@apify/actors-mcp-server 0.10.11-beta.3 → 0.10.11-beta.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -8,6 +8,12 @@ import type { ActorDefinitionPruned } from '../types.js';
8
8
  export declare function getActorMCPServerPath(actorDefinition: ActorDefinition | ActorDefinitionPruned): string | null;
9
9
  /**
10
10
  * Returns the MCP server URL for the given Actor ID.
11
+ *
12
+ * `mcpServerPath` comes from an Actor's `webServerMcpPath` field, i.e. it is
13
+ * controlled by whoever published the Actor. Resolve it against the standby
14
+ * origin and reject anything that escapes that origin so a crafted path
15
+ * (`@host/...`, `.host/...`, `//host/...`, `https://host/...`) cannot redirect
16
+ * the MCP client — and the caller's Apify token — to a third-party host.
11
17
  */
12
18
  export declare function getActorMCPServerURL(realActorId: string, mcpServerPath: string): Promise<string>;
13
19
  /**
@@ -1 +1 @@
1
- {"version":3,"file":"actors.d.ts","sourceRoot":"","sources":["../../src/mcp/actors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAIzD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,eAAe,EAAE,eAAe,GAAG,qBAAqB,GAAG,MAAM,GAAG,IAAI,CAqB7G;AAED;;GAEG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAQtG;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/F;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,SAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7G"}
1
+ {"version":3,"file":"actors.d.ts","sourceRoot":"","sources":["../../src/mcp/actors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAIzD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,eAAe,EAAE,eAAe,GAAG,qBAAqB,GAAG,MAAM,GAAG,IAAI,CAqB7G;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBtG;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/F;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,SAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7G"}
@@ -27,14 +27,30 @@ export function getActorMCPServerPath(actorDefinition) {
27
27
  }
28
28
  /**
29
29
  * Returns the MCP server URL for the given Actor ID.
30
+ *
31
+ * `mcpServerPath` comes from an Actor's `webServerMcpPath` field, i.e. it is
32
+ * controlled by whoever published the Actor. Resolve it against the standby
33
+ * origin and reject anything that escapes that origin so a crafted path
34
+ * (`@host/...`, `.host/...`, `//host/...`, `https://host/...`) cannot redirect
35
+ * the MCP client — and the caller's Apify token — to a third-party host.
30
36
  */
31
37
  export async function getActorMCPServerURL(realActorId, mcpServerPath) {
32
38
  // TODO: get from API instead
33
39
  const standbyBaseUrl = process.env.HOSTNAME === 'mcp-securitybyobscurity.apify.com'
34
40
  ? 'securitybyobscurity.apify.actor'
35
41
  : 'apify.actor';
36
- const standbyUrl = await getActorStandbyURL(realActorId, standbyBaseUrl);
37
- return `${standbyUrl}${mcpServerPath}`;
42
+ // Parse the standby URL up front so the origin comparison below is between two
43
+ // values normalised by the same parser — WHATWG lowercases hostnames, and Apify
44
+ // Actor IDs are mixed-case, so a raw-string comparison would reject legitimate URLs.
45
+ const standby = new URL(`${await getActorStandbyURL(realActorId, standbyBaseUrl)}/`);
46
+ const resolved = new URL(mcpServerPath, standby);
47
+ if (resolved.origin !== standby.origin) {
48
+ throw new Error(`Actor ${realActorId} declares a webServerMcpPath that resolves outside its standby origin`);
49
+ }
50
+ // Strip any userinfo that survived parsing; we never want credentials in the URL we hand to the MCP client.
51
+ resolved.username = '';
52
+ resolved.password = '';
53
+ return resolved.toString();
38
54
  }
39
55
  /**
40
56
  * Gets Actor ID from the Actor object.
@@ -1 +1 @@
1
- {"version":3,"file":"actors.js","sourceRoot":"","sources":["../../src/mcp/actors.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,eAAwD;IAC1F,IAAI,kBAAkB,IAAI,eAAe,IAAI,OAAO,eAAe,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QAChG,MAAM,gBAAgB,GAAG,eAAe,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAEjE,MAAM,KAAK,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;QACxD,gDAAgD;QAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QAED,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAC;QAC9E,IAAI,cAAc,EAAE,CAAC;YACjB,OAAO,cAAc,CAAC;QAC1B,CAAC;QACD,mCAAmC;QACnC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAmB,EAAE,aAAqB;IACjF,6BAA6B;IAC7B,MAAM,cAAc,GAChB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,mCAAmC;QACxD,CAAC,CAAC,iCAAiC;QACnC,CAAC,CAAC,aAAa,CAAC;IACxB,MAAM,UAAU,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACzE,OAAO,GAAG,UAAU,GAAG,aAAa,EAAE,CAAC;AAC3C,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,aAAqB,EAAE,UAAkB;IAC1E,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,SAAS,aAAa,YAAY,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAmB,EAAE,cAAc,GAAG,aAAa;IACxF,OAAO,WAAW,WAAW,IAAI,cAAc,EAAE,CAAC;AACtD,CAAC"}
1
+ {"version":3,"file":"actors.js","sourceRoot":"","sources":["../../src/mcp/actors.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,eAAwD;IAC1F,IAAI,kBAAkB,IAAI,eAAe,IAAI,OAAO,eAAe,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QAChG,MAAM,gBAAgB,GAAG,eAAe,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAEjE,MAAM,KAAK,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;QACxD,gDAAgD;QAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QAED,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAC;QAC9E,IAAI,cAAc,EAAE,CAAC;YACjB,OAAO,cAAc,CAAC;QAC1B,CAAC;QACD,mCAAmC;QACnC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAmB,EAAE,aAAqB;IACjF,6BAA6B;IAC7B,MAAM,cAAc,GAChB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,mCAAmC;QACxD,CAAC,CAAC,iCAAiC;QACnC,CAAC,CAAC,aAAa,CAAC;IACxB,+EAA+E;IAC/E,gFAAgF;IAChF,qFAAqF;IACrF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC;IAErF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,SAAS,WAAW,uEAAuE,CAAC,CAAC;IACjH,CAAC;IACD,4GAA4G;IAC5G,QAAQ,CAAC,QAAQ,GAAG,EAAE,CAAC;IACvB,QAAQ,CAAC,QAAQ,GAAG,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,aAAqB,EAAE,UAAkB;IAC1E,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,SAAS,aAAa,YAAY,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAmB,EAAE,cAAc,GAAG,aAAa;IACxF,OAAO,WAAW,WAAW,IAAI,cAAc,EAAE,CAAC;AACtD,CAAC"}