the link, sign in, and authorize. Only continue once they paste the code back in chat.\n\n4b-iv. Extract the code from the user's reply\n\nThe user will paste back either:\n\nJust the code: AUTH_CODE_HERE\nOr a full URL: https://www.xpoz.ai/oauth/openclaw?code=AUTH_CODE_HERE&state=...\n\nIf they pasted a URL, extract the code parameter. If they pasted a raw string, use it directly.\n\n4b-v. Exchange the code and configure mcporter\n\nRun the exchange script with the code. This exchanges the code for a token and configures mcporter in one step — the token is never printed or exposed:\n\nbash \"$(dirname \"$0\")/../xpoz-setup/scripts/oauth-remote.sh\" exchange AUTH_CODE_HERE\n\n\nExpected output: OK: Xpoz configured successfully\n\nSecurity notes:\n\nThe access token is never printed to stdout or logs\nThe OAuth state file (~/.cache/xpoz-oauth/state.json) is automatically deleted after exchange\nTokens are stored only in the mcporter config\n\nThen proceed to Step 5 to verify.\n\nStep 5: Verify authentication\nmcporter call xpoz.checkAccessKeyStatus\n\n\nConfirm hasAccessKey: true. If not:\n\nLocal: Retry mcporter config login xpoz\nRemote: Ask the user if they completed authorization, resend the link if needed\nStep 6: Return to the calling skill\n\nSetup is complete. Go back to the skill that referenced this one and continue fulfilling the user's request. Don't make the user wait — they asked you to do something, auth was just a prerequisite.\n\nWhat Is Xpoz?\n\nXpoz is a remote MCP server for social media intelligence:\n\nPlatforms: Twitter, Instagram, TikTok, Reddit\nScale: 1.5B+ posts indexed\nFeatures: Search posts by keyword, find people by topic, profile lookup, engagement filtering, CSV export\nAuth: OAuth 2.1 with dynamic client registration (PKCE, public clients)\nSetup: Fully remote — no npm packages, no local installation, no API keys to copy\n\nFree tier available — no credit card required.\n\nWebsite: xpoz.ai\n\nTechnical Details\nOAuth Discovery\n\nXpoz publishes a standard OAuth 2.1 authorization server metadata document:\n\nGET https://mcp.xpoz.ai/.well-known/oauth-authorization-server\n\n\nKey endpoints:\n\nAuthorization: https://mcp.xpoz.ai/oauth/authorize\nToken: https://mcp.xpoz.ai/oauth/token\nDynamic registration: https://mcp.xpoz.ai/oauth/register\nPKCE: S256 supported\nPublic clients: token_endpoint_auth_methods_supported includes none\n\nmcporter handles all of this automatically — you don't need to call these endpoints directly.\n\nServer Configuration\n\nAfter setup, the mcporter config will contain:\n\n{\n  \"xpoz\": {\n    \"transport\": \"http\",\n    \"url\": \"https://mcp.xpoz.ai/mcp\"\n  }\n}\n\n\nOAuth tokens are managed by mcporter separately from the server config.\n\nTroubleshooting\nProblem\tSolution\nmcporter not found\tEnsure OpenClaw is properly installed (mcporter is included)\nBrowser doesn't open\tHeadless server — capture the URL from stdout and send to user\n\"Unauthorized\" after login\tmcporter config login xpoz --reset\nAuth times out\tUser may not have completed the browser flow — resend the URL\nServer already exists\tSkip Step 3, just run Step 4\nPlans & Pricing\nPlan\tPrice\tIncludes\nFree\t$0/mo\tLimited searches, all platforms\nPro\t$20/mo\tUnlimited searches\nMax\t$200/mo\tUnlimited + priority + bulk export\n\nDetails: xpoz.ai\n\nBuilt for ClawHub • Prerequisite for all Xpoz skills"
  },
  "trust": {
    "sourceLabel": "tencent",
    "provenanceUrl": "https://clawhub.ai/atyachin/xpoz-setup",
    "publisherUrl": "https://clawhub.ai/atyachin/xpoz-setup",
    "owner": "atyachin",
    "version": "1.2.0",
    "license": null,
    "verificationStatus": "Indexed source record"
  },
  "links": {
    "detailUrl": "https://openagent3.xyz/skills/xpoz-setup",
    "downloadUrl": "https://openagent3.xyz/downloads/xpoz-setup",
    "agentUrl": "https://openagent3.xyz/skills/xpoz-setup/agent",
    "manifestUrl": "https://openagent3.xyz/skills/xpoz-setup/agent.json",
    "briefUrl": "https://openagent3.xyz/skills/xpoz-setup/agent.md"
  }
}