feat(stdio): allow unauthenticated access for public tools #421
+110
−1
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR updates the server startup logic to allow running without an APIFY_TOKEN if only public tools (like search-apify-docs, fetch-apify-docs) are requested.
Currently, using the MCP server requires an API token even for strictly public operations (like searching documentation). This creates unnecessary friction for users who just want to use the documentation tools without setting up a full Apify account/token immediately.
With this change, the server checks the requested tools at startup. If they are all "public safe," it bypasses the token check.
Reproduction / Context
Previously, trying to load the docs tool without a token would crash the server immediately with this error, which blocks new users from trying out the public features:
Configuration used:
Users had to provide a key just to make it work:
Which resulted in valid tool access, proving the token wasn't actually needed:
Related Context
This change simplifies the setup process discussed in apify/apify-docs#2203. Currently, users trying to set up the MCP server via stdio must provide an
APIFY_TOKENeven for purely public tools, and the server accepts any non-empty string as a valid token just to establish the connection. This PR properly removes that hacky workaround requirement, allowing public tools to run without any token config.