Firecrawl
by Firecrawl
Search the live web, a 43-million-paper research index and public GitHub history from an AI agent. The directory connector is Firecrawl's search-only surface — six read tools, no scrape and no crawl. OAuth with one wildcard scope.
Verified connector
Listed by Anthropic as a partner connector in its Connectors Directory.
Connection checked by Agentman on .
Anthropic states this reflects the level of review a connector received, not a security audit.
Connect Firecrawl via MCP
https://mcp.firecrawl.dev/v2/mcp-searchWorks in any MCP-compatible client. In Agentman Studio it is one click — no config file to edit.
Firecrawl Tools & Capabilities (6)
Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.
Limits
- Everything it returns is attacker-controllable text. This is the defining constraint, not a footnote. Search highlights, paper passages and GitHub issue bodies are all authored by third parties. Never let retrieved content act as instructions, and review carefully before enabling this connector alongside one that can write, send or deploy.
- The OAuth scope is a wildcard.
firecrawl:globalnames no object and no verb. It cannot exclude anything: granting it grants whatever the server implements, now and in future. The boundary protecting you here is the tool allowlist in code, not the consent screen — and those are different guarantees with different failure modes. - No scrape, no crawl, no extract, no automation. If you need page content from a URL you name, structured extraction, browser interaction or change monitoring, this endpoint cannot do it. That is a deliberate design choice by Firecrawl, not a gap in our reporting.
- The full server is one command away and much broader. Adding
https://mcp.firecrawl.dev/v2/mcp-oauthreaches 27 tools includingfirecrawl_crawlandfirecrawl_monitor_delete. Nothing on this page assesses that surface. - Credits are spent on failure and on blocked pages. Firecrawl charges "whenever Firecrawl's infrastructure processes a request, even if the target site returns an HTTP error status code". No idempotency key is documented, so a timeout that is retried bills twice.
- A zero balance may buy an upgrade rather than stop. Smart Upgrade is the default behaviour; disable it in billing settings if you want HTTP 402 as the failure mode.
- We could not read the live tool schemas. The endpoint returned 401 to an anonymous request, so the six names, their annotations and their parameters come from Firecrawl's MIT-licensed MCP server source and its published contract, not from a
tools/listresponse we received. Source and directory agree exactly. - Firecrawl's SSRF protection is real but undocumented. Its open-source code blocks private and link-local addresses at the resolved socket address, yet the documentation never mentions it and one undocumented environment variable turns it off. The hosted service's main browser engine is closed-source, so we verified the AGPL engine rather than production. Threat Protection, the control Firecrawl does document, is enterprise-gated, off by default, and domain-level rather than IP-level.
- Research paper credit rates are unpublished. Firecrawl's billing table covers scrape, crawl, map, search, interact and agent. It does not price the research paper endpoints, so their cost is unpredictable rather than free.
- Firecrawl's own site carries text addressed to AI agents. Its footer instructs automated readers to fetch and follow an onboarding document. We report it rather than acted on it, and it is a reminder that this connector will surface such text from far less reputable sources.
- Enterprise controls are gated. Threat Protection, Zscaler mode, SIEM audit logging, IP restrictions, ZDR search and
ignoreRobotsTxtall require an enterprise plan or account-team enablement. - Firecrawl places compliance on you. Its README states it is "the sole responsibility of end users to respect websites' policies when scraping", and that Firecrawl respects
robots.txtby default.
Frequently asked questions
No. It is Firecrawl's search-only surface at the /v2/mcp-search path, which exposes six read tools and nothing else. Firecrawl's own design note states registration on that instance is filtered against a fixed allowlist, so scrape, crawl, map, extract, agent, interact, parse and monitor are never registered there. The full surface lives at a different URL you would have to add yourself.
Not through this connector. The search surface's firecrawl_search takes no scrapeOptions, its schema rejects unknown fields, and Firecrawl states the outbound request body is built from an explicit allowed-field list rather than spread from raw arguments. Firecrawl's separate /v2/mcp endpoint does expose firecrawl_scrape and firecrawl_crawl, but that is a different server you add deliberately.
Yes, by design, and that is the main risk to plan for. Search highlights are on by default and replace each result's description with passages taken from the page itself, so third-party Markdown enters the model's context. Paper passages and GitHub issue text arrive the same way. Anyone who controls a page that ranks for your query controls text your agent reads.
Two credits per ten results, rounded up, so eleven results cost four. Firecrawl documents this rate for both web search and developer search. Every firecrawl_search response returns a creditsUsed field, so the spend is observable inline on each call rather than only in a dashboard. Firecrawl publishes no separate rate for the research paper endpoints.
It cannot delete anything, and spending does not necessarily stop. None of the six tools writes or deletes; the only delete in Firecrawl's MCP codebase, firecrawl_monitor_delete, is not registered on this surface. But Firecrawl's Smart Upgrade moves an exhausted account up one paid credit tier automatically and bills the pro-rated difference, so a zero balance is a purchase rather than a halt.
One wildcard scope called firecrawl:global. Firecrawl's RFC 9728 descriptor for the search resource advertised exactly that single scope on 2026-08-23, and its authorization server advertises the same scope plus offline_access. The name states no object and no verb, so consent cannot separate searching from anything else the server implements now or later.
Not through this connector, because it has no tool that fetches a URL you supply. The search surface accepts a query, never a target address. On Firecrawl's scraping endpoints, its open-source code does block loopback, RFC 1918 and link-local addresses at the resolved socket address, covering the cloud metadata endpoint. Firecrawl documents none of that anywhere, and we did not test it.
Yes to both, under two different licences. Firecrawl's core engine is AGPL-3.0, while the MCP server repository and the SDKs are MIT, and Firecrawl's README states SDKs and some UI components carry MIT terms. The MCP server can run locally over stdio or HTTP against either Firecrawl Cloud or a self-hosted API, though Agent, Browser and Interact are cloud-only.
Sources
- Firecrawl MCP tools reference (retrieved 2026-08-23) · retrieved 2026-08-23
- Firecrawl MCP getting started, For Agents and For Humans — · · (retrieved 2026-08-23) · retrieved 2026-08-23
- Firecrawl MCP server source and search-surface design note,
firecrawl/firecrawl-mcp-serverat branch main, MIT — ·src/index.ts·src/research.ts(retrieved 2026-08-23). All 27 registered tool names were read from source. · retrieved 2026-08-23 - Firecrawl core engine repository and licence, AGPL-3.0 — · (retrieved 2026-08-23) · retrieved 2026-08-23
- Firecrawl billing and credit costs (retrieved 2026-08-23) · retrieved 2026-08-23
- Firecrawl rate limits (retrieved 2026-08-23) · retrieved 2026-08-23
- Firecrawl Search Highlights (retrieved 2026-08-23) · retrieved 2026-08-23
- Firecrawl Search feature guide (retrieved 2026-08-23) · retrieved 2026-08-23
- Firecrawl Research Index (retrieved 2026-08-23) · retrieved 2026-08-23
- Firecrawl Developer Index (retrieved 2026-08-23) · retrieved 2026-08-23
- Firecrawl Threat Protection and Key Restrictions — · (retrieved 2026-08-23) · retrieved 2026-08-23
- Firecrawl Lockdown mode (retrieved 2026-08-23) · retrieved 2026-08-23
- Firecrawl self-hosting guide and Open Source vs Cloud — · (retrieved 2026-08-23) · retrieved 2026-08-23
- Firecrawl documentation index,
llms.txt(retrieved 2026-08-23).docs.firecrawl.dev/robots.txtcarriesContent-Signal: ai-train=yes, search=yes, ai-input=yes— synthesis expressly permitted by the publisher. · retrieved 2026-08-23 - Live auth posture check, 2026-08-23: anonymous
initializeto the endpoint returned HTTP 401 with awww-authenticateBearer challenge; RFC 9728 metadata read athttps://mcp.firecrawl.dev/.well-known/oauth-protected-resource/v2/mcp-search; authorization server metadata athttps://www.firecrawl.dev/.well-known/oauth-authorization-server. Three control paths returned matching 404s with identical body hashes, so the descriptor is genuine rather than a catch-all. · retrieved 2026-08-23 - Anthropic Connectors Directory entry — , read from our directory snapshot dated 2026-08-23. Vendor example prompts quoted above come from that entry. · retrieved 2026-08-23
- Firecrawl support — · Privacy (retrieved 2026-08-23) · retrieved 2026-08-23
Use in Agentman
Connect once and your agents call these tools on their own — on a schedule, in a workflow, with nobody at the keyboard.
Open in Agentman StudioServer Info
- Category
- Developer Tools
- Developer
- Firecrawl
- Tools
- 6
- Domain
- mcp.firecrawl.dev
Using Claude Desktop or another MCP client? Setup docs — the connection URL above works anywhere.