Apify MCP server and Dome

1. 01

   Add the Apify MCP server

   This URL loads Web Fetch and call-actor. Dome stores the Apify token and sends it as a Bearer token.

   $ dome tools add --name apify \
     --url "https://mcp.apify.com?tools=apify/web-fetch,call-actor" \
     --auth-method api-key \
     --credential-type shared \
     --authorization "Bearer $APIFY_TOKEN" \
     --gateway research-gateway

2. 02

   Sync the catalog

   Sync needs a valid token, and Apify refuses the listing without one. Until it runs, agents get “tool not available in this gateway”.

   $ dome tools catalog sync apify

3. 03

   Apply the rules

   Scope them to one agent while you try them. Simulate before you deploy.

   $ dome rules apply apify-permit.cedar apify-limits.cedar \
     --agent filings-reader --name apify-limits

Commands and rules tested against a Dome workspace on October 1, 2026. For anything about Apify itself, see Apify's documentation.

permit (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "apify" &&
  ["apify--web-fetch", "call-actor", "get-actor-run", "get-dataset-items"].contains(resource.tool_name)
};
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "apify" &&
  resource.tool_name == "apify--web-fetch" &&
  !(resource has arguments &&
    resource.arguments has url &&
    (resource.arguments.url like "https://www.sec.gov/*" ||
     resource.arguments.url like "https://investors.northwind-supply.com/*"))
};
 
forbid (principal, action == Dome::Action::"mcp:call", resource is Dome::MCPTool)
when {
  resource.connection_name == "apify" &&
  resource.tool_name == "call-actor" &&
  !(resource has arguments &&
    resource.arguments has actor &&
    resource.arguments.actor == "apify/google-search-scraper")
};