# MCP Server Auditor (`bmiller1009/mcp-server-auditor`) Actor

Audit public MCP servers for exposed tools, risky capabilities, protocol issues, and deployment readiness.

- **URL**: https://apify.com/bmiller1009/mcp-server-auditor.md
- **Developed by:** [Sentinel Signal](https://apify.com/bmiller1009) (community)
- **Categories:** MCP servers, AI, Developer tools
- **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$150.00 / 1,000 completed mcp audits

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

Test an MCP server before connecting it to an AI agent.

## MCP Server Auditor

- ✓ Discover exposed tools and capabilities
- ✓ Identify risky, mutating, or destructive operations
- ✓ Detect protocol, schema, and reliability issues
- ✓ Receive deployment-readiness findings
- ✓ Get structured machine-readable evidence
- ✓ Batch-audit up to 25 MCP servers

MCP Server Auditor evaluates public, unauthenticated Streamable HTTP endpoints through Sentinel Verify. Each target is checked locally against API-IFY's public-network policy before it is sent to Verify.

### Quick start

The Sentinel-owned endpoint below is the controlled, discovery-only qualification target used by the Store prefill.

```json
{
  "servers": [{"url": "https://mcp.sentinelsignal.io/audit-fixture/mcp"}],
  "depth": "standard",
  "includeEvidence": false
}
```

The Actor performs MCP initialization and discovery, evaluates the advertised surface, and returns one structured item per unique target. A successful result has this shape:

```json
{
  "status": "success",
  "result": {
    "capabilities": {"toolCount": 3, "resourceCount": 0, "promptCount": 0},
    "findingCount": 0,
    "summary": {"score": 65.1, "readiness": {"label": "Safe for evaluation"}}
  }
}
```

See [`examples/sample-input.json`](examples/sample-input.json) and [`examples/sample-output.json`](examples/sample-output.json) for the complete contracts. The checked-in output was produced through the Actor's real service path against the controlled endpoint and Verify `1.0.703`. Scores and findings depend on the endpoint's current behavior and Verify rules.

### Input and batching

`servers` accepts one to 25 objects with a public HTTPS `url`. Duplicate URLs are collapsed and produce one result with a warning. `depth` is currently fixed to `standard`. Set `includeEvidence` to `false` for a smaller result.

### Output and failure behavior

Results use the stable API-IFY `schemaVersion: "1.0"` envelope. The default dataset contains audit or failure records, while `RUN_SUMMARY` in the default key-value store records processing, delivery, billing, dependency, and budget totals.

`restricted` means API-IFY rejected the target locally. `unreachable` means the public endpoint could not complete MCP discovery. `unsupported` covers unsupported target behavior. `dependency_unavailable` means Verify was temporarily unavailable. `failed` is reserved for unexpected audit failures. Failures are isolated per target.

### Pricing

One `mcp-audit` event is charged only when a successful or useful partial audit is accepted into the dataset. Restricted, invalid, unreachable, unsupported, dependency-failure, and failed outcomes are uncharged. Work does not start when the caller's remaining event budget cannot cover another audit. The current event price is displayed by Apify.

### Limitations

- Public, unauthenticated MCP endpoints only.
- HTTPS on port 443 only; credentials and fragments in URLs are rejected.
- Streamable HTTP transport only.
- Private, loopback, link-local, metadata, reserved, and mixed public/private DNS targets are rejected.
- Maximum 25 submitted targets and four concurrent audits per run.
- Audit availability depends on Sentinel Verify and the target MCP server.

### Privacy and security

The target endpoint is sent to Sentinel Verify for analysis after local public-network validation. Results are stored in the customer's Apify run dataset and summary store. Do not place credentials in target URLs or query parameters. Published datasets, key-value records, and structured logs redact authorization values, secrets, private keys, and secret-like query parameters.

`VERIFY_API_KEY` is an operator-managed Actor secret. `VERIFY_BASE_URL` and `VERIFY_TIMEOUT_SECONDS` are operator settings, not Actor inputs.

### Support

For a reproducible support request, provide the Apify run ID, result `itemId`, and status. Never send credentials or unredacted URLs through support. Contact Sentinel Signal Systems through the support link on the Actor page.

# Actor input Schema

## `servers` (type: `array`):

One to 25 public HTTPS Streamable HTTP server endpoints.

## `depth` (type: `string`):

The deterministic audit profile to run.

## `includeEvidence` (type: `boolean`):

Include bounded evidence returned by Sentinel Verify.

## Actor input object example

```json
{
  "servers": [
    {
      "url": "https://mcp.sentinelsignal.io/audit-fixture/mcp"
    }
  ],
  "depth": "standard",
  "includeEvidence": true
}
```

# Actor output Schema

## `results` (type: `string`):

No description

## `runSummary` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "servers": [
        {
            "url": "https://mcp.sentinelsignal.io/audit-fixture/mcp"
        }
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("bmiller1009/mcp-server-auditor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "servers": [{ "url": "https://mcp.sentinelsignal.io/audit-fixture/mcp" }] }

# Run the Actor and wait for it to finish
run = client.actor("bmiller1009/mcp-server-auditor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "servers": [
    {
      "url": "https://mcp.sentinelsignal.io/audit-fixture/mcp"
    }
  ]
}' |
apify call bmiller1009/mcp-server-auditor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,bmiller1009/mcp-server-auditor"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/nZfGfvbtga0qG06Vd/builds/s95Qbxb7zW3KY0mWn/openapi.json