74
/ 100
2 days ago
glama

eBay MCP - Remote Edition

An MCP server providing AI assistants comprehensive access to eBay's Sell APIs for inventory management, order fulfillment, marketing, analytics, and more, with hosted multi-user and local modes.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry — install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
1 flow detected: EBAY_USER_REFRESH_TOKEN. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Known vulnerabilities in dependencies: 1 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
🔐
You'll be asked for 20 credentials: ADMIN_API_KEY, AIRTABLE_API_KEY, CLOUDFLARE_API_TOKEN, EBAY_APP_ACCESS_TOKEN, EBAY_CLIENT_SECRET, EBAY_PRODUCTION_CLIENT_SECRET, EBAY_SANDBOX_CLIENT_SECRET, EBAY_USER_ACCESS_TOKEN, EBAY_USER_REFRESH_TOKEN, OAUTH_START_KEY, PERPLEXITY_API_KEY, QSTASH_CURRENT_SIGNING_KEY, QSTASH_NEXT_SIGNING_KEY, QSTASH_TOKEN, RAPIDGATE_API_KEY, TELEGRAM_BOT_TOKEN, TWITTER_BEARER_TOKEN, TWOCAPTCHA_API_KEY, UPSTASH_REDIS_REST_TOKEN, YOUTUBE_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 high9 medium

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highaxios@1.16.0GHSA-gcfj-64vw-6mp9

Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

mediumaxios@1.16.0GHSA-42h9-826w-cgv3

Axios: Excessive recursion in formDataToJSON can cause denial of service

mediumaxios@1.16.0GHSA-7q8q-rj6j-mhjq

Axios: Nested axios option objects can consume polluted prototype values

mediumaxios@1.16.0GHSA-f4gw-2p7v-4548

Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

mediumaxios@1.16.0GHSA-hcpx-6fm6-wx23

Axios form serializer maxDepth bypass via {} metatoken

Depend on this server? Get alerted when its CVEs change.Watch this server free →
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
🔐 secretADMIN_API_KEYPrivileged admin bypass: Authorization: Bearer <> when ADMIN_API_KEY is configured
🔐 secretAIRTABLE_API_KEY
configAIRTABLE_BASE_ID
configAIRTABLE_ITEM_TABLE_ID
configAIRTABLE_PAT
configAIRTABLE_VALIDATION_TABLE_ID
configAWS_EXECUTION_ENV
configCLOUDFLARE_ACCOUNT_IDrequired when backend is cloudflare-kv
🔐 secretCLOUDFLARE_API_TOKENrequired when backend is cloudflare-kv
configCLOUDFLARE_KV_NAMESPACE_IDrequired when backend is cloudflare-kv
configDISABLE_DOTENVX
configDISPLAY
🔐 secretEBAY_APP_ACCESS_TOKEN
configEBAY_CLIENT_IDyour_client_id
🔐 secretEBAY_CLIENT_SECRETyour_client_secret
configEBAY_CONFIG_FILERequired eBay credentials unless provides them
configEBAY_CONTENT_LANGUAGEen-US # optional, defaults to en-US
configEBAY_CURRENCY_CONVERSION_ENABLED
configEBAY_CURRENCY_RATES_TO_USD_JSON
configEBAY_DEFAULT_ENVIRONMENTproduction # fallback when EBAY_ENVIRONMENT is unset
configEBAY_DEFAULT_FULFILLMENT_POLICY_ID
configEBAY_DEFAULT_PAYMENT_POLICY_ID
configEBAY_DEFAULT_RETURN_POLICY_ID
configEBAY_ENABLE_FILE_LOGGINGtrue # write logs to files
configEBAY_ENVIRONMENTsandbox # or production
configEBAY_LOCAL_TLS_CERT_PATH/path/to/ebay-local.test.pem
configEBAY_LOCAL_TLS_KEY_PATH/path/to/ebay-local.test-key.pem
configEBAY_LOG_LEVELdebug # error warn info debug
configEBAY_MARKETPLACE_IDEBAY_US # optional, defaults to EBAY_US
configEBAY_MCP_BASE_URL
configEBAY_PRODUCTION_CLIENT_ID
🔐 secretEBAY_PRODUCTION_CLIENT_SECRET
configEBAY_PRODUCTION_REDIRECT_URI
configEBAY_PRODUCTION_RUNAME
configEBAY_REDIRECT_URIlegacy env name; do not set to the public callback URL
configEBAY_RESEARCH_BOOTSTRAP_MARKETPLACE
configEBAY_RESEARCH_COOKIES_JSON
configEBAY_RESEARCH_LIVE_PID_PATH
configEBAY_RESEARCH_LIVE_SEED_STORAGE_STATE_PATH
configEBAY_RESEARCH_LIVE_STORAGE_STATE_PATH
configEBAY_RESEARCH_PROFILE_DIR
configEBAY_RESEARCH_SESSION_ALERTS_ENABLED
configEBAY_RESEARCH_SESSION_ALERT_CALLBACK_URL
configEBAY_RESEARCH_SESSION_ALERT_ON_EXPIRED
configEBAY_RESEARCH_SESSION_ALERT_WINDOW_24H
configEBAY_RESEARCH_SESSION_ALERT_WINDOW_6H
configEBAY_RESEARCH_SESSION_ALLOW_FILESYSTEM_FALLBACK
configEBAY_RESEARCH_STORAGE_STATE_META_PATH
configEBAY_RESEARCH_STORAGE_STATE_PATH
configEBAY_RESEARCH_TIMEZONE
configEBAY_RUNAMEyour_runame_string # eBay-generated RuName, not a URL
configEBAY_SANDBOX_CLIENT_ID
🔐 secretEBAY_SANDBOX_CLIENT_SECRET
configEBAY_SANDBOX_REDIRECT_URI
configEBAY_SANDBOX_RUNAME
configEBAY_SOLD_SEARCH_HTML_ENABLED
configEBAY_SOLD_SEARCH_HTML_TIMEOUT_MS
configEBAY_SOLD_SEARCH_HTML_TRANSPORT
configEBAY_SOLD_SEARCH_USER_AGENT
configEBAY_TOKEN_STORE_BACKENDupstash-redis # cloudflare-kv upstash-redis memory
configEBAY_TOKEN_STORE_PATH
configEBAY_USERNAME
🔐 secretEBAY_USER_ACCESS_TOKEN
🔐 secretEBAY_USER_REFRESH_TOKENpopulated by setup wizard
configENABLE_NOVNC
configK_SERVICE
configMCP_HOST0.0.0.0 # defaults to 0.0.0.0
configMCP_TOOL_TIMEOUT_MS
configN8N_VALIDATION_RUNNER_RECORD_WEBHOOK_URL
configN8N_VALIDATION_RUNNER_WEBHOOK_URL
configNIXPACKS
configNIXPACKS_METADATA
configNOVNC_DISPLAY
configNOVNC_PASSWORD_FILE
configNOVNC_PORT
configNOVNC_PUBLIC_HOST
configNOVNC_PUBLIC_PORT
configNOVNC_PUBLIC_PROTOCOL
configNOVNC_PUBLIC_URL
🔐 secretOAUTH_START_KEYoptional gate for /oauth/start
🔐 secretPERPLEXITY_API_KEY
configPERPLEXITY_RESEARCH_ENABLED
configPLAYWRIGHT_CHROMIUM_CHANNEL
configPORT3000 # defaults to 3000; many hosts inject this
configPUBLIC_BASE_URL
🔐 secretQSTASH_CURRENT_SIGNING_KEY
🔐 secretQSTASH_NEXT_SIGNING_KEY
🔐 secretQSTASH_TOKEN
configQSTASH_URL
🔐 secretRAPIDGATE_API_KEY
configRAPIDGATE_API_URLSold-data provider is temporary (external API via )
configREDDIT_USER_AGENT
configRENDER
configRESEARCH_CAPTURE_HEADLESS
configRESEARCH_CAPTURE_OUTPUT_DIR
configSESSION_TTL_SECONDS2592000 # default: 30 days
🔐 secretTELEGRAM_BOT_TOKEN
configTELEGRAM_CHAT_ID
🔐 secretTWITTER_BEARER_TOKEN
🔐 secretTWOCAPTCHA_API_KEY
🔐 secretUPSTASH_REDIS_REST_TOKENrequired when backend is upstash-redis
configUPSTASH_REDIS_REST_URLrequired when backend is upstash-redis
configVALIDATION_AIRTABLE_BASE_ID
configVALIDATION_AIRTABLE_ITEM_TABLE_ID
configVALIDATION_AIRTABLE_TABLE_ID
configVALIDATION_RUNNER_RECORD_WEBHOOK_URL
configVALIDATION_RUNNER_USER_IDBoth require X-Admin-API-Key: <ADMIN_API_KEY>. The server impersonates the configured validation runner user from env vars.
configVALIDATION_RUNNER_USER_ID_PRODUCTION
configVALIDATION_RUNNER_USER_ID_SANDBOX
configVALIDATION_RUNNER_WEBHOOK_URL
configVERCEL
🔐 secretYOUTUBE_API_KEY
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance — verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/mrnajiboy-ebay-mcp-remote-edition-1idmii)](https://m8ven.ai/mcp/mrnajiboy-ebay-mcp-remote-edition-1idmii)
commit: 55370f88b248978e91390b867e09b3d171952f5c
code hash: 092fa066b8c4d3b1b850f2145691a2fcb6b456756c8dbb1033bc159628af6463
verified: 7/21/2026, 9:32:40 AM
view raw JSON →