Apify MCP Server
Extract data from any website with thousands of scrapers, crawlers, and automations on Apify Store ⚡
Update first. Issues have been reported, but none is flagged on the version the registry lists. That version can trail the package's newest release, so check you run one past the issues below.
Registry name com.apify/apify-mcp-server
· Source code · Website · Our trust grade: A
Reported issues
Each issue is counted once, with its other IDs listed under it. "Listed version" means the version the registry lists: "Not flagged" means OSV doesn't mark it as affected, and "Not checked" means the source gives no version we can compare.
| Issue | Severity | Listed version | Reported |
|---|---|---|---|
| CVE-2026-81093The get-html-skeleton tool fetched a URL the caller supplied after checking only its syntax. The handler in src/tools/common/get_html_skeleton.ts validated the url argument with isValidHttpUrl from src/utils/generic.ts, which confirmed the string be… | high | Not checked | Aug 27, 2026 |
| CVE-2026-50143The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.10.11, getActorMCPServerURL in src/mcp/actors.ts concatenates the trusted Actor s… | high | Not checked | Aug 18, 2026 |
| CVE-2026-46341The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store. Prior to 0.9.21, the fetch-apify-docs tool in src/tools/common/fetch_apify_docs.ts validates… | medium | Not checked | Jul 16, 2026 |
Versions in the registry
0.21.5 (listed), 0.21.4, 0.21.3, 0.21.2, 0.21.1, 0.21.0, 0.20.2, 0.20.1, 0.20.0, 0.19.5, 0.19.4, 0.19.3, 0.19.2, 0.19.1, 0.19.0, 0.18.4, 0.18.3, 0.18.2, 0.18.1, 0.18.0, 0.17.4, 0.17.3, 0.17.2, 0.17.1, 0.17.0, 0.16.0, 0.15.7, 0.15.6, 0.15.5, 0.15.4 and 63 older