# MCP Server Auditor (`bmiller1009/mcp-server-auditor`) Actor

Audit public MCP servers for exposed tools, risky capabilities, protocol issues, and deployment readiness.

- **URL**: https://apify.com/bmiller1009/mcp-server-auditor.md
- **Developed by:** [Sentinel Signal](https://apify.com/bmiller1009) (community)
- **Categories:** MCP servers, AI, Developer tools
- **Stats:** 1 total users, 0 monthly users, 0.0% runs succeeded, 0 bookmarks
- **User rating**: No ratings yet

## Pricing

$150.00 / 1,000 completed mcp audits

This Actor is paid per event. You are not charged for the Apify platform usage, but only a fixed price for specific events.

Learn more: https://docs.apify.com/actors/running/actors-in-store.md#pay-per-event

## What's an Apify Actor?

Actors are web data automations that power AI and operations. They run on the Apify platform to scrape websites, process data, connect APIs, and automate workflows.
In Batch mode, an Actor accepts a well-defined JSON input, performs an action which can take anything from a few seconds to a few hours,
and optionally produces a well-defined JSON output, datasets with results, or files in key-value store.
In Standby mode, an Actor provides a web server which can be used as a website, API, or an MCP server.
Actors are written with capital "A".

## How to integrate an Actor?

If asked about integration, you help developers integrate Actors into their projects.
You adapt to their stack and deliver integrations that are safe, well-documented, and production-ready.
The best way to integrate Actors is as follows.

- **AI agents and MCP clients** — the [Apify MCP server](https://docs.apify.com/integrations/mcp.md) at `https://mcp.apify.com` (remote, streamable HTTP, OAuth on first use).
- **Agentic workflows and local Actor development** — [Agent Skills](https://apify.com/.well-known/agent-skills/index.json) with the [Apify CLI](https://docs.apify.com/cli/docs.md): `npm install -g apify-cli`, then `apify login`.
- **JavaScript/TypeScript projects** — the official [JS/TS client](https://docs.apify.com/api/client/js/docs.md): `npm install apify-client`.
- **Python projects** — the official [Python client](https://docs.apify.com/api/client/python/docs.md): `pip install apify-client`.
- **Any other language** — the [REST API](https://docs.apify.com/api/v2.md).

For usage examples, see the [API](#api) section below.

For more details, see Apify documentation as [Markdown index](https://docs.apify.com/llms.txt) and [Markdown full-text](https://docs.apify.com/llms-full.txt).

# README

## MCP Server Auditor

Paste one public HTTPS Streamable HTTP MCP endpoint. In about 25 seconds, receive a tool inventory, risk flags, protocol/schema findings, and a readiness score.

**$0.15 per successful audit. Useful partial audits are also $0.15; failed, restricted, invalid, unsupported, unreachable, and dependency-failure targets are not charged.**

**Runtime-surface audit only — no source-code, CVE, OAuth, stdio, SSE, local/private-network, or authenticated-target scanning.**

The safe example endpoint is already filled in, so you can run the controlled audit without changing the input. You can also batch-audit up to 25 compatible endpoints.

### Quick start

Use the prefilled Sentinel-owned endpoint for a safe, discovery-only first run:

```json
{
  "servers": [{"url": "https://mcp.sentinelsignal.io/audit-fixture/mcp"}],
  "depth": "standard",
  "includeEvidence": false
}
```

### Real report preview

This abbreviated result was produced through the Actor's real service path against the controlled endpoint. Scores and findings depend on the endpoint's current behavior and the active Verify rules.

```json
{
  "status": "success",
  "target": {
    "identifier": "https://mcp.sentinelsignal.io/audit-fixture/mcp"
  },
  "result": {
    "server": {
      "protocolVersion": "2025-03-26",
      "status": "healthy"
    },
    "capabilities": {"toolCount": 3, "resourceCount": 0, "promptCount": 0},
    "tools": [
      {"name": "echo"},
      {"name": "add"},
      {"name": "server_info"}
    ],
    "findings": [],
    "findingCount": 0,
    "summary": {
      "score": 65.1,
      "risk": {"highRiskTools": 0},
      "readiness": {"label": "Safe for evaluation"}
    }
  }
}
```

See the public [Input schema](https://apify.com/bmiller1009/mcp-server-auditor/input-schema) and [Output schema](https://apify.com/bmiller1009/mcp-server-auditor/output-schema) for the complete contracts.

### Input and batching

`servers` accepts one to 25 objects with a public HTTPS `url`. Duplicate URLs are collapsed and produce one result with a warning. `depth` is currently fixed to `standard`. Set `includeEvidence` to `false` for a smaller result.

### Output and failure behavior

Results use the stable API-IFY `schemaVersion: "1.0"` envelope. The default dataset contains audit or failure records, while `RUN_SUMMARY` in the default key-value store records processing, delivery, billing, dependency, and budget totals.

`restricted` means API-IFY rejected the target locally. `unreachable` means the public endpoint could not complete MCP discovery. `unsupported` covers unsupported target behavior. `dependency_unavailable` means Verify was temporarily unavailable. `failed` is reserved for unexpected audit failures. Failures are isolated per target.

### How it works

MCP Server Auditor evaluates public, unauthenticated Streamable HTTP endpoints through Sentinel Verify. It performs MCP initialization and discovery, evaluates the advertised surface, and returns one structured item per unique target. Each target is checked locally against API-IFY's public-network policy before it is sent to Verify. The Actor never invokes advertised MCP tools.

### Pricing

One `mcp-audit` event costs $0.15 and is charged only when a successful or useful partial audit is accepted into the dataset. Restricted, invalid, unreachable, unsupported, dependency-failure, and failed outcomes are uncharged. Work does not start when the caller's remaining event budget cannot cover another audit.

### Limitations

- Public, unauthenticated MCP endpoints only.
- HTTPS on port 443 only; credentials and fragments in URLs are rejected.
- Streamable HTTP transport only.
- Private, loopback, link-local, metadata, reserved, and mixed public/private DNS targets are rejected.
- Maximum 25 submitted targets and four concurrent audits per run.
- Audit availability depends on Sentinel Verify and the target MCP server.

### Privacy and security

The target endpoint is sent to Sentinel Verify for analysis after local public-network validation. Results are stored in the customer's Apify run dataset and summary store. Do not place credentials in target URLs or query parameters. Published datasets, key-value records, and structured logs redact authorization values, secrets, private keys, and secret-like query parameters.

`VERIFY_CLIENT_ID` and `VERIFY_CLIENT_SECRET` are operator-managed Actor secrets used to obtain a short-lived Verify access token at runtime via Sentinel's token-service client-credentials exchange. `VERIFY_API_KEY` (a static, long-lived JWT) is a deprecated fallback used only when the client-credentials secrets are absent. `VERIFY_BASE_URL`, `TOKEN_SERVICE_BASE_URL`, and `VERIFY_TIMEOUT_SECONDS` are operator settings, not Actor inputs.

### Support

For a reproducible support request, provide the Apify run ID, result `itemId`, and status. Never send credentials or unredacted URLs through support. Contact Sentinel Signal Systems through the support link on the Actor page.

# Actor input Schema

## `servers` (type: `array`):

One to 25 public HTTPS Streamable HTTP server endpoints.

## `depth` (type: `string`):

The deterministic audit profile to run.

## `includeEvidence` (type: `boolean`):

Include bounded evidence returned by Sentinel Verify.

## Actor input object example

```json
{
  "servers": [
    {
      "url": "https://mcp.sentinelsignal.io/audit-fixture/mcp"
    }
  ],
  "depth": "standard",
  "includeEvidence": true
}
```

# Actor output Schema

## `results` (type: `string`):

No description

## `runSummary` (type: `string`):

No description

# API

You can run this Actor programmatically using our API. Below are code examples in JavaScript, Python, and CLI, as well as the OpenAPI specification and MCP server setup.

## JavaScript example

```javascript
import { ApifyClient } from 'apify-client';

// Initialize the ApifyClient with your Apify API token
// Replace the '<YOUR_API_TOKEN>' with your token
const client = new ApifyClient({
    token: '<YOUR_API_TOKEN>',
});

// Prepare Actor input
const input = {
    "servers": [
        {
            "url": "https://mcp.sentinelsignal.io/audit-fixture/mcp"
        }
    ]
};

// Run the Actor and wait for it to finish
const run = await client.actor("bmiller1009/mcp-server-auditor").call(input);

// Fetch and print Actor results from the run's dataset (if any)
console.log('Results from dataset');
console.log(`💾 Check your data here: https://console.apify.com/storage/datasets/${run.defaultDatasetId}`);
const { items } = await client.dataset(run.defaultDatasetId).listItems();
items.forEach((item) => {
    console.dir(item);
});

// 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/js/docs

```

## Python example

```python
from apify_client import ApifyClient

# Initialize the ApifyClient with your Apify API token
# Replace '<YOUR_API_TOKEN>' with your token.
client = ApifyClient("<YOUR_API_TOKEN>")

# Prepare the Actor input
run_input = { "servers": [{ "url": "https://mcp.sentinelsignal.io/audit-fixture/mcp" }] }

# Run the Actor and wait for it to finish
run = client.actor("bmiller1009/mcp-server-auditor").call(run_input=run_input)

# Fetch and print Actor results from the run's dataset (if there are any)
print(f"💾 Check your data here: https://console.apify.com/storage/datasets/{run.default_dataset_id}")
for item in client.dataset(run.default_dataset_id).iterate_items():
    print(item)

# 📚 Want to learn more 📖? Go to → https://docs.apify.com/api/client/python/docs/quick-start

```

## CLI example

```bash
echo '{
  "servers": [
    {
      "url": "https://mcp.sentinelsignal.io/audit-fixture/mcp"
    }
  ]
}' |
apify call bmiller1009/mcp-server-auditor --silent --output-dataset

```

## MCP server setup

```json
{
    "mcpServers": {
        "apify": {
            "type": "http",
            "url": "https://mcp.apify.com/?tools=fetch-actor-details,bmiller1009/mcp-server-auditor"
        }
    }
}

```

The hosted server signs you in with OAuth on first connect, so no API token belongs in this config. Clients without OAuth support can send an `Authorization: Bearer <APIFY_API_TOKEN>` header instead, using a token from API & Integrations in Apify Console (https://console.apify.com/settings/integrations).

## OpenAPI specification

Download the OpenAPI definition: https://api.apify.com/v2/actors/nZfGfvbtga0qG06Vd/builds/AgMcUlnWELGa4Jcx0/openapi.json