ListBomb · Set up Muse · Support

ListBomb connector for Muse

ListBomb is a cross-listing app: a seller enters an item once (photos, title, description, price, condition, pickup city and ZIP). ListBomb posts to eBay and the ListBomb Marketplace itself. For Facebook Marketplace, OfferUp and Craigslist (plus Nextdoor by share link, and optional sites like Mercari, Poshmark, Etsy, Reverb, Bonanza and Depop) it prepares the listing so the seller copies it and opens the site to post it themselves. This connector lets Muse, Meta's AI agent, read the seller's own ListBomb items so Muse can create the Facebook Marketplace listing from the seller's own Facebook account, with the seller's approval, and then record the result in ListBomb. ListBomb never posts to Facebook.

Setup

In Muse, add a custom connector with the MCP URL and client ID below (or pick ListBomb under Settings > Connectors once listed).
Sign in with your ListBomb email and password on the ListBomb page that opens, review the permissions and tap Allow. "Mark items as posted" is checked by default (uncheck it for read-only). "Mark items as sold" is unchecked by default.
Disconnect any time in Muse, or in ListBomb under Account settings > Connected apps. Access stops at once; the connection's tokens and sign-in record are deleted within 30 days.

Endpoints and OAuth

What	Value
MCP server (Streamable HTTP, stateless, POST, JSON responses)	`https://quaint-opossum-193.convex.site/muse/mcp`
Authorize (ListBomb sign-in + consent)	`https://quaint-opossum-193.convex.site/muse/oauth/authorize`
Token	`https://quaint-opossum-193.convex.site/muse/oauth/token`
Revocation (RFC 7009)	`https://quaint-opossum-193.convex.site/muse/oauth/revoke`
Dynamic Client Registration (RFC 7591)	`https://quaint-opossum-193.convex.site/muse/oauth/register`
Protected resource metadata (RFC 9728)	`https://quaint-opossum-193.convex.site/.well-known/oauth-protected-resource/muse/mcp`
Authorization server metadata (RFC 8414)	`https://quaint-opossum-193.convex.site/.well-known/oauth-authorization-server`
Client ID	`listbomb-muse` (public client, `token_endpoint_auth_method=none`, no client secret)
PKCE	Required, `S256` only
Allowed redirect URIs for `listbomb-muse`	https URLs on meta.ai, meta.com or facebook.com (e.g. `https://agent.meta.ai/api/hatch/oauth/callback`); anything else is refused with HTTP 400

Authorization code flow (OAuth 2.1). Codes last 5 minutes and are single use. Access tokens are opaque, last 1 hour and are sent as Authorization: Bearer <token>. Refresh tokens last 60 days and rotate on every use; reusing an old refresh token revokes the whole connection. Codes, tokens and secrets are stored only as SHA-256 hashes.

Scopes

Scope	Allows	Default at consent
`items:read`	`list_pending_marketplace_drafts`, `get_listing`	Always granted
`items:mark_posted`	`mark_posted`	Checked (can be unchecked)
`items:mark_sold`	`mark_sold`, `undo_mark_sold`	Unchecked by default; separate checkbox

search_marketplace, get_public_listing and find_similar_listings read only the public ListBomb marketplace and need no scope (also available without sign-in at https://quaint-opossum-193.convex.site/mcp).

Tools

Tool	Class	Input	Output and side effects
`list_pending_marketplace_drafts`	Read	none	Up to 100 of the user's active items not yet on Facebook Marketplace: id, title, price (USD), pickup city, photo count, Facebook status. No side effects.
`get_listing`	Read	`listingId` (required)	One item: title, description, price, condition, category, pickup city and 5-digit ZIP (never a street address), public HTTPS photo URLs in display order, per-site status, and any Facebook title/description override. No side effects.
`search_marketplace`	Read	`query`, optional `state`, `city`, `maxPrice`, `sizes` (XS–6XL), `departments` (men/women/kids), `minPrice`, `conditions`, `brands`, `colors`, `shoeSizes`, `zip` + `withinMiles`	Up to 20 public listings (city-level location only). No side effects.
`get_public_listing`	Read	`slug` (required)	One public listing. Street addresses, phone numbers and emails in text are replaced with "[removed for privacy]". No side effects.
`find_similar_listings`	Read	`slug` (required), `category`, `state`, `zip`, `withinMiles`	Up to 20 public listings that look similar (photo + title visual match), best first, with a 0-1 similarity score. No side effects.
`mark_posted`	Write (not sensitive)	`listingId` (required), `url` (optional http(s) Marketplace link)	Records in ListBomb that the item is live on Facebook Marketplace and saves the link. Changes only ListBomb's own record: nothing is posted, edited or deleted on Facebook or any other site. Idempotent; the user can undo it in the app.
`mark_sold`	Sensitive write (ask every time; never "always allow")	`listingId` (required), `soldOn` (optional: ebay, facebook, offerup, craigslist, nextdoor, other), `confirm` (boolean)	Effect: ends the item's eBay / eBay Motors listings (through the eBay API) and takes the item down from ListBomb Marketplace. An ended eBay listing can't be reopened; it has to be relisted. Confirm every time, enforced by ListBomb: a call without `confirm: true` changes nothing and returns `needsConfirm: true` with a plain-language `summary` to show the user. Only after the user says yes, call again with `confirm: true`. Undo window: a confirmed call returns `pending: true` and `undoUntil`; the sale takes effect 10 minutes later. Until then `undo_mark_sold` or Undo in ListBomb cancels it and nothing is ended. Then it works like Mark sold in the app: other sites where the item is still live go on the user's removal checklist (ListBomb can't remove those). Never deletes or edits the item or changes the price. Already-sold items are left as is. Audit-logged.
`undo_mark_sold`	Write (not sensitive)	`listingId` (required)	Cancels a confirmed `mark_sold` still inside its 10-minute window: the item stays for sale and nothing is ended. Returns `undone` true/false with a `summary`. After the window there is nothing to undo here. Scope `items:mark_sold`. Audit-logged.

Not offered: creating, editing, re-pricing or deleting items; posting to any marketplace; messages; payments.

Errors and HTTP status codes

HTTP	MCP / body	Meaning
200	JSON-RPC result	Success. Tool-level errors come back as `isError: true` with text `<error>: <message>`.
400	`bad_request`, `invalid_url`, `invalid_sold_on`, `no_price`	Missing listingId, bad URL, bad soldOn, or item has no price.
401 + `WWW-Authenticate: Bearer resource_metadata="…"`	`invalid_token`	Missing, expired or revoked token. Refresh or reconnect.
402	`listing_limit`	The user's plan limit blocks the change.
403	`forbidden`	Token lacks the scope (e.g. connected read-only).
404	`not_found`, `unknown_tool`	No such item for this user, or unknown tool.
429 + `Retry-After`	`rate_limited`	Over a rate limit (below).
—	JSON-RPC -32601 / -32602 / -32700	Unknown method / bad params / bad JSON.
400 / 401	OAuth `{error, error_description}`	invalid_client, invalid_grant, invalid_scope, invalid_request, unsupported_grant_type.

Rate limits

Fixed one-minute windows: 60 authenticated tool calls per user, 20 writes (mark_posted / mark_sold / undo_mark_sold) per user, 120 requests per IP, and 30 public (no sign-in) requests per IP. Over a limit returns HTTP 429 with Retry-After (seconds). Repeated wrong passwords on the consent page are throttled.

Data and privacy

Returned: title, description, price, category, condition, public photo URLs, pickup city, 5-digit ZIP and posting status. Never returned: email, password, street address, phone, payment details, marketplace logins or tokens. A security log (time, action, listing ID, result, hashed IP; no content) is kept 90 days. No AI model runs in the connector; no data is sold, used for ads or used to train models. See the Privacy Policy and Terms.

Support: support@listbomb.com