Back to Browse

Findasale MCP Server

by Deseee
Developer ToolsModerate5.4MCP RegistryLocalRemote
Free

Server data from the Official MCP Registry

Find yard sales, garage sales, auctions, flea markets and resale shops, and search items for sale.

About

Find yard sales, garage sales, auctions, flea markets and resale shops, and search items for sale.

Remote endpoints: streamable-http: https://mcp.finda.sale/mcp sse: https://mcp.finda.sale/sse

Security Report

5.4
Moderate5.4Moderate Risk

The FindA.Sale MCP server is a public, read-only, unauthenticated discovery server that proxies anonymous calls to the FindA.Sale backend API with allow-listed public response projections, per-IP rate limiting, and safe error mapping. Its network access matches its purpose, and no malicious exfiltration, shell execution, or hardcoded secrets were found in the provided files. Minor observations remain: the unauthenticated design is intentional but broad CORS and some dependency version pinning/ranges deserve periodic review, and the truncated shared utilities file could not be fully inspected. Supply chain analysis found 29 known vulnerabilities in dependencies (2 critical, 10 high severity).

15 files analyzed · 37 issues found

Security scores are indicators to help you make informed decisions, not guarantees. Always review permissions before connecting any MCP server.

Permissions Required

This plugin requests these system permissions. Most are normal for its category.

HTTP Network Access

Connects to external APIs or services over the internet.

env_vars

Check that this permission is expected for this type of plugin.

system_info

Check that this permission is expected for this type of plugin.

How to Install & Connect

Available as Local & Remote

This plugin can run on your machine or connect to a hosted endpoint. during install.

Documentation

View on GitHub

From the project's GitHub README.

Finda.Sale

Development setup

One-time step after cloning — enable the repo-tracked git hooks (pre-commit secret scan + Public Repo Discipline content guard; pre-push TypeScript/Prisma/ auth checks):

git config core.hooksPath .githooks

Without this, hooks in .githooks/ are inert and Git falls back to the (empty) default .git/hooks/ directory.

Reviews

No reviews yet

Be the first to review this server!