Skip to content

Resollo Agent API

by resollo.com · remote · no sign-in to list tools · v3.3.11 · published by com.resollo

Resollo marketplace: search, seller lookup, offers, orders, draft listings. All human-approved.

Deletes · 83 high findings

19 tools: 8 can delete or cancel things and 11 only read.

Scanned Oct 21, 2026

3 checks matched something in the tool definitions. No finding is not a safety guarantee. How the checks work.

claude mcp add --transport http agent-api https://www.resollo.com/api/mcp

Findings

Matches of fixed checks, with the text they matched.

3 high
  • The description contains "Never tell the user", an instruction to keep something from the user.

    Matched text

    description: "...ut page, or cash-payment confirmation). Never tell the user their order is 'placed' or 'paid' after..."

    What this check looks for
  • The description contains "Never tell the user", an instruction to keep something from the user.

    Matched text

    description: "...activate it themselves on resollo.com. Never tell the user the listing is 'live' or 'published'. W..."

    What this check looks for
  • The description contains "Never tell the user", an instruction to keep something from the user.

    Matched text

    description: "...te payment on Stripe's own hosted page. Never tell the user their order is 'paid' after calling thi..."

    What this check looks for

Tools

Open a tool for its reasons and full description. Descriptions are the publisher's own words, shown as they are.

19 tools

Deletes or cancels 8Claude Code: deny
  • offers.makeSubmits a price offer (Make an Offer / bargaining) on a fixed-price Resollo listing, on behalf of the authenticated buyer.No findings

    Why it is in this group

    • The description's first verb is "submit": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Submits a price offer (Make an Offer / bargaining) on a fixed-price Resollo listing, on behalf of the authenticated buyer. Only works on fixed-price listings where the seller has offers enabled and a fully active Stripe Connect account -- never on auctions. A product can only have one active offer at a time; if it's currently locked by someone else's in-flight offer, or isn't otherwise eligible, this returns product_not_eligible. This does NOT move any money -- it only creates a PENDING offer the seller must respond to (see offers.respond). Requires a signed-in Resollo user (OAuth sign-in, or an 'Authorization: Bearer <agent api key>' header).

    Annotations the server declares

    • destructiveHint: true
    • readOnlyHint: false
    • openWorldHint: false
  • offers.respondResponds to a pending Make an Offer / bargaining offer.No findings

    Why it is in this group

    • Nothing in its name or description says what it does, so it is counted as a write.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Responds to a pending Make an Offer / bargaining offer. If the caller is the SELLER of the offer, action must be 'accept', 'reject', or 'counter' (counter_price required for 'counter') and the offer must currently be pending. If the caller is the BUYER, action must be 'accept_counter' and the offer must currently be countered. Accepting an offer or a counter-offer immediately creates a confirmed order at the agreed price -- it does NOT charge any payment method, the buyer still completes payment themselves afterwards through the normal flow, exactly like after orders.place. Requires a signed-in Resollo user (OAuth sign-in, or an 'Authorization: Bearer <agent api key>' header).

    Annotations the server declares

    • destructiveHint: true
    • readOnlyHint: false
    • openWorldHint: false
  • orders.placeCreates a RESERVATION for the given product -- it does NOT complete a purchase and does NOT charge any payment method.1 finding

    Why it is in this group

    • The description's first verb is "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    Findings

    • High

      The description contains "Never tell the user", an instruction to keep something from the user.

      Matched text

      description: "...ut page, or cash-payment confirmation). Never tell the user their order is 'placed' or 'paid' after..."

      What this check looks for
    Description, as the server wrote it
    Creates a RESERVATION for the given product -- it does NOT complete a purchase and does NOT charge any payment method. After calling this tool, a human (the buyer) MUST log in to Resollo and complete payment manually through the normal checkout flow (Stripe-hosted checkout page, or cash-payment confirmation). Never tell the user their order is 'placed' or 'paid' after calling this tool -- tell them the item is reserved and they need to complete payment themselves at resollo.com to finalize it. Only fixed-price listings can be reserved this way (not auctions). Requires a signed-in Resollo user (OAuth sign-in, or an 'Authorization: Bearer <agent api key>' header). The buyer must have explicitly approved this specific order before you call this tool (confirm must be true).

    Annotations the server declares

    • destructiveHint: true
    • readOnlyHint: false
    • openWorldHint: false
  • orders.rejectRejects an order on behalf of the SELLER -- only allowed while the order is still RESERVED, i.e.No findings

    Why it is in this group

    • The name "orders.reject" says "reject": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Rejects an order on behalf of the SELLER -- only allowed while the order is still RESERVED, i.e. before the seller has dispatched it or the buyer has paid. Returns order_not_reserved once the order has moved past that point (use the normal Resollo order page for anything after dispatch). This does NOT move any money -- no payment has happened yet at the RESERVED stage. Requires a signed-in Resollo user (OAuth sign-in, or an 'Authorization: Bearer <agent api key>' header).

    Annotations the server declares

    • destructiveHint: true
    • readOnlyHint: false
    • openWorldHint: false
  • products.createStarts creating a new Resollo listing from photos.1 finding

    Why it is in this group

    • The name "products.create" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).

    Findings

    • High

      The description contains "Never tell the user", an instruction to keep something from the user.

      Matched text

      description: "...activate it themselves on resollo.com. Never tell the user the listing is 'live' or 'published'. W..."

      What this check looks for
    Description, as the server wrote it
    Starts creating a new Resollo listing from photos. It opens a photo upload (no photos in the call), which can be completed in two ways. (1) Resollo's photo picker: in clients that support MCP Apps (e.g. Claude, ChatGPT) it appears right in the chat; otherwise give the seller upload_url, a Resollo page where they pick the photos (signed in; phone gallery or camera works). (2) Direct upload, for agents that have a tool to create the WebP files (e.g. the free photo MCP servers at github.com/resollo/mcp-servers, ImageMagick, cwebp) and can send an HTTP PUT: call with upload: 'direct' -- only then does the result include upload_id and direct_upload, and the picker stays hidden. Create each photo as WebP as direct_upload.requirements says, PUT it to direct_upload.put_urls with direct_upload.headers, then call products.createFromUpload with upload_id. Resollo never converts photos -- if you can't, use (1). Never put photo bytes into a tool argument. A photo that arrives as a file (attached, or a file pasted from the seller's file manager) reaches your tools as that file and can go through (2). Only an inline image (e.g. a screenshot or a copied image) is just pixels, not a file -- for that one, use the picker. After the upload, Resollo's own AI writes the title, description, category, condition, and a suggested price, and creates the listing as an INACTIVE draft that is NOT publicly visible. The seller MUST review and activate it themselves on resollo.com. Never tell the user the listing is 'live' or 'published'. When a picker upload finishes, the picker itself shows the seller the draft and its activation link, so you don't need to look it up or wait for it; if you need its details later, it's the newest 'inactive' listing in sellers.listings. Requires a signed-in Resollo user (OAuth sign-in, or an 'Authorization: Bearer <agent api key>' header).

    Annotations the server declares

    • destructiveHint: true
    • readOnlyHint: false
    • openWorldHint: false
  • products.createFromUploadFinishes a direct upload started with products.create: after you PUT the converted photos to its direct_upload.put_urls, call this with its upload_id.No findings

    Why it is in this group

    • The name "products.createFromUpload" says "create": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Finishes a direct upload started with products.create: after you PUT the converted photos to its direct_upload.put_urls, call this with its upload_id. Resollo's own AI then writes the listing and creates it as an INACTIVE draft (not public) -- returns product_id, the suggested content and price range, and activation_url, where the seller reviews and activates it. Uses 2 AI credits. Photos that aren't WebP within direct_upload.requirements are rejected, never converted. Also used by Resollo's photo picker panel. Requires a signed-in Resollo user.

    Annotations the server declares

    • destructiveHint: true
    • readOnlyHint: false
    • openWorldHint: false
  • questions.askSubmits a public question about a product listing on behalf of the authenticated caller -- exactly the same product_questions record the web 'Ask a question' form creates.No findings

    Why it is in this group

    • The description's first verb is "submit": a word for a change.
    • The server marks it destructive (destructiveHint: true).
    Description, as the server wrote it
    Submits a public question about a product listing on behalf of the authenticated caller -- exactly the same product_questions record the web 'Ask a question' form creates. The seller can answer it on the Resollo web UI (with their own AI-drafted-answer assistant); this tool does not draft or send an answer. Question text is capped at 500 characters. Requires a signed-in Resollo user (OAuth sign-in, or an 'Authorization: Bearer <agent api key>' header).

    Annotations the server declares

    • destructiveHint: true
    • readOnlyHint: false
    • openWorldHint: true
Only reads 11Claude Code: allow
  • marketplace.infoReturns the static reference data an agent needs to build valid searches and read responses without guessing: the numeric category ids and their keys/English names (use these for s…No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Returns the static reference data an agent needs to build valid searches and read responses without guessing: the numeric category ids and their keys/English names (use these for search's category filter), the condition codes, the list of supported ISO currency codes and the fallback default currency (search and product tools default to the caller's own currency when known), the payment- and shipment-method codes, the available sort options, the max search page size, and policy URLs (AI policy, OpenAPI spec). The photo limit per listing depends on the seller's plan -- see sellers.status max_images. Read-only, no authentication required. Safe to call once and cache for the session.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • offers.listReturns the caller's most recent Make-an-Offer / bargaining offers.No findings

    Why it is in this group

    • The name "offers.list" says "list": a word for reading.
    Description, as the server wrote it
    Returns the caller's most recent Make-an-Offer / bargaining offers. Pass role: 'buyer' for offers you sent, or role: 'seller' for offers received on your own listings; omit role for both. Optionally filter to a single state (pending / accepted / rejected / countered / buyer_accepted / expired). Each entry has the product, the offered price, the seller's counter price if any, and timestamps. Read-only, no side effects. Requires a signed-in Resollo user (OAuth sign-in, or an 'Authorization: Bearer <agent api key>' header).

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • orders.listReturns the caller's most recent orders.No findings

    Why it is in this group

    • The name "orders.list" says "list": a word for reading.
    Description, as the server wrote it
    Returns the caller's most recent orders. Pass role: 'buyer' for orders you placed, or role: 'seller' for orders on your own listings; omit role for both. Each entry has the same decoded status booleans as orders.status (reserved / dispatched / paid / received / rejected / closed), plus the product name, item count, total price (converted to the requested currency, default: your own), the other party's name, and a link to the order page. Read-only, no side effects. Requires a signed-in Resollo user (OAuth sign-in, or an 'Authorization: Bearer <agent api key>' header).

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • orders.statusReturns the current status of one order: whether it's reserved, dispatched, paid, received, rejected, or closed (decoded booleans, not a raw state number), carrier/tracking info if…No findings

    Why it is in this group

    • The name "orders.status" says "status": a word for reading.
    Description, as the server wrote it
    Returns the current status of one order: whether it's reserved, dispatched, paid, received, rejected, or closed (decoded booleans, not a raw state number), carrier/tracking info if dispatched, and the total price. The caller must be either the order's buyer or its seller -- returns forbidden otherwise. Read-only, no side effects. Requires a signed-in Resollo user (OAuth sign-in, or an 'Authorization: Bearer <agent api key>' header).

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • products.getFetch the full details of one specific Resollo product listing by its ID, including its Semantic Profile (suitable_for, not_ideal_for, target_audience, key_strengths, evokes, is_si…No findings

    Why it is in this group

    • The name "products.get" says "get": a word for reading.
    Description, as the server wrote it
    Fetch the full details of one specific Resollo product listing by its ID, including its Semantic Profile (suitable_for, not_ideal_for, target_audience, key_strengths, evokes, is_similar_to -- useful for judging fit against a buyer's stated needs), attributes, all image URLs, shipment prices, and the seller's accepted payment/shipment methods. Returns not_found for products that don't exist, are sold, expired, or moderation-hidden. No authentication required. Reading the fields: semantic_profile is null when Resollo's AI wasn't confident enough to write one; shipment_prices are text ranges such as '1000-3000' in shipment_prices_currency (always equal to price.currency, not converted); payment method 'card' means paying by card directly to the seller (e.g. on handover), while online card payment through Resollo is 'stripe' and needs seller.stripe_connect_active.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • products.searchSearch active, publicly available product listings on the Resollo marketplace.No findings

    Why it is in this group

    • The name "products.search" says "search": a word for reading.
    Description, as the server wrote it
    Search active, publicly available product listings on the Resollo marketplace. Use this to browse or filter by keyword (matched at the start of a word: 'phone' finds 'phones' but not 'headphone'), category, price range, currency, or seller location. Returns only currently active, purchasable listings (never sold, expired, or moderation-hidden ones). For full details on one specific product you already have the ID for (including its Semantic Profile fields -- suitable_for, not_ideal_for, target_audience, key_strengths, evokes, is_similar_to -- which this search tool does NOT return), call products.get instead. Results are paginated via next_cursor; pass it back as the cursor argument to fetch the next page. count is the total number of matching listings across all pages, not the number returned on this page. No authentication required.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • questions.listReturns every question asked about a product listing, including the seller's answer where one exists (answer/answered_at are null for unanswered questions).No findings

    Why it is in this group

    • The name "questions.list" says "list": a word for reading.
    Description, as the server wrote it
    Returns every question asked about a product listing, including the seller's answer where one exists (answer/answered_at are null for unanswered questions). Useful to check what past buyers already asked before asking a new one, or before advising a buyer on a purchase decision. Read-only, no authentication required.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • reviews.listReturns the reviews left for a product by past buyers (rating, message, date), plus the product's average rating and review count.No findings

    Why it is in this group

    • The name "reviews.list" says "list": a word for reading.
    Description, as the server wrote it
    Returns the reviews left for a product by past buyers (rating, message, date), plus the product's average rating and review count. Every review is tied to a real, verified order line -- only actual buyers can leave one. Useful to judge product/seller quality before advising a buyer on a purchase decision. Read-only, no authentication required.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • sellers.getReturns a seller's public profile -- the same information the web /user/<id> profile page shows: display name, avatar URL, about text, identity-verification badge, location (countr…No findings

    Why it is in this group

    • The name "sellers.get" says "get": a word for reading.
    Description, as the server wrote it
    Returns a seller's public profile -- the same information the web /user/<id> profile page shows: display name, avatar URL, about text, identity-verification badge, location (country/region/city), when they joined, accepted payment/shipment methods, whether they have a fully active Stripe Connect account, their number of currently active listings, completed-sale count, follower count, and their positive-feedback rating (0-5, null if they have no feedback yet). Useful for judging seller reputation before advising a buyer, or to get the shop_url for browsing everything they sell (pass the same seller id as search's seller_id filter). Read-only, no authentication required.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • sellers.listingsReturns the caller's own product listings in EVERY state -- active, inactive, pending moderation, rejected, and closed -- not just the publicly visible ones (soft-deleted listings …No findings

    Why it is in this group

    • The description's first verb is "return": a word for reading.
    Description, as the server wrote it
    Returns the caller's own product listings in EVERY state -- active, inactive, pending moderation, rejected, and closed -- not just the publicly visible ones (soft-deleted listings are excluded). Use this to find a draft created earlier with products.create (those sit in state 'inactive' until the seller activates them) when you no longer have its product_id, or to review what the seller currently has listed. Each entry includes the listing's state, category, condition, price, quantity, and an edit_url (the seller's product page where an inactive draft is reviewed and activated). A products.create draft's price is the midpoint of Resollo's AI price suggestion; the seller can change it before activating. Optionally filter to a single state. Read-only, no side effects. Requires a signed-in Resollo user (OAuth sign-in, or an 'Authorization: Bearer <agent api key>' header).

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false
  • sellers.statusReturns the authenticated user's current listing capabilities: whether they can create a new listing right now (subscription plan limit), whether they have a payment/shipment metho…No findings

    Why it is in this group

    • The name "sellers.status" says "status": a word for reading.
    Description, as the server wrote it
    Returns the authenticated user's current listing capabilities: whether they can create a new listing right now (subscription plan limit), whether they have a payment/shipment method configured (both required before products.create will succeed), the max images and price their plan allows (max_price null = no price cap), and their remaining AI credit balance (each draft listing costs 2 credits, charged when it is created from the uploaded photos). Call this BEFORE asking the user for photos or calling products.create, so you can tell the user upfront if something would block listing creation, instead of finding out only after a failed attempt. If the credit balance is too low, ai_credits_purchase_url is the seller's resollo.com page for buying more (translate_credits_purchase_url likewise for translation credits). Read-only, no side effects.

    Annotations the server declares

    • readOnlyHint: true
    • openWorldHint: false

This is not a safety rating, and no finding is not a safety guarantee. The groups and findings come from fixed checks of the tool definitions the server returned on the date shown, not from its code or what it does when called. How the checks work.

Install

Pinned to version 3.3.11. Values in angle brackets are yours to fill in.

claude mcp add --transport http agent-api https://www.resollo.com/api/mcp

Run in a terminal.

Claude Code permissions

Allow the reads, ask before a change, deny the deletes. Paste into .claude/settings.json.

.claude/settings.json
{
  "permissions": {
    "allow": [
      "mcp__agent-api__products_search",
      "mcp__agent-api__products_get",
      "mcp__agent-api__sellers_status",
      "mcp__agent-api__sellers_listings",
      "mcp__agent-api__offers_list",
      "mcp__agent-api__orders_status",
      "mcp__agent-api__orders_list",
      "mcp__agent-api__questions_list",
      "mcp__agent-api__reviews_list",
      "mcp__agent-api__sellers_get",
      "mcp__agent-api__marketplace_info"
    ],
    "ask": [],
    "deny": [
      "mcp__agent-api__orders_place",
      "mcp__agent-api__products_create",
      "mcp__agent-api__products_createFromUpload",
      "mcp__agent-api__offers_make",
      "mcp__agent-api__offers_respond",
      "mcp__agent-api__orders_reject",
      "mcp__agent-api__orders_checkoutLink",
      "mcp__agent-api__questions_ask"
    ]
  }
}

Tools that only read are allowed, tools that change things ask first, tools that delete or cancel are denied. It assumes the server is installed as agent-api. Review it before you use it.