
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
secondhand-mcp
Advanced tools
MCP server for searching secondhand marketplaces — Facebook Marketplace, eBay, Depop, and Poshmark. Search listings, filter by price/category/condition/size/color, and get full details with photos.
A Model Context Protocol (MCP) server that lets AI assistants search secondhand marketplaces. Search Facebook Marketplace, eBay, Depop, and Poshmark for used and secondhand items — filter by price, category, condition, size, and color, then get full listing details with photos, descriptions, and seller info.
Works with Claude Desktop, Claude Code, Cursor, and other clients that run MCP servers locally.
[!TIP] Using ChatGPT? This one won't work there.
It runs on your computer, so it only works where your computer is — Claude Desktop, Claude Code, Cursor. Secondhand MCP Cloud is the same search, always on, so whichever assistant you actually use can reach it. Free tier, no card.
| This repo | Cloud | |
|---|---|---|
| Claude Desktop, Code, Cursor | ✅ | ✅ |
| ChatGPT, Claude, and other assistants | — | ✅ |
| Searching from your phone | — | ✅ |
| Chrome running in the background | needed | not needed |
| Price | free, forever | free tier, then $4.99 |
| Marketplace | Auth Required | Notes |
|---|---|---|
| Facebook Marketplace | No | Location-based search |
| eBay | Yes (API keys) | Official Browse API |
| Depop | No | Requires Chrome installed |
| Poshmark | No | Requires Chrome installed |
Add to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"secondhand": {
"command": "npx",
"args": ["-y", "secondhand-mcp"],
"env": {
"EBAY_CLIENT_ID": "your-ebay-client-id",
"EBAY_CLIENT_SECRET": "your-ebay-client-secret",
"EBAY_MARKETPLACE_ID": "EBAY_US"
}
}
}
}
Add to ~/.claude/.mcp.json:
{
"mcpServers": {
"secondhand": {
"command": "npx",
"args": ["-y", "secondhand-mcp"],
"env": {
"EBAY_CLIENT_ID": "your-ebay-client-id",
"EBAY_CLIENT_SECRET": "your-ebay-client-secret",
"EBAY_MARKETPLACE_ID": "EBAY_US"
}
}
}
}
eBay, Depop, and Poshmark are all optional — if eBay API keys are missing or Chrome isn't installed, those marketplaces are automatically disabled and the rest still work.
Depop and Poshmark require a headless browser. If Google Chrome or Chromium is installed on your system, both are automatically enabled — no config needed. If Chrome isn't found, they are silently skipped.
On macOS, the first time you search Depop or Poshmark, you may see a system prompt asking to allow Node.js to control Chrome. This is expected — puppeteer needs to launch Chrome in headless mode. Allow it once and it won't ask again.
The browser runs invisibly in the background and only launches when you actually search Depop or Poshmark.
By default all marketplaces are enabled. To limit which are active, set the MARKETPLACES env var (comma-separated):
{
"env": {
"MARKETPLACES": "facebook,ebay"
}
}
Valid values: facebook, ebay, depop, poshmark
eBay uses the official Browse API. You need a free eBay developer account:
EBAY_CLIENT_ID and EBAY_CLIENT_SECRETBy default the server targets the US eBay site. To search a different regional marketplace, set the EBAY_MARKETPLACE_ID environment variable:
{
"env": {
"EBAY_MARKETPLACE_ID": "EBAY_DE"
}
}
Common values:
| Value | Site |
|---|---|
EBAY_US | ebay.com (default) |
EBAY_DE | ebay.de |
EBAY_GB | ebay.co.uk |
EBAY_AU | ebay.com.au |
EBAY_FR | ebay.fr |
EBAY_IT | ebay.it |
EBAY_ES | ebay.es |
EBAY_CA | ebay.ca |
The full list is available in the eBay API docs.
search_marketplaceSearch for items across marketplaces.
| Parameter | Required | Default | Description |
|---|---|---|---|
query | Yes | Search terms | |
marketplace | No | facebook | facebook, ebay, depop, poshmark, or all |
location | No | san francisco | City to search in (Facebook only) |
radiusMiles | No | 25 | Search radius in miles, up to 500 (Facebook only) |
maxPrice | No | Maximum price | |
minPrice | No | Minimum price | |
limit | No | 20 | Max results |
showSold | No | false | Include sold items (Facebook only) |
includeImages | No | false | Include image URLs in output |
sort | No | relevance | Sort order (Depop, Poshmark): relevance, newest, most_popular, price_low_to_high, price_high_to_low |
condition | No | Item condition. eBay: new, like_new, good, fair. Depop: new, like_new, excellent, good, fair, used. Poshmark: new (NWT), like_new (NWOT), good, fair | |
category | No | Product category. Depop: tops, bottoms, dresses, coats-jackets, footwear, accessories, bags, jewellery, activewear, swimwear. Poshmark: Jackets_&_Coats, Dresses, Shoes, Accessories, etc. | |
brand | No | Brand filter (Poshmark only): e.g. "Nike", "Levi's", "Gucci" | |
department | No | Department filter (Poshmark only): Women, Men, Kids | |
sizes | No | Size filter (Depop, Poshmark): e.g. ["S", "M", "L"] or ["US 9", "US 10"] | |
colors | No | Color filter (Depop, Poshmark): black, white, red, blue, green, yellow, orange, pink, purple, brown, grey, cream, multi, silver, gold |
Data returned per marketplace:
| Field | eBay | Depop | Poshmark | |
|---|---|---|---|---|
| Title | Yes | Yes | Yes | Yes |
| Price | Yes | Yes | Yes | Yes |
| Location | City | City, State | — | — |
| Condition | — | Yes | — | — |
| Photo count | 1 thumbnail | 1 thumbnail | 1 thumbnail | 1 thumbnail |
| Seller | Yes | Yes | — | — |
get_listing_detailsGet full details for a specific listing using an ID from search results.
| Parameter | Required | Default | Description |
|---|---|---|---|
listingId | Yes | Listing ID from search results | |
marketplace | No | facebook | facebook, ebay, depop, or poshmark |
Data returned per marketplace:
| Field | eBay | Depop | Poshmark | |
|---|---|---|---|---|
| Description | Yes | Yes | Yes | Yes |
| All photos | Yes | Yes | Yes | Yes |
| Location | City | City, State, Country | — | — |
| Seller | Name | Username | Username | Username |
| Delivery types | Yes | — | — | — |
| Shipping | Yes/No | Service codes | Yes/No | Always included |
list_marketplacesList all enabled marketplaces and their status.
search / fetch (deep research)Convenience pair following the ChatGPT Deep Research tool contract — exact names, a single string argument each:
search(query) — searches every enabled marketplace at once and returns { results: [{ id, title, text, url }] }, where id is marketplace:listingIdfetch(id) — returns full listing details for a search result ID as { id, title, text, url, metadata }Useful for research-style clients that expect these standard tool names; for filtered searches use search_marketplace.
Facebook Marketplace — Searches listings by location, radius, price, and query. Resolves city names to coordinates. No login or browser needed. Facebook serves non-browser callers a gated version of its search API from time to time (a single result with more pages behind it, or stubs with no listing inside); when that happens the server reads the logged-out search page instead, which still carries a full first page of results.
eBay — Uses the official eBay Browse API with OAuth 2.0 client credentials. Tokens are cached and auto-refreshed. The target regional marketplace is controlled by EBAY_MARKETPLACE_ID (default: EBAY_US).
Depop — Uses a headless browser to search listings with support for category, condition, size, and color filters. The browser instance is shared across requests.
Poshmark — Uses a headless browser to search listings with support for condition, size, color, sort, and price filters. Poshmark is not location-based — all items ship nationally.
git clone https://github.com/jlsookiki/secondhand-mcp.git
cd secondhand-mcp
npm install
npm run build
src/marketplaces/BaseMarketplace and implement search() and optionally getListingDetails()allMarketplaces in src/marketplaces/index.tsMIT
FAQs
MCP server for searching secondhand marketplaces — Facebook Marketplace, eBay, Depop, and Poshmark. Search listings, filter by price/category/condition/size/color, and get full details with photos.
We found that secondhand-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.