{ "openapi": "3.0.1", "info": { "title": "MCP Server Security & Trust Scanner", "description": "Audits Model Context Protocol (MCP) servers for security & trust issues: missing auth, SSRF exposure, secret leaks, prompt-injection risk, and error handling. Get a scored (A-F), shareable report before connecting any MCP server to your AI agents.", "version": "0.2", "x-build-id": "aDz6RlygN3koRXowL" }, "servers": [ { "url": "https://api.apify.com/v2" } ], "paths": { "/acts/abhi72~mcp-security-scanner/run-sync-get-dataset-items": { "post": { "operationId": "run-sync-get-dataset-items-abhi72-mcp-security-scanner", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for its completion, and returns Actor's dataset items in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } }, "/acts/abhi72~mcp-security-scanner/runs": { "post": { "operationId": "runs-sync-abhi72-mcp-security-scanner", "x-openai-isConsequential": false, "summary": "Executes an Actor and returns information about the initiated run in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK", "content": { "application/json": { "schema": { "$ref": "#/components/schemas/runsResponseSchema" } } } } } } }, "/acts/abhi72~mcp-security-scanner/run-sync": { "post": { "operationId": "run-sync-abhi72-mcp-security-scanner", "x-openai-isConsequential": false, "summary": "Executes an Actor, waits for completion, and returns the OUTPUT from Key-value store in response.", "tags": [ "Run Actor" ], "requestBody": { "required": true, "content": { "application/json": { "schema": { "$ref": "#/components/schemas/inputSchema" } } } }, "parameters": [ { "name": "token", "in": "query", "required": true, "schema": { "type": "string" }, "description": "Enter your Apify token here" } ], "responses": { "200": { "description": "OK" } } } } }, "components": { "schemas": { "inputSchema": { "type": "object", "required": [ "serverUrl" ], "properties": { "serverUrl": { "title": "MCP Server URL", "type": "string", "description": "Full URL of the MCP server's Streamable HTTP endpoint (e.g. https://example.com/mcp)." }, "authHeader": { "title": "Authorization header (optional)", "type": "string", "description": "Authorization header used for the authenticated scan (for example, 'Bearer ...'). When this value is supplied and authorized dynamic checks are enabled, the scanner can run an unauthenticated comparison for an allowlisted tool in a separate session without this header. The value is never written to reports." }, "runDynamicChecks": { "title": "Run dynamic checks", "type": "boolean", "description": "Execute live tools/call requests in addition to static analysis. Dynamic calls may trigger tool side effects. Requires authorizedToTest=true and a non-empty exact dynamicToolAllowlist.", "default": false }, "authorizedToTest": { "title": "I am authorized to test this server", "type": "boolean", "description": "Required for dynamic checks. Confirm only when you own the server or have explicit authorization to execute the allowlisted tools.", "default": false }, "dynamicToolAllowlist": { "title": "Exact tool names allowed for dynamic testing", "type": "array", "description": "Only these exact advertised tool names may be executed. An empty list prevents all dynamic tool execution.", "items": { "type": "string" }, "default": [] }, "probeUrl": { "title": "Controlled callback URL (optional)", "type": "string", "description": "A callback URL you control. SSRF behavioral testing is skipped unless this is explicitly provided. The scanner submits the value but cannot prove a fetch without callback telemetry." }, "maxToolsToTest": { "title": "Max tools to dynamically test", "minimum": 1, "maximum": 50, "type": "integer", "description": "Caps how many matching allowlisted tools receive live calls. Discovered tools outside the exact allowlist are never executed.", "default": 10 } } }, "runsResponseSchema": { "type": "object", "properties": { "data": { "type": "object", "properties": { "id": { "type": "string" }, "actId": { "type": "string" }, "userId": { "type": "string" }, "startedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "finishedAt": { "type": "string", "format": "date-time", "example": "2025-01-08T00:00:00.000Z" }, "status": { "type": "string", "example": "READY" }, "meta": { "type": "object", "properties": { "origin": { "type": "string", "example": "API" }, "userAgent": { "type": "string" } } }, "stats": { "type": "object", "properties": { "inputBodyLen": { "type": "integer", "example": 2000 }, "rebootCount": { "type": "integer", "example": 0 }, "restartCount": { "type": "integer", "example": 0 }, "resurrectCount": { "type": "integer", "example": 0 }, "computeUnits": { "type": "integer", "example": 0 } } }, "options": { "type": "object", "properties": { "build": { "type": "string", "example": "latest" }, "timeoutSecs": { "type": "integer", "example": 300 }, "memoryMbytes": { "type": "integer", "example": 1024 }, "diskMbytes": { "type": "integer", "example": 2048 } } }, "buildId": { "type": "string" }, "defaultKeyValueStoreId": { "type": "string" }, "defaultDatasetId": { "type": "string" }, "defaultRequestQueueId": { "type": "string" }, "buildNumber": { "type": "string", "example": "1.0.0" }, "containerUrl": { "type": "string" }, "usage": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "integer", "example": 1 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } }, "usageTotalUsd": { "type": "number", "example": 0.00005 }, "usageUsd": { "type": "object", "properties": { "ACTOR_COMPUTE_UNITS": { "type": "integer", "example": 0 }, "DATASET_READS": { "type": "integer", "example": 0 }, "DATASET_WRITES": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_READS": { "type": "integer", "example": 0 }, "KEY_VALUE_STORE_WRITES": { "type": "number", "example": 0.00005 }, "KEY_VALUE_STORE_LISTS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_READS": { "type": "integer", "example": 0 }, "REQUEST_QUEUE_WRITES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_INTERNAL_GBYTES": { "type": "integer", "example": 0 }, "DATA_TRANSFER_EXTERNAL_GBYTES": { "type": "integer", "example": 0 }, "PROXY_RESIDENTIAL_TRANSFER_GBYTES": { "type": "integer", "example": 0 }, "PROXY_SERPS": { "type": "integer", "example": 0 } } } } } } } } } }