Is Apify MCP server safe?

const versionString = execSync(`pnpm view ${PACKAGE_NAME} versions --json`, { encoding: 'utf8' });

"command": "node",

"command": "node",

import { execSync } from 'node:child_process';

const versionString = execSync(`pnpm view ${PACKAGE_NAME} versions --json`, { encoding: 'utf8' });

import { spawn } from 'node:child_process';

const child = spawn(cmd, args, {

const match = KV_RECORD_PATH_RE.exec(pathname);

const match = /;\s*charset\s*=\s*"?([^";]+)"?/i.exec(contentType ?? '');

const cssContent = await fs.readFile(args.path, 'utf8');

await fs.rm(distPath, { recursive: true, force: true });

* caps every body here — its download is also aborted mid-flight at this limit via axios `maxContentLength`.

const response = await handler.fetch(request, options);

async fetch(input: Request | URL | string, init?: RequestInit) {

return fetch(input, { ...init, headers });

const response = await fetch(url, {

import { isAxiosError } from 'axios';

* (`user@api.apify.com`) are rejected even when the host is genuinely ours: axios drops

/** The mid-consumption abort axios raises when a streamed body crosses `maxContentLength`. */

* The request goes straight through `apifyClient.httpClient.axios` (the same axios instance

* socket. One attempt, no retries. `maxContentLength` is enforced by axios itself mid-consumption

* (verified in axios@1.16.1: the adapter wraps streamed responses in a byte-counting generator

// The raw axios instance skips `httpClient.call()` → `ensureNodeInit()`, so reads do NOT honor

response = await apifyClient.httpClient.axios.request<unknown>({

// `validateStatus: null` on this axios instance resolves non-2xx responses instead of throwing,

// instead of blocking on the HTTP fetch (the SDK does not accept an AbortSignal directly).

* The axios response interceptor stores the header value here so it can be

return (apifyClient as unknown as { httpClient?: { axios?: AxiosInstanceLike } }).httpClient?.axios;

* Registers an axios response error interceptor on the ApifyClient's internal

* on errors, so we reach into the internal axios instance.

log.warning('[x402] Failed to access apify-client axios internals — payment header capture disabled');

// eslint-disable-next-line @typescript-eslint/promise-function-async -- axios interceptors must return a rejected promise, not throw

* 1. The captured `payment-required` response header (via axios interceptor)

"mcpServers": {

{

"tools": {

{

this.server = new Server(getServerInfo(), {

this.server = new Server(getServerInfo(), {