74
/ 100
2 days ago
glama

eBay MCP - Remote Edition

An MCP server providing AI assistants comprehensive access to eBay's Sell APIs for inventory management, order fulfillment, marketing, analytics, and more, with hosted multi-user and local modes.

Is this your MCP?

Claim it to get a verified publisher badge, a free copy of our full audit findings, and direct contact for any high-priority issues we find.

Install from

M8ven verifies MCPs across every public registry β€” install directly from whichever one you prefer.

// key findings
🚨
Secret credentials may flow to a network call
1 flow detected: EBAY_USER_REFRESH_TOKEN. We can’t prove the destination matches the brand the credential belongs to.
⚠️
Known vulnerabilities in dependencies: 1 high
Affects packages this MCP installs at runtime. Upgrade or remove the affected dependency.
πŸ”
You'll be asked for 20 credentials: ADMIN_API_KEY, AIRTABLE_API_KEY, CLOUDFLARE_API_TOKEN, EBAY_APP_ACCESS_TOKEN, EBAY_CLIENT_SECRET, EBAY_PRODUCTION_CLIENT_SECRET, EBAY_SANDBOX_CLIENT_SECRET, EBAY_USER_ACCESS_TOKEN, EBAY_USER_REFRESH_TOKEN, OAUTH_START_KEY, PERPLEXITY_API_KEY, QSTASH_CURRENT_SIGNING_KEY, QSTASH_NEXT_SIGNING_KEY, QSTASH_TOKEN, RAPIDGATE_API_KEY, TELEGRAM_BOT_TOKEN, TWITTER_BEARER_TOKEN, TWOCAPTCHA_API_KEY, UPSTASH_REDIS_REST_TOKEN, YOUTUBE_API_KEY
These are read from process.env at runtime. Make sure you trust where they’ll be sent.
// known CVEs in dependencies1 high9 medium

Disclosed vulnerabilities in this server's declared npm dependencies (via OSV). Whether each is reachable depends on the installed versions.

highaxios@1.16.0GHSA-gcfj-64vw-6mp9

Axios Node HTTP adapter can use an inherited proxy after interceptor config cloning

mediumaxios@1.16.0GHSA-42h9-826w-cgv3

Axios: Excessive recursion in formDataToJSON can cause denial of service

mediumaxios@1.16.0GHSA-7q8q-rj6j-mhjq

Axios: Nested axios option objects can consume polluted prototype values

mediumaxios@1.16.0GHSA-f4gw-2p7v-4548

Axios: NO_PROXY bypass for 0.0.0.0 local addresses in axios

mediumaxios@1.16.0GHSA-hcpx-6fm6-wx23

Axios form serializer maxDepth bypass via {} metatoken

Depend on this server? Get alerted when its CVEs change.Watch this server free β†’
// required environment variables
This server reads these from process.env. You'll be asked to provide them before it can run.
πŸ” secretADMIN_API_KEYβ€” Privileged admin bypass: Authorization: Bearer <> when ADMIN_API_KEY is configured
πŸ” secretAIRTABLE_API_KEY
configAIRTABLE_BASE_ID
configAIRTABLE_ITEM_TABLE_ID
configAIRTABLE_PAT
configAIRTABLE_VALIDATION_TABLE_ID
configAWS_EXECUTION_ENV
configCLOUDFLARE_ACCOUNT_IDβ€” required when backend is cloudflare-kv
πŸ” secretCLOUDFLARE_API_TOKENβ€” required when backend is cloudflare-kv
configCLOUDFLARE_KV_NAMESPACE_IDβ€” required when backend is cloudflare-kv
configDISABLE_DOTENVX
configDISPLAY
πŸ” secretEBAY_APP_ACCESS_TOKEN
configEBAY_CLIENT_IDβ€” your_client_id
πŸ” secretEBAY_CLIENT_SECRETβ€” your_client_secret
configEBAY_CONFIG_FILEβ€” Required eBay credentials unless provides them
configEBAY_CONTENT_LANGUAGEβ€” en-US # optional, defaults to en-US
configEBAY_CURRENCY_CONVERSION_ENABLED
configEBAY_CURRENCY_RATES_TO_USD_JSON
configEBAY_DEFAULT_ENVIRONMENTβ€” production # fallback when EBAY_ENVIRONMENT is unset
configEBAY_DEFAULT_FULFILLMENT_POLICY_ID
configEBAY_DEFAULT_PAYMENT_POLICY_ID
configEBAY_DEFAULT_RETURN_POLICY_ID
configEBAY_ENABLE_FILE_LOGGINGβ€” true # write logs to files
configEBAY_ENVIRONMENTβ€” sandbox # or production
configEBAY_LOCAL_TLS_CERT_PATHβ€” /path/to/ebay-local.test.pem
configEBAY_LOCAL_TLS_KEY_PATHβ€” /path/to/ebay-local.test-key.pem
configEBAY_LOG_LEVELβ€” debug # error warn info debug
configEBAY_MARKETPLACE_IDβ€” EBAY_US # optional, defaults to EBAY_US
configEBAY_MCP_BASE_URL
configEBAY_PRODUCTION_CLIENT_ID
πŸ” secretEBAY_PRODUCTION_CLIENT_SECRET
configEBAY_PRODUCTION_REDIRECT_URI
configEBAY_PRODUCTION_RUNAME
configEBAY_REDIRECT_URIβ€” legacy env name; do not set to the public callback URL
configEBAY_RESEARCH_BOOTSTRAP_MARKETPLACE
configEBAY_RESEARCH_COOKIES_JSON
configEBAY_RESEARCH_LIVE_PID_PATH
configEBAY_RESEARCH_LIVE_SEED_STORAGE_STATE_PATH
configEBAY_RESEARCH_LIVE_STORAGE_STATE_PATH
configEBAY_RESEARCH_PROFILE_DIR
configEBAY_RESEARCH_SESSION_ALERTS_ENABLED
configEBAY_RESEARCH_SESSION_ALERT_CALLBACK_URL
configEBAY_RESEARCH_SESSION_ALERT_ON_EXPIRED
configEBAY_RESEARCH_SESSION_ALERT_WINDOW_24H
configEBAY_RESEARCH_SESSION_ALERT_WINDOW_6H
configEBAY_RESEARCH_SESSION_ALLOW_FILESYSTEM_FALLBACK
configEBAY_RESEARCH_STORAGE_STATE_META_PATH
configEBAY_RESEARCH_STORAGE_STATE_PATH
configEBAY_RESEARCH_TIMEZONE
configEBAY_RUNAMEβ€” your_runame_string # eBay-generated RuName, not a URL
configEBAY_SANDBOX_CLIENT_ID
πŸ” secretEBAY_SANDBOX_CLIENT_SECRET
configEBAY_SANDBOX_REDIRECT_URI
configEBAY_SANDBOX_RUNAME
configEBAY_SOLD_SEARCH_HTML_ENABLED
configEBAY_SOLD_SEARCH_HTML_TIMEOUT_MS
configEBAY_SOLD_SEARCH_HTML_TRANSPORT
configEBAY_SOLD_SEARCH_USER_AGENT
configEBAY_TOKEN_STORE_BACKENDβ€” upstash-redis # cloudflare-kv upstash-redis memory
configEBAY_TOKEN_STORE_PATH
configEBAY_USERNAME
πŸ” secretEBAY_USER_ACCESS_TOKEN
πŸ” secretEBAY_USER_REFRESH_TOKENβ€” populated by setup wizard
configENABLE_NOVNC
configK_SERVICE
configMCP_HOSTβ€” 0.0.0.0 # defaults to 0.0.0.0
configMCP_TOOL_TIMEOUT_MS
configN8N_VALIDATION_RUNNER_RECORD_WEBHOOK_URL
configN8N_VALIDATION_RUNNER_WEBHOOK_URL
configNIXPACKS
configNIXPACKS_METADATA
configNOVNC_DISPLAY
configNOVNC_PASSWORD_FILE
configNOVNC_PORT
configNOVNC_PUBLIC_HOST
configNOVNC_PUBLIC_PORT
configNOVNC_PUBLIC_PROTOCOL
configNOVNC_PUBLIC_URL
πŸ” secretOAUTH_START_KEYβ€” optional gate for /oauth/start
πŸ” secretPERPLEXITY_API_KEY
configPERPLEXITY_RESEARCH_ENABLED
configPLAYWRIGHT_CHROMIUM_CHANNEL
configPORTβ€” 3000 # defaults to 3000; many hosts inject this
configPUBLIC_BASE_URL
πŸ” secretQSTASH_CURRENT_SIGNING_KEY
πŸ” secretQSTASH_NEXT_SIGNING_KEY
πŸ” secretQSTASH_TOKEN
configQSTASH_URL
πŸ” secretRAPIDGATE_API_KEY
configRAPIDGATE_API_URLβ€” Sold-data provider is temporary (external API via )
configREDDIT_USER_AGENT
configRENDER
configRESEARCH_CAPTURE_HEADLESS
configRESEARCH_CAPTURE_OUTPUT_DIR
configSESSION_TTL_SECONDSβ€” 2592000 # default: 30 days
πŸ” secretTELEGRAM_BOT_TOKEN
configTELEGRAM_CHAT_ID
πŸ” secretTWITTER_BEARER_TOKEN
πŸ” secretTWOCAPTCHA_API_KEY
πŸ” secretUPSTASH_REDIS_REST_TOKENβ€” required when backend is upstash-redis
configUPSTASH_REDIS_REST_URLβ€” required when backend is upstash-redis
configVALIDATION_AIRTABLE_BASE_ID
configVALIDATION_AIRTABLE_ITEM_TABLE_ID
configVALIDATION_AIRTABLE_TABLE_ID
configVALIDATION_RUNNER_RECORD_WEBHOOK_URL
configVALIDATION_RUNNER_USER_IDβ€” Both require X-Admin-API-Key: <ADMIN_API_KEY>. The server impersonates the configured validation runner user from env vars.
configVALIDATION_RUNNER_USER_ID_PRODUCTION
configVALIDATION_RUNNER_USER_ID_SANDBOX
configVALIDATION_RUNNER_WEBHOOK_URL
configVERCEL
πŸ” secretYOUTUBE_API_KEY
// full audit trail
The full breakdown of what we checked, the deductions that landed, the network hosts, the dependency advisories, and concrete fix guidance is available to verified publishers.
// improvement guidance β€” verified publishers only
We have 3 concrete improvements we can share with the publisher of this MCP. Each comes with specific guidance to raise the trust score.
// embed badge in your README
[![M8ven Score](https://m8ven.ai/badge/mcp/mrnajiboy-ebay-mcp-remote-edition-1idmii)](https://m8ven.ai/mcp/mrnajiboy-ebay-mcp-remote-edition-1idmii)
commit: 55370f88b248978e91390b867e09b3d171952f5c
code hash: 092fa066b8c4d3b1b850f2145691a2fcb6b456756c8dbb1033bc159628af6463
verified: 7/21/2026, 9:32:40 AM
view raw JSON β†’
eBay MCP - Remote Edition Β· M8ven Trust Score | M8ven