Vinted Mcp — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited Vinted Mcp (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
An MCP server for Vinted search and analysis that provides tools to search listings, fetch item details, inspect seller profiles, compare prices across countries, and surface trending items.
It also exposes resources for supported countries and category data.
Disclaimer: This project is not affiliated, associated, authorized, endorsed by, or in any way officially connected with Vinted, or any of its subsidiaries or its affiliates. The official Vinted website can be found at vinted.com.
This server works with MCP clients that support local stdio servers.
Popular clients and setup docs:
Add this to your MCP client config:
{
"mcpServers": {
"vinted": {
"command": "npx",
"args": ["-y", "@andrijdavid/vinted-mcp"]
}
}
}bunx @andrijdavid/vinted-mcp@nextThis starts the server in stdio mode and waits for an MCP client.
npm install -g @andrijdavid/vinted-mcpThen configure:
{
"mcpServers": {
"vinted": {
"command": "vinted-mcp"
}
}
}If you need a network endpoint instead of stdio, run:
VINTED_MCP_TRANSPORT=http VINTED_MCP_HOST=127.0.0.1 VINTED_MCP_PORT=3001 bunx @andrijdavid/vinted-mcp@nextOptional:
VINTED_MCP_PATH (default /mcp)VINTED_MCP_ENABLE_LEGACY_SSE (default true)VINTED_MCP_LEGACY_SSE_PATH (default /sse)VINTED_MCP_LEGACY_MESSAGES_PATH (default /messages)Default endpoints:
http://127.0.0.1:3001/mcphttp://127.0.0.1:3001/sseVINTED_AUTH_MODE=env \
VINTED_AUTH_COOKIES='session_cookie=your_value; other_cookie=your_value' \
VINTED_AUTH_CSRF_TOKEN='your_csrf_token' \
bunx @andrijdavid/vinted-mcp@next$env:VINTED_AUTH_MODE = "env"
$env:VINTED_AUTH_COOKIES = "session_cookie=your_value; other_cookie=your_value"
$env:VINTED_AUTH_CSRF_TOKEN = "your_csrf_token"
bunx @andrijdavid/vinted-mcp@nextset VINTED_AUTH_MODE=env
set VINTED_AUTH_COOKIES=session_cookie=your_value; other_cookie=your_value
set VINTED_AUTH_CSRF_TOKEN=your_csrf_token
bunx @andrijdavid/vinted-mcp@next.env fileThe server auto-loads .env from the current working directory.
cp .env.example .env
bunx @andrijdavid/vinted-mcp@nextVINTED_MCP_TRANSPORT=http \
VINTED_MCP_HOST=127.0.0.1 \
VINTED_MCP_PORT=3001 \
bunx @andrijdavid/vinted-mcp@nextWindows Command Prompt:
set VINTED_MCP_TRANSPORT=http
set VINTED_MCP_HOST=127.0.0.1
set VINTED_MCP_PORT=3001
bunx @andrijdavid/vinted-mcp@nextThe server auto-loads .env from the working directory if present.
Start from the example file:
cp .env.example .envMain variables:
VINTED_AUTH_MODE: http, playwright, or envVINTED_AUTH_COOKIES: cookie header string or JSON object stringVINTED_AUTH_CSRF_TOKEN: CSRF tokenVINTED_AUTH_ACCESS_TOKEN: optional bearer tokenVINTED_AUTH_REFRESH_TOKEN: optional refresh token, used to mint a new access tokenVINTED_PROFILE_DIR: optional root for browser profiles created by login, default ~/.vinted-mcpVINTED_PROXY_URL: optional proxy URLVINTED_MAX_CONCURRENCY: optional tuningVINTED_REQUEST_DELAY_MS: optional tuningVINTED_MAX_RETRIES: optional tuningExample client config with env auth:
{
"mcpServers": {
"vinted": {
"command": "npx",
"args": ["-y", "@andrijdavid/vinted-mcp"],
"env": {
"VINTED_AUTH_MODE": "env",
"VINTED_AUTH_COOKIES": "session_cookie=your_value; other_cookie=your_value",
"VINTED_AUTH_CSRF_TOKEN": "your_csrf_token"
}
}
}
}Search and price tools work anonymously. Anything tied to your account (like_item), plus a seller's own listings in get_seller, needs a logged-in session. Run this once per country:
npx @andrijdavid/vinted-mcp login --country frA browser window opens on Vinted. Sign in the way you normally do (password, captcha, 2FA, Google login all work). The window closes by itself once you are signed in, and the browser profile is saved to ~/.vinted-mcp/profile-<country>. The server reopens that profile headlessly when it needs cookies, so the session refreshes itself and there is nothing to copy or paste.
Requirements: Playwright with Chromium (npm i playwright && npx playwright install chromium). Set VINTED_PROFILE_DIR to move the profile root somewhere other than ~/.vinted-mcp.
Where no browser can be opened, use VINTED_AUTH_MODE=env and supply the credentials yourself:
Network and refresh.https://www.vinted.<country>/api/... request.Request Headers:cookie -> VINTED_AUTH_COOKIESx-csrf-token -> VINTED_AUTH_CSRF_TOKENauthorization: Bearer ... token into VINTED_AUTH_ACCESS_TOKEN, and therefresh_token_web cookie value into VINTED_AUTH_REFRESH_TOKEN.
Security notes:
.envsearch_itemsSearch listings with filters like country, price range, brand IDs, category, condition, sort, and limit.
get_itemGet item details by itemId or url. Vinted retired the item API, so this reads the public item page instead: it is slower than search, and view counts and listing dates are no longer available.
get_sellerGet seller profile data, recent reviews and optional recent items by sellerId or url. The rating is on a 0-5 scale. Recent items come from the seller's wardrobe, which Vinted returns empty to anonymous callers, so that part needs a logged-in session.
compare_pricesCompare average and median prices for a query across countries.
get_trendingReturn recently listed items ranked by favourites, then views. The catalogue API no longer returns listing timestamps or view counts, so the ranking is coarser than it used to be.
like_itemAdd an item to your favourites by itemId or url, or remove it with unlike: true. Needs a logged-in session, see Signing in. Already-liked items are left alone rather than toggled off.
vinted://countriesvinted://categoriesvinted://item/{country}/{itemId}vinted://seller/{country}/{sellerId}vinted://search/{country}/{query}These templates let clients create direct resource URIs quickly.
find_best_dealscreen_sellersearch_item_with_filterstrending_reportbuy_or_skip_decisionresale_arbitrage_estimatorThese predefined prompts help clients bootstrap common Vinted workflows.
Supported countries: fr, de, uk, it, es, nl, pl, pt, be, at, lt, cz, sk, hu, ro, hr, fi, dk, se.
npm install
npm run build
npm run bundle
npm startRun protocol-level tests:
npm testRun live integration tests:
RUN_LIVE_MCP_TESTS=1 npm testLicensed under AGPL-3.0-or-later.
See LICENSE.md.
~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.