@apify/actors-mcp-server 0.10.11-beta.3 → 0.10.11-beta.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
package/dist/mcp/actors.d.ts
CHANGED
|
@@ -8,6 +8,12 @@ import type { ActorDefinitionPruned } from '../types.js';
|
|
|
8
8
|
export declare function getActorMCPServerPath(actorDefinition: ActorDefinition | ActorDefinitionPruned): string | null;
|
|
9
9
|
/**
|
|
10
10
|
* Returns the MCP server URL for the given Actor ID.
|
|
11
|
+
*
|
|
12
|
+
* `mcpServerPath` comes from an Actor's `webServerMcpPath` field, i.e. it is
|
|
13
|
+
* controlled by whoever published the Actor. Resolve it against the standby
|
|
14
|
+
* origin and reject anything that escapes that origin so a crafted path
|
|
15
|
+
* (`@host/...`, `.host/...`, `//host/...`, `https://host/...`) cannot redirect
|
|
16
|
+
* the MCP client — and the caller's Apify token — to a third-party host.
|
|
11
17
|
*/
|
|
12
18
|
export declare function getActorMCPServerURL(realActorId: string, mcpServerPath: string): Promise<string>;
|
|
13
19
|
/**
|
package/dist/mcp/actors.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"actors.d.ts","sourceRoot":"","sources":["../../src/mcp/actors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAIzD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,eAAe,EAAE,eAAe,GAAG,qBAAqB,GAAG,MAAM,GAAG,IAAI,CAqB7G;AAED
|
|
1
|
+
{"version":3,"file":"actors.d.ts","sourceRoot":"","sources":["../../src/mcp/actors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAGpD,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAIzD;;;;GAIG;AACH,wBAAgB,qBAAqB,CAAC,eAAe,EAAE,eAAe,GAAG,qBAAqB,GAAG,MAAM,GAAG,IAAI,CAqB7G;AAED;;;;;;;;GAQG;AACH,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAmBtG;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS/F;AAED;;GAEG;AACH,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,cAAc,SAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAE7G"}
|
package/dist/mcp/actors.js
CHANGED
|
@@ -27,14 +27,30 @@ export function getActorMCPServerPath(actorDefinition) {
|
|
|
27
27
|
}
|
|
28
28
|
/**
|
|
29
29
|
* Returns the MCP server URL for the given Actor ID.
|
|
30
|
+
*
|
|
31
|
+
* `mcpServerPath` comes from an Actor's `webServerMcpPath` field, i.e. it is
|
|
32
|
+
* controlled by whoever published the Actor. Resolve it against the standby
|
|
33
|
+
* origin and reject anything that escapes that origin so a crafted path
|
|
34
|
+
* (`@host/...`, `.host/...`, `//host/...`, `https://host/...`) cannot redirect
|
|
35
|
+
* the MCP client — and the caller's Apify token — to a third-party host.
|
|
30
36
|
*/
|
|
31
37
|
export async function getActorMCPServerURL(realActorId, mcpServerPath) {
|
|
32
38
|
// TODO: get from API instead
|
|
33
39
|
const standbyBaseUrl = process.env.HOSTNAME === 'mcp-securitybyobscurity.apify.com'
|
|
34
40
|
? 'securitybyobscurity.apify.actor'
|
|
35
41
|
: 'apify.actor';
|
|
36
|
-
|
|
37
|
-
|
|
42
|
+
// Parse the standby URL up front so the origin comparison below is between two
|
|
43
|
+
// values normalised by the same parser — WHATWG lowercases hostnames, and Apify
|
|
44
|
+
// Actor IDs are mixed-case, so a raw-string comparison would reject legitimate URLs.
|
|
45
|
+
const standby = new URL(`${await getActorStandbyURL(realActorId, standbyBaseUrl)}/`);
|
|
46
|
+
const resolved = new URL(mcpServerPath, standby);
|
|
47
|
+
if (resolved.origin !== standby.origin) {
|
|
48
|
+
throw new Error(`Actor ${realActorId} declares a webServerMcpPath that resolves outside its standby origin`);
|
|
49
|
+
}
|
|
50
|
+
// Strip any userinfo that survived parsing; we never want credentials in the URL we hand to the MCP client.
|
|
51
|
+
resolved.username = '';
|
|
52
|
+
resolved.password = '';
|
|
53
|
+
return resolved.toString();
|
|
38
54
|
}
|
|
39
55
|
/**
|
|
40
56
|
* Gets Actor ID from the Actor object.
|
package/dist/mcp/actors.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"actors.js","sourceRoot":"","sources":["../../src/mcp/actors.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,eAAwD;IAC1F,IAAI,kBAAkB,IAAI,eAAe,IAAI,OAAO,eAAe,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QAChG,MAAM,gBAAgB,GAAG,eAAe,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAEjE,MAAM,KAAK,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;QACxD,gDAAgD;QAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QAED,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAC;QAC9E,IAAI,cAAc,EAAE,CAAC;YACjB,OAAO,cAAc,CAAC;QAC1B,CAAC;QACD,mCAAmC;QACnC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED
|
|
1
|
+
{"version":3,"file":"actors.js","sourceRoot":"","sources":["../../src/mcp/actors.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,uBAAuB,EAAE,MAAM,YAAY,CAAC;AAErD;;;;GAIG;AACH,MAAM,UAAU,qBAAqB,CAAC,eAAwD;IAC1F,IAAI,kBAAkB,IAAI,eAAe,IAAI,OAAO,eAAe,CAAC,gBAAgB,KAAK,QAAQ,EAAE,CAAC;QAChG,MAAM,gBAAgB,GAAG,eAAe,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC;QAEjE,MAAM,KAAK,GAAG,uBAAuB,CAAC,gBAAgB,CAAC,CAAC;QACxD,gDAAgD;QAChD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACrB,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QAED,wEAAwE;QACxE,kCAAkC;QAClC,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,uBAAuB,CAAC,CAAC;QAC9E,IAAI,cAAc,EAAE,CAAC;YACjB,OAAO,cAAc,CAAC;QAC1B,CAAC;QACD,mCAAmC;QACnC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,IAAI,CAAC;AAChB,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAmB,EAAE,aAAqB;IACjF,6BAA6B;IAC7B,MAAM,cAAc,GAChB,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,mCAAmC;QACxD,CAAC,CAAC,iCAAiC;QACnC,CAAC,CAAC,aAAa,CAAC;IACxB,+EAA+E;IAC/E,gFAAgF;IAChF,qFAAqF;IACrF,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,GAAG,MAAM,kBAAkB,CAAC,WAAW,EAAE,cAAc,CAAC,GAAG,CAAC,CAAC;IAErF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACjD,IAAI,QAAQ,CAAC,MAAM,KAAK,OAAO,CAAC,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CAAC,SAAS,WAAW,uEAAuE,CAAC,CAAC;IACjH,CAAC;IACD,4GAA4G;IAC5G,QAAQ,CAAC,QAAQ,GAAG,EAAE,CAAC;IACvB,QAAQ,CAAC,QAAQ,GAAG,EAAE,CAAC;IACvB,OAAO,QAAQ,CAAC,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,aAAqB,EAAE,UAAkB;IAC1E,MAAM,WAAW,GAAG,IAAI,WAAW,CAAC,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC,CAAC;IAE3D,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC/C,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC;IAC/B,IAAI,CAAC,IAAI,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,SAAS,aAAa,YAAY,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,CAAC;AACnB,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAmB,EAAE,cAAc,GAAG,aAAa;IACxF,OAAO,WAAW,WAAW,IAAI,cAAc,EAAE,CAAC;AACtD,CAAC"}
|