
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
secondhand-mcp
Advanced tools
MCP server for searching secondhand marketplaces — Facebook Marketplace, eBay, and Depop. Search listings, filter by price/category/condition, and get full details with photos.
A Model Context Protocol (MCP) server that lets AI assistants search secondhand marketplaces. Search Facebook Marketplace, eBay, and Depop for used and secondhand items — filter by price, category, condition, size, and color, then get full listing details with photos, descriptions, and seller info.
Works with Claude Desktop, Claude Code, Cursor, and any MCP-compatible client.
| Marketplace | Auth Required | Notes |
|---|---|---|
| Facebook Marketplace | No | Location-based search |
| eBay | Yes (API keys) | Official Browse API |
| Depop | No | Requires Chrome installed |
Add to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"secondhand": {
"command": "npx",
"args": ["-y", "secondhand-mcp"],
"env": {
"EBAY_CLIENT_ID": "your-ebay-client-id",
"EBAY_CLIENT_SECRET": "your-ebay-client-secret"
}
}
}
}
Add to ~/.claude/.mcp.json:
{
"mcpServers": {
"secondhand": {
"command": "npx",
"args": ["-y", "secondhand-mcp"],
"env": {
"EBAY_CLIENT_ID": "your-ebay-client-id",
"EBAY_CLIENT_SECRET": "your-ebay-client-secret"
}
}
}
}
eBay and Depop are both optional — if eBay API keys are missing or Chrome isn't installed, those marketplaces are automatically disabled and the rest still work.
Depop uses a headless browser to bypass Cloudflare. If Google Chrome or Chromium is installed on your system, Depop is automatically enabled — no config needed. If Chrome isn't found, Depop is silently skipped.
On macOS, the first time you search Depop, you may see a system prompt asking to allow Node.js to control Chrome. This is expected — puppeteer needs to launch Chrome in headless mode. Allow it once and it won't ask again.
The browser runs invisibly in the background and only launches when you actually search Depop.
By default all marketplaces are enabled. To limit which are active, set the MARKETPLACES env var (comma-separated):
{
"env": {
"MARKETPLACES": "facebook,ebay"
}
}
Valid values: facebook, ebay, depop
eBay uses the official Browse API. You need a free eBay developer account:
EBAY_CLIENT_ID and EBAY_CLIENT_SECRETsearch_marketplaceSearch for items across marketplaces.
| Parameter | Required | Default | Description |
|---|---|---|---|
query | Yes | Search terms | |
marketplace | No | facebook | facebook, ebay, depop, or all |
location | No | san francisco | City to search in (Facebook only) |
maxPrice | No | Maximum price | |
minPrice | No | Minimum price | |
limit | No | 20 | Max results |
showSold | No | false | Include sold items (Facebook only) |
includeImages | No | false | Include image URLs in output |
sort | No | relevance | Sort order (Depop only): relevance, newest, most_popular, price_low_to_high, price_high_to_low |
condition | No | Item condition. eBay: new, like_new, good, fair. Depop: new, like_new, excellent, good, fair, used | |
category | No | Product category (Depop only): tops, bottoms, dresses, coats-jackets, footwear, accessories, bags, jewellery, activewear, swimwear | |
sizes | No | Size filter (Depop only): e.g. ["S", "M", "L"] or ["US 9", "US 10"] | |
colors | No | Color filter (Depop only): black, white, red, blue, green, yellow, orange, pink, purple, brown, grey, cream, multi, silver, gold |
Data returned per marketplace:
| Field | eBay | Depop | |
|---|---|---|---|
| Title | Yes | Yes | Yes |
| Price | Yes | Yes | Yes |
| Location | City | City, State | — |
| Condition | — | Yes | — |
| Photo count | 1 thumbnail | 1 thumbnail | 1 thumbnail |
| Seller | Yes | Yes | — |
get_listing_detailsGet full details for a specific listing using an ID from search results.
| Parameter | Required | Default | Description |
|---|---|---|---|
listingId | Yes | Listing ID from search results | |
marketplace | No | facebook | facebook, ebay, or depop |
Data returned per marketplace:
| Field | eBay | Depop | |
|---|---|---|---|
| Description | Yes | Yes | Yes |
| All photos | Yes | Yes | Yes |
| Location | City | City, State, Country | — |
| Seller | Name | Username | Username |
| Delivery types | Yes | — | — |
| Shipping | Yes/No | Service codes | Yes/No |
list_marketplacesList all enabled marketplaces and their status.
Facebook Marketplace — Uses Facebook's internal GraphQL API. Resolves city names to coordinates, then searches with location/price/query filters. No login or browser needed.
eBay — Uses the official eBay Browse API with OAuth 2.0 client credentials. Tokens are cached and auto-refreshed.
Depop — Uses a headless browser (puppeteer-core + stealth plugin) to bypass Cloudflare TLS fingerprinting, then calls Depop's internal web API from within the browser context. Returns clean JSON — no DOM scraping. The browser instance is shared across requests.
git clone https://github.com/jlsookiki/secondhand-mcp.git
cd secondhand-mcp
npm install
npm run build
src/marketplaces/BaseMarketplace and implement search() and optionally getListingDetails()allMarketplaces in src/marketplaces/index.tsdoc_id valuesMIT
FAQs
MCP server for searching secondhand marketplaces — Facebook Marketplace, eBay, Depop, and Poshmark. Search listings, filter by price/category/condition/size/color, and get full details with photos.
The npm package secondhand-mcp receives a total of 107 weekly downloads. As such, secondhand-mcp popularity was classified as not popular.
We found that secondhand-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.