Firecrawl

Search the live web, a 43-million-paper research index and public GitHub history.

Add to Agentman Studio

Opens Agent Studio, where connecting is one click. The connector URL below works in any MCP client.

Paste it into any MCP client. Setup docs

Resources

What the Firecrawl connector does

The Firecrawl connector gives Claude, ChatGPT and any MCP client live web search, a research index of roughly 43 million paper abstracts, and search over public GitHub issues and READMEs. Anthropic's directory lists six read-only tools. This is Firecrawl's deliberately narrowed search surface — it cannot scrape, crawl or extract a page you name.

Verified connector

Listed by Anthropic as a partner connector in its Connectors Directory.

Connection checked by Agentman on .

Anthropic states this reflects the level of review a connector received, not a security audit.

Firecrawl tools (6)

  • firecrawl_research_inspect_paper
  • firecrawl_research_read_paper
  • firecrawl_research_related_papers
  • firecrawl_research_search_github
  • firecrawl_research_search_papers
  • firecrawl_search

Tool names from Anthropic's directory listing. This server requires sign-in, so we could not read tool descriptions or parameter schemas.

Limits

  • Everything it returns is attacker-controllable text. This is the defining constraint, not a footnote. Search highlights, paper passages and GitHub issue bodies are all authored by third parties. Never let retrieved content act as instructions, and review carefully before enabling this connector alongside one that can write, send or deploy.
  • The OAuth scope is a wildcard. firecrawl:global names no object and no verb. It cannot exclude anything: granting it grants whatever the server implements, now and in future. The boundary protecting you here is the tool allowlist in code, not the consent screen — and those are different guarantees with different failure modes.
  • No scrape, no crawl, no extract, no automation. If you need page content from a URL you name, structured extraction, browser interaction or change monitoring, this endpoint cannot do it. That is a deliberate design choice by Firecrawl, not a gap in our reporting.
  • The full server is one command away and much broader. Adding https://mcp.firecrawl.dev/v2/mcp-oauth reaches 27 tools including firecrawl_crawl and firecrawl_monitor_delete. Nothing on this page assesses that surface.
  • Credits are spent on failure and on blocked pages. Firecrawl charges "whenever Firecrawl's infrastructure processes a request, even if the target site returns an HTTP error status code". No idempotency key is documented, so a timeout that is retried bills twice.
  • A zero balance may buy an upgrade rather than stop. Smart Upgrade is the default behaviour; disable it in billing settings if you want HTTP 402 as the failure mode.
  • We could not read the live tool schemas. The endpoint returned 401 to an anonymous request, so the six names, their annotations and their parameters come from Firecrawl's MIT-licensed MCP server source and its published contract, not from a tools/list response we received. Source and directory agree exactly.
  • Firecrawl's SSRF protection is real but undocumented. Its open-source code blocks private and link-local addresses at the resolved socket address, yet the documentation never mentions it and one undocumented environment variable turns it off. The hosted service's main browser engine is closed-source, so we verified the AGPL engine rather than production. Threat Protection, the control Firecrawl does document, is enterprise-gated, off by default, and domain-level rather than IP-level.
  • Research paper credit rates are unpublished. Firecrawl's billing table covers scrape, crawl, map, search, interact and agent. It does not price the research paper endpoints, so their cost is unpredictable rather than free.
  • Firecrawl's own site carries text addressed to AI agents. Its footer instructs automated readers to fetch and follow an onboarding document. We report it rather than acted on it, and it is a reminder that this connector will surface such text from far less reputable sources.
  • Enterprise controls are gated. Threat Protection, Zscaler mode, SIEM audit logging, IP restrictions, ZDR search and ignoreRobotsTxt all require an enterprise plan or account-team enablement.
  • Firecrawl places compliance on you. Its README states it is "the sole responsibility of end users to respect websites' policies when scraping", and that Firecrawl respects robots.txt by default.

Frequently asked questions

Is the Firecrawl connector in Claude's directory the full Firecrawl MCP server?

No. It is Firecrawl's search-only surface at the /v2/mcp-search path, which exposes six read tools and nothing else. Firecrawl's own design note states registration on that instance is filtered against a fixed allowlist, so scrape, crawl, map, extract, agent, interact, parse and monitor are never registered there. The full surface lives at a different URL you would have to add yourself.

Can the Firecrawl connector scrape or crawl a website?

Not through this connector. The search surface's firecrawl_search takes no scrapeOptions, its schema rejects unknown fields, and Firecrawl states the outbound request body is built from an explicit allowed-field list rather than spread from raw arguments. Firecrawl's separate /v2/mcp endpoint does expose firecrawl_scrape and firecrawl_crawl, but that is a different server you add deliberately.

Does the Firecrawl connector feed untrusted web content into my AI agent?

Yes, by design, and that is the main risk to plan for. Search highlights are on by default and replace each result's description with passages taken from the page itself, so third-party Markdown enters the model's context. Paper passages and GitHub issue text arrive the same way. Anyone who controls a page that ranks for your query controls text your agent reads.

How many credits does a Firecrawl search cost?

Two credits per ten results, rounded up, so eleven results cost four. Firecrawl documents this rate for both web search and developer search. Every firecrawl_search response returns a creditsUsed field, so the spend is observable inline on each call rather than only in a dashboard. Firecrawl publishes no separate rate for the research paper endpoints.

Can the Firecrawl connector delete anything or spend money without stopping?

It cannot delete anything, and spending does not necessarily stop. None of the six tools writes or deletes; the only delete in Firecrawl's MCP codebase, firecrawl_monitor_delete, is not registered on this surface. But Firecrawl's Smart Upgrade moves an exhausted account up one paid credit tier automatically and bills the pro-rated difference, so a zero balance is a purchase rather than a halt.

What OAuth scope does the Firecrawl MCP server request?

One wildcard scope called firecrawl:global. Firecrawl's RFC 9728 descriptor for the search resource advertised exactly that single scope on 2026-08-23, and its authorization server advertises the same scope plus offline_access. The name states no object and no verb, so consent cannot separate searching from anything else the server implements now or later.

Can Firecrawl fetch internal URLs like localhost or a cloud metadata endpoint?

Not through this connector, because it has no tool that fetches a URL you supply. The search surface accepts a query, never a target address. On Firecrawl's scraping endpoints, its open-source code does block loopback, RFC 1918 and link-local addresses at the resolved socket address, covering the cloud metadata endpoint. Firecrawl documents none of that anywhere, and we did not test it.

Is Firecrawl open source, and can I self-host this MCP server?

Yes to both, under two different licences. Firecrawl's core engine is AGPL-3.0, while the MCP server repository and the SDKs are MIT, and Firecrawl's README states SDKs and some UI components carry MIT terms. The MCP server can run locally over stdio or HTTP against either Firecrawl Cloud or a self-hosted API, though Agent, Browser and Interact are cloud-only.

Sources

More Developer Tools connectors

  • Base44

    Build and edit Base44 apps from an AI assistant, and query data your app's users submit.

  • CircleCI

    Diagnose failed builds, read job logs, inspect test results and rerun or roll back deployments from your AI assistant.

  • Claude Managed Agents

    Create, run, monitor and debug Anthropic's Claude Managed Agents from inside Claude itself.

Browse all MCP connectorsClaude and ChatGPT setup guideBrowse AI skills

Product names and logos belong to their owners. Agentman is not affiliated with a connector's maker unless the page says the connector is built and run by Agentman.

Use it in an agent

Put Firecrawl to work.

Connect Firecrawl once and your agents call these tools on their own: on a schedule, in a workflow, with nobody at the keyboard.

Open in Agentman Studio
Call (650) 285-1019Our AI receptionist answers.