{ "openapi": "3.0.1", "info": { "title": "MCP Server Validator & Security Audit 2026", "description": "Validate remote MCP servers for current protocol compatibility, OAuth, headers, schemas, capabilities, tools/resources inventories, and production security without invoking tools.", "version": "0.2", "x-build-id": "Rhumxo5SlYkgMLHd9" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/craigtechservicesllc~mcp-server-validator-security-audit/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-craigtechservicesllc-mcp-server-validator-security-audit", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/craigtechservicesllc~mcp-server-validator-security-audit/runs": { "post": { "operationId": "runs-sync-craigtechservicesllc-mcp-server-validator-security-audit", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/craigtechservicesllc~mcp-server-validator-security-audit/run-sync": { "post": { "operationId": "run-sync-craigtechservicesllc-mcp-server-validator-security-audit", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "servers" ], "properties": { "servers": { "title": "MCP server endpoints", "minItems": 1, "maxItems": 25, "type": "array", "description": "Remote Streamable HTTP MCP endpoint URLs to audit. Up to 25 per run.", "items": { "type": "object", "properties": { "url": { "title": "MCP endpoint URL", "type": "string", "editor": "textfield", "pattern": "^https?:\\/\\/.+", "maxLength": 2048, "description": "Public Streamable HTTP MCP endpoint URL to audit. HTTPS is required by default; private, loopback, link-local, and reserved network targets are blocked." }, "name": { "title": "Label", "description": "Optional label used only in the report.", "type": "string", "editor": "textfield", "maxLength": 120 } }, "required": [ "url" ], "additionalProperties": false } }, "bearerToken": { "title": "Bearer token (optional)", "type": "string", "description": "Apify secret input. Used only as an Authorization header to same-origin HTTPS MCP endpoints, exact secret values are redacted from persisted reports, and plaintext HTTP credential transmission is blocked." }, "protocolVersion": { "title": "Target protocol", "enum": [ "2026-07-28" ], "type": "string", "description": "The launch version focuses on the current MCP revision.", "default": "2026-07-28" }, "compatibilityProbe": { "title": "Detect legacy 2025 servers", "type": "boolean", "description": "Checks whether the endpoint also responds like a legacy 2025 MCP server so migration issues can be identified.", "default": true }, "originSecurityProbe": { "title": "Test Origin rejection", "type": "boolean", "description": "Sends one safe discovery request with an unrelated Origin header. No tool is invoked.", "default": true }, "headerComplianceProbe": { "title": "Test MCP header enforcement", "type": "boolean", "description": "Sends safe discovery requests with missing/mismatched Mcp-Method and MCP-Protocol-Version headers to verify final 2026-07-28 enforcement.", "default": true }, "validateAuthorizationDiscovery": { "title": "Validate OAuth discovery", "type": "boolean", "description": "For protected endpoints, validates RFC 9728 Protected Resource Metadata plus RFC 8414/OIDC authorization-server discovery, issuer consistency, PKCE S256, Client ID Metadata Document readiness, endpoint URL safety, scope signals, and safe 401/403 invalid-token semantics without starting an OAuth login.", "default": true }, "includeInventory": { "title": "Include safe capability inventory", "type": "boolean", "description": "Includes bounded tool names/schema/risk-hint flags, resource URIs, templates, and prompt names. Full tool descriptions and tokens are not emitted.", "default": true }, "timeoutSecs": { "title": "Per-request timeout", "minimum": 2, "maximum": 60, "type": "integer", "description": "Maximum wall-clock time allowed for each individual HTTP request before the audit cancels it.", "default": 15 }, "maxResponseBytes": { "title": "Maximum response bytes", "minimum": 64000, "maximum": 1500000, "type": "integer", "description": "Safety cap for each HTTP response.", "default": 1000000 }, "maxListPages": { "title": "Maximum pages per list method", "minimum": 1, "maximum": 20, "type": "integer", "description": "Maximum number of pagination pages requested from each MCP list method to bound audit work and avoid cursor loops.", "default": 5 }, "maxItemsPerCapability": { "title": "Maximum items per capability", "minimum": 1, "maximum": 2000, "type": "integer", "description": "Maximum number of discovered tools, resources, resource templates, or prompts retained per capability.", "default": 500 }, "concurrency": { "title": "Concurrent endpoint audits", "minimum": 1, "maximum": 5, "type": "integer", "description": "Maximum number of MCP endpoints audited at the same time. The runtime also enforces a hard safety cap of 5.", "default": 3 }, "allowInsecureHttp": { "title": "Allow public HTTP endpoints", "type": "boolean", "description": "Off by default. Only unauthenticated public HTTP endpoints can be audited; private/local/reserved targets and credential transmission over HTTP remain blocked in production.", "default": false } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } }