x: request broadcast.read and broadcast.write scopes (2.9.0)

[santiagomed]

Why

The 18 livestream tools on https://api.x.com/mcp (broadcasts, scheduled broadcasts, broadcast chat moderators and mutes, and stream sources) return 403 for missing scopes, because the X plugin never requests broadcast.read or broadcast.write.

What

• mcp.json: requests broadcast.read and broadcast.write, after calls.write. The README's MCP snippet and "Scopes requested" list match.
• skills/x-api-mcp-guide/SKILL.md: scope and reconnect guidance only. Missing livestream tools, or a 403 for broadcast.read / broadcast.write, while other X tools work is not error 2. A new Livestream scopes section tells the user to reconnect, the same as for X Chat and call scopes.
• 2.9.0 in plugin.json and the CHANGELOG. 2.8.0 is already claimed by x: X Chat image send via MCP, pin chatxdk<0.6, reinstall note (2.8.0) #719, which is still open.

Before merging

• Depends on D1386218 landing. That diff adds both scopes to authd's discovery metadata for https://api.x.com/mcp. Merge this only after it lands.
• Users must reconnect. Existing installs keep their current token, so they need to sign in to X again to get the new scopes.
• Overlaps with X plugin: livestream tools (sources, broadcasts, scheduled broadcasts, chat moderation) #725, which requests the same two scopes and also adds a full Livestreams usage section, at 2.8.0. Only one should land as is: if X plugin: livestream tools (sources, broadcasts, scheduled broadcasts, chat moderation) #725 goes first, close this; if this goes first, rebase X plugin: livestream tools (sources, broadcasts, scheduled broadcasts, chat moderation) #725 onto it.
• If this lands before x: X Chat image send via MCP, pin chatxdk<0.6, reinstall note (2.8.0) #719, x: X Chat image send via MCP, pin chatxdk<0.6, reinstall note (2.8.0) #719 needs a version above 2.9.0.

Testing

• node scripts/validate-plugins.mjs: all plugins validated.
• The scope lists in mcp.json and both README lists match each other and match the scope set D1386218 advertises for https://api.x.com/mcp.
• Not tested end to end: signing in with the new scopes needs D1386218 live.

  

---

Note

Low Risk
Plugin metadata and agent guidance only; scope expansion requires user reconnect and depends on server-side auth metadata (D1386218) for end-to-end behavior.

^{Reviewed by Cursor Bugbot for commit b47f9d8. Bugbot is set up for automated code reviews on this repo. Configure here.}