Feature requests
FR-2026-02-06 Secure agent data pull tool (X bookmarks)
Summary: Provide a read-only tool that lets agents retrieve a user's X bookmarks using server-side credentials stored in a secrets manager, returning sanitized data only.
Problem: Agents need access to bookmarked posts, but credentials must never be exposed via environment variables or agent prompts.
Proposed solution:
- Fetch bookmarks via the X API with pagination and limit controls.
- Load credentials from a secrets store at runtime (AWS Secrets Manager, HashiCorp Vault, 1Password Connect), with in-memory caching only.
- Expose a narrow agent-facing interface: list recent, search by text, and basic stats.
- Sanitize outputs to safe fields only (id, text, author, created_at, like_count, saved_at if available).
Security requirements:
- Read-only credentials and API permissions.
- No direct HTTP or credential access from agents.
- Rate limiting and audit logging on requests.
Source: https://www.kimi.com/share/19c31546-ede2-8c41-8000-0000bcdabbbd?sharetype=link