The plumbing that lets AI agents sell your old junk on XianYu

What it does XianYuApis is an unofficial pipe into China’s XianYu second-hand marketplace. It reverse-engineers the platform’s private WebSocket chat protocol—handling decrypted sign signatures, base64 framing, and Protobuf parsing—and wraps the HTTP endpoints for product details, media uploads, and conversation history. The goal is to let an external AI agent read buyer messages and reply without a human in the loop.

The interesting bit This is protocol archaeology, not just scraping. The author pulled the JavaScript signing algorithm from the client, runs it under Node.js, and keeps the WebSocket alive with automatic token refresh. A growing list of downstream AI agent projects already sits on top of it, suggesting the abstraction is solid enough to build on.

Key highlights

• Full reverse engineering of the WebSocket IM stack: sign verification, base64 encoding, and Protobuf message parsing.
• Decrypted HTTP API signatures covering login, chat history, product info, and image upload.
• A message abstraction layer (handle_message, send_msg) that lets you swap in GPT, Claude, or a local model without touching XianYu internals.
• Auto-refreshing login tokens so the agent stays online around the clock.
• Support for text and image messages, plus retrieval of full chat history with any user.

Caveats

• Authentication is manual: you copy a full cookie string from browser dev tools, and there is no proper OAuth flow.
• The README itself warns against misuse and invites takedown requests, acknowledging the project is unauthorized reverse engineering of a commercial platform.
• You must run both Python and Node.js because the core signing logic is shipped as extracted JavaScript.

Verdict A pragmatic foundation if you need to automate XianYu customer service and can tolerate the maintenance and compliance friction of an unofficial API. If you require vendor blessing or a stable terms-of-service relationship, keep walking.