ai-goofish-monitor: An AI Agent That Watches Xianyu Listings, and the Risks of Running It

ai-goofish-monitor is an open-source tool that watches listings on Xianyu, the Chinese second-hand marketplace, and uses an AI model to decide which ones match what you want. The GitHub repo, Usagi-org/ai-goofish-monitor, picked up about 200 stars in a single day and shows roughly 16,100 stars, 2,800 forks and an MIT license.

It is a good example of the "AI agent as personal shopper" pattern. It is also a scraper, which brings terms-of-service, account and privacy risks that the README itself flags.

TL;DR: ai-goofish-monitor at a glance

How does the monitor work?

The README describes a system built on Playwright, a browser automation library, and an AI layer. You create monitoring tasks in a web admin UI. Each task has its own keywords, price range, filters and AI prompt.

The AI part is the useful one. Keyword search returns many listings that look right and are wrong. A multimodal model can read the listing text and look at the photos, then judge against criteria you wrote in plain language. You can even create tasks by describing what you want, though the README notes that this runs as a background job and is not instant.

Features listed in the README:

• A web UI for task management, account management, AI criteria editing, run logs and results.
• Concurrent tasks, each with separate keywords, price range, filters and prompt.
• Filters for free shipping, posting-time range, and province, city and district.
• Cron-based scheduling.
• Multi-account management, binding accounts to tasks, and proxy-pool rotation with retries.

Green magnifier examining product tags, picturing how an AI marketplace monitor judges listings

That last bullet is worth noticing. Account rotation and proxy pools are what you build when a site tries to limit automated traffic. We come back to this under risks.

What are people likely to ask before trying it?

Do I need to read Chinese? The README is written for Chinese-speaking users, and the target site is Chinese. The model reads listings in whatever language you prompt it in, but you will need to understand the results to act on them.

What does it cost to run? The software is free under MIT. The real cost is model calls: every listing the AI judges may send text and photos to your provider. A broad keyword with a short schedule can generate many calls. Start with narrow filters, such as a tight price range and one city, so the model sees fewer listings. The README's filters for free shipping, posting time and region exist for this reason, and it suggests leaving the region filter blank at first because it narrows results a lot.

Is it only for shopping? The code targets one marketplace. The idea, though, is general: describe a match in words, let a multimodal model check each candidate, and send an alert when it passes. That pattern fits price tracking on sites that offer an API, or monitoring your own listings.

What happens when it breaks? Marketplace pages change often. The failure-protection variables, such as TASK_FAILURE_THRESHOLD, are there so a failing task stops instead of hammering the site. Keep those settings on.

Can I trust the AI's verdict? Treat it as a filter, not an authority. A model can misjudge condition from photos, and sellers can word listings to look better than the item is. Always open the listing and check before you pay anyone.

How do you install it?

The README recommends Docker.

git clone https://github.com/Usagi-org/ai-goofish-monitor && cd ai-goofish-monitor
cp .env.example .env
vim .env
docker compose up -d
docker compose logs -f app

The web UI listens at http://127.0.0.1:8000. Data is stored in ./data, including a SQLite file at data/app.sqlite3, along with state/, prompts/, logs/ and images/. To update, run docker compose pull && docker compose up -d. A mirror registry at ghcr.nju.edu.cn exists if the default is slow.

For local development, ./start.sh checks prerequisites, installs dependencies, builds the frontend and starts the backend. You need Python 3.10 or newer, Node.js with npm, and Playwright with Chromium. The Docker image does not include Edge, so the container always uses Chromium.

What do you put in the .env file?

Three variables are required, and they decide the model.

Optional settings include WEB_USERNAME and WEB_PASSWORD (default admin and admin123), RUN_HEADLESS, SERVER_PORT (default 8000), and PROXY_URL. There are also proxy-rotation and failure-protection variables such as PROXY_ROTATION_ENABLED, PROXY_POOL, PROXY_BLACKLIST_TTL and TASK_FAILURE_THRESHOLD.

The README says to change the default credentials in production. Do it before the first start, not after.

How do alerts reach you?

Bell sending green ripples to a receiving box, picturing ntfy, Telegram and webhook alerts from the monitor

When a listing passes your AI criteria, the tool can notify you. The README lists ntfy.sh, Gotify, Bark, a WeCom (企业微信) bot, Telegram and generic webhooks. Each is set through variables such as NTFY_TOPIC_URL, BARK_URL, WX_BOT_URL, TELEGRAM_BOT_TOKEN and WEBHOOK_*.

A webhook output means you can feed matches into other tools, for example a chat channel or a spreadsheet.

What are the terms-of-service and legal risks?

This is the part to read twice. The README itself says users should follow Xianyu's user agreement and robots.txt, and avoid request rates that could burden servers or get accounts restricted. It also says the project is for learning and technical research only, is provided "as is", and that the authors disclaim liability for resulting damages. A separate DISCLAIMER.md is linked.

Our reading:

1. Automated access may violate the marketplace's terms. The README's own warning about restricted accounts points the same way. Check the current user agreement before running anything.
2. Your account is the exposure. Tasks are bound to marketplace accounts. An account flagged for automation can lose access, including to purchases and chats you care about. Use a throwaway account.
3. Proxy rotation raises the stakes. Rotating proxies to avoid limits is a step beyond polite polling. Do not enable it casually.
4. Law differs by country. Scraping rules vary. This is not legal advice.

This is the same grey area we flagged in other trending agent repos. See our write-up on Replica, the Claude skills that clone any app, and the wider debate in Paul Graham on Amazon banning agents. Platforms are actively drawing lines on automated shopping agents, as in Walmart's agent gateway with spending limits.

What are the privacy and security risks?

• Listing images go to your model provider. The multimodal check sends photos and text to the API in OPENAI_BASE_URL. If that is a third-party gateway, it sees them too.
• Marketplace login state is stored on disk. The repo keeps a state/ folder. Treat it like a password file and keep the host private.
• A default admin password on a web UI. If port 8000 is reachable from the internet, anyone who guesses admin123 controls your tasks and accounts.
• Prompt injection from listings. A seller can write text into a listing that tries to steer the model. The model only scores listings here, so the damage is limited to false matches, but do not wire it to automatic purchases. For broader agent risks, see why frontier labs skip security basics.

For agents that do take actions, AgentBeam is the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions.

How does it compare with other browser agents?

The repo's strength is that it is complete: UI, scheduler, accounts, alerts and AI scoring in one container. Its weakness is the same thing. It is tied to a single site's page structure, and the README notes the region filter relies on a snapshot of Xianyu page data built into the project. When the site changes, expect breakage. The repo shows 32 open issues and 8 open pull requests.

Should you run it?

Run it if you read Chinese-language listings, accept the account risk, and want a worked example of an AI monitor with scheduling and alerts. Study it even if you never run it: the pattern of natural-language criteria plus a multimodal model is reusable for any site where you have permission, such as your own store or a public data feed with an API.

A careful first run:

1. Create a throwaway marketplace account.
2. Change WEB_USERNAME and WEB_PASSWORD before docker compose up.
3. Leave proxy rotation off and keep tasks few and slow.
4. Use a model provider you trust with the photos.
5. Read DISCLAIMER.md and the marketplace terms first.

Related reading

• Replica: Claude skills that clone any app
• Paul Graham on Amazon banning agents
• Walmart's agent gateway and spending limits
• Lightpanda 1.0: a headless browser for AI agents
• Firecrawl universal scrape
• Why frontier labs skip security basics
• The ai-goofish-monitor repository

Star counts, defaults and install steps come from the project README as of November 3, 2026, and may change.