C
com.apify/apify-mcp-server
Official@apify/actors-mcp-server
Extract data from any website with thousands of scrapers, crawlers, and automations on Apify Store ⚡
No known CVEs
No license
Actively maintained
Last commit 1d ago
Works with most clients
Transport: stdio, sse, http
2 tools · ~145 tok
Grade A · 0.1% of 200K ctx
This server has been archived and is no longer actively maintained.
Step 1
Install in your client
Config is the same across clients — only the file and path differ.
CD
Supported in Claude Desktopstdio, sse, http · Node 18+
Paste into ~/Library/Application Support/Claude/claude_desktop_config.json
{
"mcpServers": {
"apify": {
"url": "https://mcp.apify.com?payment=skyfire"
},
"skyfire": {
"url": "https://api.skyfire.xyz/mcp/sse",
"headers": {
"skyfire-api-key": "<YOUR_SKYFIRE_API_KEY>"
}
}
}
}Are you the author?
Add this badge to your README to show your security score and help users find safe servers.
Embed in your READMEAbout badges →
[](https://mcppedia.org/s/com-apify-apify-mcp-server)
Read me
What com.apify/apify-mcp-server does
Extract data from any website with thousands of scrapers, crawlers, and automations on Apify Store ⚡
Test This Server
Run this in your terminal to verify the server starts. Then let us know if it worked — your result helps other developers.
npx -y '@apify/actors-mcp-server' 2>&1 | head -1 && echo "✓ Server started successfully"
After testing, let us know if it worked:
Loading README…
Scored, not listed
Why this score
Five weighted categories — click any category to see the underlying evidence.
Score breakdown
76/100across 5 weighted dimensions
0255075100
24
9
20
13
10
−24
Security
Maintenance
Efficiency
Documentation
Compatibility
Categoriesclick a row to see evidence
Security
OSV.dev2 fixed
CVE-2026-50143high · fixedCVSS 8.1
Apify Model Context Protocol (MCP) server: Actor MCP path authority injection leaks Apify token
## Actor MCP path authority injection leaks Apify token ### Summary `@apify/actors-mcp-server` version `0.10.7` builds Actor standby URLs by directly concatenating a trusted base URL with an attacker-controlled `webServerMcpPath` value taken from an Actor definition returned by the Apify API. An attacker who publishes a malicious Actor with a crafted `webServerMcpPath` (e.g., `@attacker.example/mcp`) can cause the MCP client to resolve the final URL to an entirely different host. Because the M
CVE-2026-46341medium · fixedCVSS 6.1
Apify Model Context Protocol (MCP) server: Domain Allowlist Bypass in fetch-apify-docs via String Prefix Matching
### Summary The `fetch-apify-docs` tool validates URLs against a domain allowlist using `String.startsWith()` instead of proper URL hostname comparison. This allows bypass via attacker-controlled subdomains (e.g., `https://docs.apify.com.evil.com/`), enabling the tool to fetch and return arbitrary web content to the LLM. ### Details #### Vulnerable component `src/tools/common/fetch_apify_docs.ts`, line 51: ```typescript const isAllowedDomain = ALLOWED_DOC_DOMAINS.some((domain) => url.startsWi
Inventory
Tools (2)
Click any tool to inspect its schema.
~145 tokens total
Help improve this page
This server is missing a description.If you've used it, help the community.
Add informationCommunity
Reviews
Be the first to review
Have you used this server?
Share your experience — it helps other developers decide.
How easy was setup?Did it work reliably?How was the documentation?
Sign in to write a review.
Frequently Asked Questions
- Is com.apify/apify-mcp-server safe to use?
- com.apify/apify-mcp-server has no known CVEs as of the latest MCPpedia security scan. It does not require authentication, so any local process can connect — keep this in mind in shared environments.
- How do I install com.apify/apify-mcp-server?
- com.apify/apify-mcp-server supports copy-paste install configs on its MCPpedia page for Claude Desktop, Cursor, and Claude Code. Scroll to the Quick Install section and select your client.
- What can com.apify/apify-mcp-server do?
- com.apify/apify-mcp-server provides 2 tools: call-actor, add-actor. See the full tools list on the server page for descriptions and parameters.
- What AI clients work with com.apify/apify-mcp-server?
- com.apify/apify-mcp-server is compatible with claude-desktop, cursor, claude-code. It uses stdio and sse and http transport.
- Is com.apify/apify-mcp-server actively maintained?
- com.apify/apify-mcp-server is actively maintained — last commit was 1 day ago. It has 1,487 GitHub stars.
Related
Similar servers
Others in browser
Firecrawl Mcp Server95🔥 Official Firecrawl MCP Server - Adds powerful web scraping and search to Cursor, Claude and any other LLM clients.
6.8k 4
Pullmd95Self-hosted URL- and file-to-Markdown service for humans and AI agents - web pages, documents, images, audio, YouTube. PWA + REST + MCP + Claude Code skill, Reddit-aware, refreshable share links.
194 3
Puppeteer MCP Server95Browser automation with Puppeteer for web scraping and testing
87.9k 5
Apify Mcp Server94The Apify MCP server enables your AI agents to extract data from social media, search engines, maps, e-commerce sites, or any other website using thousands of ready-made scrapers, crawlers, and automation tools available on the Apify Store.
1.5k 1
MCP Security Weekly
Get CVE alerts and security updates for com.apify/apify-mcp-server and similar servers.
Community
Discussion
Start a conversation
Ask a question, share a tip, or report an issue.
Has anyone used this with Cursor?How do you handle auth?Any alternatives?
Sign in to join the discussion.
