
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
secondhand-mcp
Advanced tools
MCP server for searching secondary marketplaces (Facebook Marketplace, eBay, Craigslist, etc.)
An MCP server for searching secondary marketplaces. Lets Claude and other AI assistants search for deals on Facebook Marketplace and eBay.
| Marketplace | Status | Auth Required |
|---|---|---|
| Facebook Marketplace | Working | No |
| eBay | Working | Yes (API keys) |
git clone https://github.com/jlsookiki/secondhand-mcp.git
cd secondhand-mcp
npm install
npm run build
Add to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"secondhand": {
"command": "npx",
"args": ["-y", "secondhand-mcp"],
"env": {
"EBAY_CLIENT_ID": "your-ebay-client-id",
"EBAY_CLIENT_SECRET": "your-ebay-client-secret"
}
}
}
}
Add to ~/.claude/.mcp.json:
{
"mcpServers": {
"secondhand": {
"command": "npx",
"args": ["-y", "secondhand-mcp"],
"env": {
"EBAY_CLIENT_ID": "your-ebay-client-id",
"EBAY_CLIENT_SECRET": "your-ebay-client-secret"
}
}
}
}
eBay credentials are optional — if omitted, eBay will be disabled and only Facebook Marketplace will be available.
By default all marketplaces are enabled. To limit which marketplaces are active, set the MARKETPLACES env var (comma-separated):
{
"env": {
"MARKETPLACES": "facebook",
"EBAY_CLIENT_ID": "...",
"EBAY_CLIENT_SECRET": "..."
}
}
Valid values: facebook, ebay
eBay uses the official Browse API. You need a free eBay developer account:
EBAY_CLIENT_ID and EBAY_CLIENT_SECRETsearch_marketplaceSearch for items across marketplaces. Returns a summary per listing: title, price, location, listing ID, and photo count.
| Parameter | Required | Default | Description |
|---|---|---|---|
query | Yes | Search terms | |
marketplace | No | facebook | facebook, ebay, or all |
location | No | san francisco | City to search in (Facebook only) |
maxPrice | No | Maximum price | |
minPrice | No | Minimum price | |
limit | No | 20 | Max results |
showSold | No | false | Include sold/unavailable items (Facebook only) |
includeImages | No | false | Include image URLs in output |
Data returned per marketplace:
| Field | eBay | |
|---|---|---|
| Title | Yes | Yes |
| Price | Yes | Yes |
| Location | City name | City, State |
| Condition | No | Yes |
| Photo count | Yes (1 thumbnail) | Yes (1 thumbnail) |
| Seller | Yes | Yes |
get_listing_detailsGet full details for a specific listing using an ID from search results.
| Parameter | Required | Default | Description |
|---|---|---|---|
listingId | Yes | Listing ID from search results | |
marketplace | No | facebook | facebook or ebay |
Data returned per marketplace:
| Field | eBay | |
|---|---|---|
| Description | Yes | Yes |
| All photos | Yes | Yes |
| Location | City | City, State, Country |
| Seller | Name | Username |
| Delivery types | Yes | No |
| Shipping options | Yes/No flag | Service codes |
list_marketplacesList all enabled marketplaces and their status.
Found 15 listings for "stroller" on facebook
Location: san francisco
**$25** - Baby stroller
San Francisco, CA
ID: 123456789
1 photo
**$50** - Thule Urban Glide Jogging Stroller
San Francisco, CA
ID: 987654321
1 photo
Use get_listing_details with a listing ID to see full photos, description, and seller info.
Facebook Marketplace — Uses Facebook's internal GraphQL API to search listings directly. No login, no browser automation. Resolves city names to coordinates, then searches with location/price/query filters. Uses undocumented doc_id endpoints that may need updating if Facebook changes their frontend.
eBay — Uses the official eBay Browse API with OAuth 2.0 client credentials. Tokens are cached and auto-refreshed.
src/marketplaces/ (e.g., craigslist.ts)BaseMarketplace and implement search() and optionally getListingDetails()allMarketplaces registry in src/marketplaces/index.tsnpm install
npm run build
doc_id values (constants in src/marketplaces/facebook.ts)MIT
This tool is for personal use. Respect each marketplace's Terms of Service.
FAQs
MCP server for searching secondhand marketplaces — Facebook Marketplace, eBay, Depop, and Poshmark. Search listings, filter by price/category/condition/size/color, and get full details with photos.
The npm package secondhand-mcp receives a total of 107 weekly downloads. As such, secondhand-mcp popularity was classified as not popular.
We found that secondhand-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.