Limit Apify tokens to the actors your MCP agent needs

Why it matters

The apify-mcp-server project page (opens external site) ↗ notes that Apify API tokens grant broad access to your account and actor runs, so an exposed token could let an attacker execute arbitrary scrapers or access sensitive data. The same page flags prompt injection via actor output and risk from community-contributed actors in the Apify Store. Keeping the agent's reach narrow is a practical way to reduce risk.

Steps

1. Write down the actors the agent needs. Include only those you have a concrete use for, and leave out anything you tried once.
2. Find out which token options your Apify account offers. The sources for this guide do not document per-actor token restrictions, so check your account settings directly and do not assume a feature exists.
3. Avoid giving the MCP server your main account token. Where your account allows it, use a separate token for the agent, so a leak of that token does not also expose your other scripts and jobs.
4. If you cannot restrict the token to a list of actors, treat it as broad. Keep a record of which actors the agent runs and review that record regularly.
5. Keep the token out of committed files, shared chat windows and screenshots. Store it in an environment variable or a secrets manager, which is standard practice. The sources do not show how the MCP server expects to receive the token, so follow the official setup instructions for that part.
6. Start the agent with one harmless actor run. Then check whether it can reach an actor outside your list. If it can, do not rely on the token alone to enforce your list.
7. Rotate the token on a regular schedule, and replace it right away if you suspect a leak. Update the stored value everywhere it is used and retire the old token.

Common mistakes

• Reusing one all-access account token across agents, scripts and CI jobs.
• Pasting the token into a shared config file or chat window where others can copy it.
• Installing community actors from the Store without reading what they do first.
• Assuming the agent will only call the actors you intended, since scraped page content can try to steer it.