This repository provides a Node.js HTTP service that generates TikTok API signatures (X-Bogus and X-Gnarly) required to access TikTok's data endpoints. It uses Puppeteer to run a headless Chromium browser, injects a bundled copy of TikTok's web SDK, and computes signatures by intercepting fetch requests. The service also includes a pure Node.js implementation for X-Gnarly using ChaCha20. It exposes POST /signature and POST /fetch endpoints, manages a request queue, and automatically refreshes the browser session after 500 signatures or 30 minutes. The repository includes example scripts for fetching user videos, comments, trending content, and search results, demonstrating typical TikTok data scraping workflows. While the core functionality is well-implemented, the reliance on static SDK copies and a heavy browser dependency introduces maintenance risks as TikTok updates its anti-scraping measures.
The repository is an MCP (Model Context Protocol) server designed to interact with Xiaohongshu (Little Red Book) social media platform. It exposes a set of tools via the MCP standard that enable AI assistants to perform actions like checking cookie validity, retrieving home feed, searching notes, fetching note content and comments, and posting comments. The server requires a valid Xiaohongshu cookie obtained from web login for authentication. Architecturally, the application follows a modular design separating the MCP transport layer (implemented using FastMCP in `xhs_mcp/__main__.py`) from the business logic handled by API clients. Two API implementations exist: the original (`xhs_mcp/api/xhs_api.py`) uses curl_cffi and execjs to reverse-engineer and execute JavaScript for generating required anti-bot signatures (X-S, X-T headers), while the v2 version (`xhs_mcp/api/xhs_api_v2.py`) employs Playwright for JavaScript execution in a browser context. The MCP server dynamically registers tools from these API modules, manages server lifecycle with proper resource cleanup, and handles authentication errors by prompting cookie validation. The project demonstrates solid engineering practices with clear separation of concerns, async/await patterns for non-blocking I/O, and environment-based configuration for sensitive data. However, it faces inherent technical drift due to reliance on Xiaohongshu's private undocumented APIs, which are subject to frequent changes that break signature generation mechanisms. The dual API implementations indicate ongoing efforts to adapt to such changes, though they introduce maintenance overhead. Dependency management is modern using uv and Python 3.12, but version constraints (e.g., curl-cffi<0.14.0) may pose future compatibility risks.