ℹ️ Maintainers note: there was already discussion about changing the server.json authorization metadata to always required in #1174. The main issues is that the server.json spec does not support setting that authentication is required under some condition and we advertise in the server.json only the main mcp.apify.com URL that currently requires token. The MCP server might not require auth when the ?tools= is specified with tools that do not require auth like docs for example, but that is out of server.json scope currently.
Problem
getServerCard() (src/server_card.ts) emits authentication: { required: true, schemes: ['bearer', 'oauth2'] }. server.json emits remotes[0].headers[0].isRequired: true. Both unconditional — but the server does serve an anonymous surface.
Verified against production, no credentials:
| Endpoint |
initialize |
tools/list |
?tools=search-actors,fetch-actor-details,search-apify-docs,fetch-apify-docs |
200 |
200 — returns those 4 tools |
/ (default) |
401 invalid_token |
— |
Documented too: https://docs.apify.com/integrations/mcp names the 4 tools usable without a token.
Why it matters
Discovery metadata is read before connecting. An agent that trusts required: true prompts for a token before anonymous exploration, or skips the server — friction on exactly the path we want frictionless.
Fix
Auth is conditional on the ?tools param, so neither true nor false is correct on its own. Options:
remotes[].headers[].isRequired: false plus a description naming the anonymous toolset (what the old hand-maintained apify.com card did).- Per-tool auth annotation.
test/unit/server-card.test.ts here and in the internal repo pins required === true — update alongside.
Related
ℹ️ Maintainers note: there was already discussion about changing the server.json authorization metadata to always required in #1174. The main issues is that the server.json spec does not support setting that authentication is required under some condition and we advertise in the server.json only the main
mcp.apify.comURL that currently requires token. The MCP server might not require auth when the?tools=is specified with tools that do not require auth likedocsfor example, but that is out of server.json scope currently.Problem
getServerCard()(src/server_card.ts) emitsauthentication: { required: true, schemes: ['bearer', 'oauth2'] }.server.jsonemitsremotes[0].headers[0].isRequired: true. Both unconditional — but the server does serve an anonymous surface.Verified against production, no credentials:
initializetools/list?tools=search-actors,fetch-actor-details,search-apify-docs,fetch-apify-docs/(default)invalid_tokenDocumented too: https://docs.apify.com/integrations/mcp names the 4 tools usable without a token.
Why it matters
Discovery metadata is read before connecting. An agent that trusts
required: trueprompts for a token before anonymous exploration, or skips the server — friction on exactly the path we want frictionless.Fix
Auth is conditional on the
?toolsparam, so neithertruenorfalseis correct on its own. Options:remotes[].headers[].isRequired: falseplus a description naming the anonymous toolset (what the old hand-maintained apify.com card did).test/unit/server-card.test.tshere and in the internal repo pinsrequired === true— update alongside.Related
required: trueis always wrong.remotes[]but not auth accuracy.apify.com/.well-known/mcp/server-card.jsonas well.