@apify/actors-mcp-server 0.20.1-beta.9 → 0.20.2-beta.0

package/dist/utils/ajv.d.ts

@@ -1,6 +1,10 @@
 import type { ValidateFunction } from 'ajv';
 import Ajv from 'ajv';
-export declare const ajv: Ajv;
+/**
+ * Ajv with the server's validation policy. One instance per compile, never shared: Ajv caches every compiled
+ * schema in a Map that is never evicted.
+ */
+export declare function createAjv(): Ajv;
 /**
  * Removes the `$schema` property and drops fields with real `default` values from `required`.
  *
@@ -22,7 +26,7 @@ export declare function fixZodSchemaRequired(schema: Record<string, unknown>): R
  * and fixing the required array.
  *
  * **Unknown properties are silently stripped** by the AJV `removeAdditional: true` option
- * (set on the shared `ajv` instance). MCP / LLM clients regularly send extra top-level keys
+ * (set in `createAjv`). MCP / LLM clients regularly send extra top-level keys
  * (client metadata, duplicated hints, transport leftovers) that would otherwise cause validation
  * failures. Stripping them is safer than allowing them through with `additionalProperties: true`,
  * because no downstream code should rely on undeclared properties.

package/dist/utils/ajv.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ajv.d.ts","sourceRoot":"","sources":["../../src/utils/ajv.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,KAAK,CAAC;AAC5C,OAAO,GAAG,MAAM,KAAK,CAAC;AAEtB,eAAO,MAAM,GAAG,KAA2E,CAAC;AAe5F;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAc7F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB,CAE/E"}
+{"version":3,"file":"ajv.d.ts","sourceRoot":"","sources":["../../src/utils/ajv.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,KAAK,CAAC;AAC5C,OAAO,GAAG,MAAM,KAAK,CAAC;AAEtB;;;GAGG;AACH,wBAAgB,SAAS,IAAI,GAAG,CAgB/B;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAc7F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,gBAAgB,CAE/E"}

package/dist/utils/ajv.js

@@ -1,17 +1,24 @@
 import Ajv from 'ajv';
-export const ajv = new Ajv({ coerceTypes: 'array', strict: false, removeAdditional: true });
-// `pattern`/`patternProperties` compile a RegExp from untrusted Actor / proxied-MCP input schemas;
-// a catastrophic-backtracking pattern freezes the single-threaded event loop (ReDoS). `format` is
-// inert today (ajv-formats is not registered) but would arm the same vector if it ever were. This
-// layer only sanitizes LLM args — the Actor re-validates its real input on the run — so dropping
-// regex enforcement removes the DoS surface with no loss of protection. Consequence for `src/`
-// schemas: a `.regex()` on a Zod field is NOT enforced here. It still reaches `tools/list` and still
-// fires in a tool body's `parse()`, where it throws a raw ZodError at the client instead of a
-// readable error — so rely on the API's own validation rather than adding one. `taskNameSchema`
-// (`tools/tasks/task_helpers.ts`) still carries one and predates this note.
-ajv.removeKeyword('pattern');
-ajv.removeKeyword('patternProperties');
-ajv.removeKeyword('format');
+/**
+ * Ajv with the server's validation policy. One instance per compile, never shared: Ajv caches every compiled
+ * schema in a Map that is never evicted.
+ */
+export function createAjv() {
+    const instance = new Ajv({ coerceTypes: 'array', strict: false, removeAdditional: true });
+    // `pattern`/`patternProperties` compile a RegExp from untrusted Actor / proxied-MCP input schemas;
+    // a catastrophic-backtracking pattern freezes the single-threaded event loop (ReDoS). `format` is
+    // inert today (ajv-formats is not registered) but would arm the same vector if it ever were. This
+    // layer only sanitizes LLM args — the Actor re-validates its real input on the run — so dropping
+    // regex enforcement removes the DoS surface with no loss of protection. Consequence for `src/`
+    // schemas: a `.regex()` on a Zod field is NOT enforced here. It still reaches `tools/list` and still
+    // fires in a tool body's `parse()`, where it throws a raw ZodError at the client instead of a
+    // readable error — so rely on the API's own validation rather than adding one. `taskNameSchema`
+    // (`tools/tasks/task_helpers.ts`) still carries one and predates this note.
+    instance.removeKeyword('pattern');
+    instance.removeKeyword('patternProperties');
+    instance.removeKeyword('format');
+    return instance;
+}
 /**
  * Removes the `$schema` property and drops fields with real `default` values from `required`.
  *
@@ -46,7 +53,7 @@ export function fixZodSchemaRequired(schema) {
  * and fixing the required array.
  *
  * **Unknown properties are silently stripped** by the AJV `removeAdditional: true` option
- * (set on the shared `ajv` instance). MCP / LLM clients regularly send extra top-level keys
+ * (set in `createAjv`). MCP / LLM clients regularly send extra top-level keys
  * (client metadata, duplicated hints, transport leftovers) that would otherwise cause validation
  * failures. Stripping them is safer than allowing them through with `additionalProperties: true`,
  * because no downstream code should rely on undeclared properties.
@@ -56,6 +63,6 @@ export function fixZodSchemaRequired(schema) {
  * so they are never subject to this stripping.
  */
 export function compileSchema(schema) {
-    return ajv.compile(fixZodSchemaRequired(schema));
+    return createAjv().compile(fixZodSchemaRequired(schema));
 }
 //# sourceMappingURL=ajv.js.map

package/dist/utils/ajv.js.map

@@ -1 +1 @@
-{"version":3,"file":"ajv.js","sourceRoot":"","sources":["../../src/utils/ajv.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,KAAK,CAAC;AAEtB,MAAM,CAAC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;AAE5F,mGAAmG;AACnG,kGAAkG;AAClG,kGAAkG;AAClG,iGAAiG;AACjG,+FAA+F;AAC/F,qGAAqG;AACrG,8FAA8F;AAC9F,gGAAgG;AAChG,4EAA4E;AAC5E,GAAG,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;AAC7B,GAAG,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;AACvC,GAAG,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;AAE5B;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA+B;IAChE,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,OAAO,CAAC;IAEvB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC3G,MAAM,UAAU,GAAG,OAAO,CAAC,UAAqC,CAAC;QACjE,OAAO,CAAC,QAAQ,GAAI,OAAO,CAAC,QAAqB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;YACnE,MAAM,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YAC1C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACzE,OAAQ,WAAqC,CAAC,OAAO,KAAK,SAAS,CAAC;QACxE,CAAC,CAAC,CAAC;IACP,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,MAA+B;IACzD,OAAO,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;AACrD,CAAC"}
+{"version":3,"file":"ajv.js","sourceRoot":"","sources":["../../src/utils/ajv.ts"],"names":[],"mappings":"AACA,OAAO,GAAG,MAAM,KAAK,CAAC;AAEtB;;;GAGG;AACH,MAAM,UAAU,SAAS;IACrB,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1F,mGAAmG;IACnG,kGAAkG;IAClG,kGAAkG;IAClG,iGAAiG;IACjG,+FAA+F;IAC/F,qGAAqG;IACrG,8FAA8F;IAC9F,gGAAgG;IAChG,4EAA4E;IAC5E,QAAQ,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;IAClC,QAAQ,CAAC,aAAa,CAAC,mBAAmB,CAAC,CAAC;IAC5C,QAAQ,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;IACjC,OAAO,QAAQ,CAAC;AACpB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAA+B;IAChE,MAAM,OAAO,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC9B,OAAO,OAAO,CAAC,OAAO,CAAC;IAEvB,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,OAAO,OAAO,CAAC,UAAU,KAAK,QAAQ,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,EAAE,CAAC;QAC3G,MAAM,UAAU,GAAG,OAAO,CAAC,UAAqC,CAAC;QACjE,OAAO,CAAC,QAAQ,GAAI,OAAO,CAAC,QAAqB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE;YACnE,MAAM,WAAW,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;YAC1C,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,KAAK,IAAI;gBAAE,OAAO,IAAI,CAAC;YACzE,OAAQ,WAAqC,CAAC,OAAO,KAAK,SAAS,CAAC;QACxE,CAAC,CAAC,CAAC;IACP,CAAC;IAED,OAAO,OAAO,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,aAAa,CAAC,MAA+B;IACzD,OAAO,SAAS,EAAE,CAAC,OAAO,CAAC,oBAAoB,CAAC,MAAM,CAAC,CAAC,CAAC;AAC7D,CAAC"}

package/manifest.json

@@ -2,7 +2,7 @@
   "manifest_version": "0.3",
   "name": "apify-mcp-server",
   "display_name": "Apify",
-  "version": "0.20.1",
+  "version": "0.20.2",
   "description": "Extract data from any website with thousands of scrapers, crawlers, and automations on Apify Store.",
   "long_description": "Apify is the world's largest marketplace of tools for web scraping, crawling, data extraction, and web automation. Get structured data from social media, e-commerce, search engines, maps, travel sites, or any other website.",
   "keywords": [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@apify/actors-mcp-server",
-  "version": "0.20.1-beta.9",
+  "version": "0.20.2-beta.0",
   "type": "module",
   "description": "Apify MCP Server",
   "mcpName": "com.apify/apify-mcp-server",

package/server.json

@@ -6,7 +6,7 @@
     "url": "https://github.com/apify/apify-mcp-server",
     "source": "github"
   },
-  "version": "0.20.1",
+  "version": "0.20.2",
   "remotes": [
     {
       "type": "streamable-http",