Apify MCP Server
MCPpedia last refreshed this data
This server has been archived and is no longer actively maintained.
Actors MCP Server is an MCP server that apify MCP Server. Its tool list has not been published yet over stdio, sse and http, requires no API key, and scores 84/100 on MCPpedia's security, maintenance and efficiency rubric.
Config is the same across clients — only the file and path differ.
{
"mcpServers": {
"apify": {
"url": "https://mcp.apify.com?payment=skyfire"
},
"skyfire": {
"url": "https://api.skyfire.xyz/mcp/sse",
"headers": {
"skyfire-api-key": "<YOUR_SKYFIRE_API_KEY>"
}
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
The Apify Model Context Protocol (MCP) server at mcp.apify.com enables your AI agents to extract data from social media, search engines, maps, e-commerce sites, and any other website using thousands of ready-made scrapers, crawlers, and automation tools from Apify Store. It supports OAuth, allowing you to connect from clients like Claude.ai or Visual Studio Code using just the URL.
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y '@apify/actors-mcp-server' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Five weighted categories — click any category to see the underlying evidence.
Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token
## Actor MCP path authority injection leaks Apify token ### Summary `@apify/actors-mcp-server` version `0.10.7` builds Actor standby URLs by directly concatenating a trusted base URL with an attacker-controlled `webServerMcpPath` value taken from an Actor definition returned by the Apify API. An attacker who publishes a malicious Actor with a crafted `webServerMcpPath` (e.g., `@attacker.example/mcp`) can cause the MCP client to resolve the final URL to an entirely different host. Because the M
Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching
### Summary The `fetch-apify-docs` tool validates URLs against a domain allowlist using `String.startsWith()` instead of proper URL hostname comparison. This allows bypass via attacker-controlled subdomains (e.g., `https://docs.apify.com.evil.com/`), enabling the tool to fetch and return arbitrary web content to the LLM. ### Details #### Vulnerable component `src/tools/common/fetch_apify_docs.ts`, line 51: ```typescript const isAllowedDomain = ALLOWED_DOC_DOMAINS.some((domain) => url.startsWi
Click any tool to inspect its schema.
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
Sign in to write a review.
Others in other
Compress tool outputs, logs, files, and RAG chunks before they reach the LLM. 60-95% fewer tokens, same answers. Library, proxy, MCP server.
Transport for TMCP using STDIO
The graph based agentic IDE
Buddhist canon tools: search, passages, cross-canon parallels, dictionaries — all URN-cited.
MCP Security Weekly
Get CVE alerts and security updates for Actors Mcp Server and similar servers.
Start a conversation
Ask a question, share a tip, or report an issue.
Sign in to join the discussion.