MCP for listings

What you need

• Node.js 22 or newer.
• First sign in on the website using the configured operator email and accept the current documents. MCP uses a separate operator credential, not a seller email/OTP login.
• An operator token — 64 characters, issued by the site owner. The token grants full access to the queue and listing creation; do not publish it.
• The client file listings.mjs — the same file lives in the project repository as mcp/listings.mjs.

The token is read from ~/.config/shisha-market/operator.token (permissions 0600). Override the path with SHISHA_OPERATOR_TOKEN_FILE, or pass the token itself via SHISHA_OPERATOR_TOKEN. The default site URL is https://shisha-market.com; set SHISHA_APP_URL for local checks.

Connection

The client starts the process and talks to it over stdio (JSON-RPC 2.0, standard newline-delimited transport, MCP 2025-11-25 with older version negotiation). Claude Desktop example — add the server to the MCP configuration:

{
  "mcpServers": {
    "shisha-market": {
      "command": "node",
      "args": ["/полный/путь/к/listings.mjs"]
    }
  }
}

macOS: ~/Library/Application Support/Claude/claude_desktop_config.json, Windows: %APPDATA%\Claude\claude_desktop_config.json. Other clients (Cursor, custom agents) start the same command node listings.mjs.

Tools

create_listing

Creates a listing as the operator. Required fields: title, description, category, city, price in rubles, contact link and 1–6 photos (local JPG/PNG/WebP paths, up to 8 MB combined). Categories: hookahs, bowls, accessories. Tobacco, nicotine and vapes are not accepted. By default the listing stays pending; publish: true asks to publish immediately — the platform rules are checked in both cases. Response: id and status.

list_pending

Returns the moderation queue: up to 50 records, oldest first. Each record contains id, title, city, category, revision and dates. The revision number is a required decision parameter.

get_listing and get_listing_photo

Use id to inspect the full text, price, status, moderation note, current revision and photo IDs. Fetch each photo with id and photoId as MCP image content, including private pending photos. Login email and consent full name are not exposed.

update_listing and archive_listing

Only operator-owned listings may be changed, using the current revision. Supply fields to change, optional new photos and keepPhotoIds; omitted fields/photos stay unchanged. Every edit returns to review. Archiving hides the listing on the site, not physical deletion or removal of existing VK posts. Archived listings cannot be restored this way.

Recommended path: create without publishing → inspect the text and every photo → obtain human approval or request corrections. After a network timeout inspect the queue first; do not blindly create a duplicate.

moderate_listing

Publishes or rejects a listing. Requires id, decision (published or rejected), revision from the queue and, for rejection, a reason of at least three characters. If the author edits the listing first, the number will not match and the decision is refused: fetch the queue again and review the text and photos. Response: id and status.

For AI agents

Machine-readable resources: /llms.txt, /llms-full.txt and the JSON status at /ai/status with analytics and search visibility.

This page is open to AI crawlers but excluded from search indexing.

Security and limits

• Without a token configured on the server, the operator endpoints answer 404; with a wrong token, 401. All requests go over HTTPS.
• If the token leaks, it is rotated on the server and the old one stops working.
• The platform does not take payments and does not support deals. Autoposting of approved listings to the VK community is enabled with a community key on the server and is off by default.
• The owner can fix a rejected listing and submit it again; archived listings are not restored by this form.

This page is a service page: search engines do not index it.