MCP server · Org-owned · Audited from source
Firecrawl MCP server
by mendableai/firecrawl-mcp-serverMIT licenceAudited 21 Sep 2026 · source e418e97c65b8
Is it safe? With care — CAUTION, grade B (87/100). The tool list is built at runtime, so we cannot read it from the source. The audit recorded 11 findings (0 critical, 0 high, 2 medium, 8 low). Maintainer's description: 🔥 Official Firecrawl MCP Server - Adds powerful web scraping and search to Cursor, Claude and any other LLM clients.
Cite
Cite this page
ModelsAtlas. “Firecrawl MCP server (mendableai/firecrawl-mcp-server)”. Retrieved 21 Sep 2026. https://modelsatlas.com/mcp/mendableai/firecrawl
Copy of mcp/firecrawl/firecrawl-10: identical text; the original is the page to read and cite.
Trust audit
Audit 0.4.1 · full source read 21 Sep 2026
11 findings, listed below with the file and line each was found on. Grade A needs a sandboxed behavioural run too; this audit read the source only.
What the source does
- FilesystemNone observedNothing seen in the source
- NetworkDeclared6 observations
- ShellNone observedNothing seen in the source
- DependenciesNot pinnedSome ranges float
- SecretsFoundSee the findings
“Declared” means the server says it does this and the source agrees. Browser, file and shell access are expected of some kinds of server.
Five audit layers
| Layer | What we check | Result |
|---|---|---|
L0 Provenance | Repo owner, licence, archive status, activity | PASS 1 finding |
L1 Static source | Secrets, path traversal, supply chain | WARN 8 findings |
L2 Instructions | Prompt injection and authority framing in docs and tool descriptions | PASS 1 finding |
L3 Inventory | Declared tools match the source | PASS 1 finding |
L4 Sandbox | Run in isolation and watch behaviour | SKIPPED |
Provenance & runtime
Who published it, and what the audit could and could not run
Provenance
- Repository owner
mendableaiOrganizationAccount type recorded when we read the repository. - PackagePublished on npm
firecrawl-mcpat version 3.24.1 - LicenceMITFrom the repository, as read at the audited commit.
- Last pushTodayActivity of the repository when we read it.
- Source commit reade418e97c65b8The audit covers exactly this commit, read on 21 Sep 2026.
Runtime
- Sandbox runNot run yetThis audit read the source only; it did not execute the server.
- Tool inventoryBuilt at runtimeThe source declares no tools; the server lists them when a client connects, so we cannot read them.
Every value here is read from the record's own repository and audit.Suggest a correction
Findings (11)
Sorted by severity
MEDIUMHard-coded secretssecret.generic · tests/mcp-smoke.test.mjs:2055
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
MEDIUMHard-coded secretssecret.generic · tests/mcp-smoke.test.mjs:2684
Excerpt withheld: it is a secret, and we never print one.
- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · tests/mcp-search-profile.test.mjs:67
const url = `http://127.0.0.1:${port}/health`;- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · tests/mcp-search-profile.test.mjs:232
url: `http://127.0.0.1:${port}`,- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · tests/mcp-search-profile.test.mjs:315
return fetch(`http://127.0.0.1:${port}${endpoint}`, {- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · tests/mcp-search-profile.test.mjs:693
`http://127.0.0.1:${searchPort}/.well-known/oauth-protected-resource${SEARCH_ENDPOINT}`- Why
- No further detail recorded for this rule.
- Fix
- —
LOWNetwork egressnet.raw_ip · tests/mcp-search-profile.test.mjs:796
`http://127.0.0.1:${fullPort}/.well-known/oauth-protected-resource`- Why
- No further detail recorded for this rule.
- Fix
- —
LOWSupply chainsupply.unpinned · package.json
dotenv, zod, @types/node, tsup, typescript
- Why
- 5 dependency range(s) float
- Fix
- pin exact versions or ship a lockfile
LOWPrompt injectionprompt.transfer_instruction · CHANGELOG.md:7
- `firecrawl_parse` now works on the remote hosted MCP server (`CLOUD_SERVICE`), not just local mode. Because the hosted server cannot read the caller's filesystem, hosted parse uses a two-call flow:
- Why
- an instruction to move sensitive data to an outside destination
- Fix
- remove; a skill never needs the user's secrets off the machine
LOWInventory / provenancemcp.no_tools_extracted · server.json
- Why
- the tool list is enumerated at runtime by tools/list, not declared in source
- Fix
- the page says so rather than showing an empty table
INFOInventory / provenanceinv.oversize · img/fire.png
img/fire.png
- Why
- 2726130 bytes not read
- Fix
- —
Tools it exposes
None declared in source
The tool list is built at runtime, so we cannot read it from the source.
Install
Package version 3.24.1 · audited commit e418e97
Read the findings first. The most severe is Hard-coded secrets (medium) at tests/mcp-smoke.test.mjs.
claude mcp add firecrawl-mcp --env FIRECRAWL_API_KEY=${FIRECRAWL_API_KEY} -- npx -y [email protected]The command pins the package version recorded in the source (3.24.1); the audit covers commit e418e97c65b8. Transport: stdio. Reads these environment variables: FIRECRAWL_API_KEY, FIRECRAWL_MCP_ACTION_LOG_SECRET, FIRECRAWL_MCP_SEARCH_OAUTH_ONLY, FIRECRAWL_OAUTH_INTROSPECT_SECRET, FIRECRAWL_OAUTH_ISSUER, FIRECRAWL_OAUTH_TOKEN, KEYLESS_PROXY_SECRET, MCP_DELEGATED_CREDENTIAL_SECRET and 2 more. Give it the narrowest token it needs.
Audit history
- !CAUTION B 87 / 100
Source changed, verdict held ·
e418e97c65b8 - !CAUTION B 87 / 100
First audit ·
436fd1a4207c
Other ratings
Cited, never blended into our score
No third-party security ratings are recorded for this server yet. When they exist they appear here with their source and date, beside, not inside, our grade.
Questions about Firecrawl MCP server
What is the Firecrawl MCP server?
Is Firecrawl safe to connect to an agent?
What credentials does Firecrawl need?
How does Firecrawl run?
How current is this page?
Sources
- mendableai/firecrawl-mcp-server on GitHub — the source we read, its licence, stars and activityObserved · 21 Sep 2026
- ModelsAtlas trust audit — CAUTION verdict for commit e418e97c65b8Observed · 21 Sep 2026
Spotted something wrong? Report a correction · Methodology
Keep going in your AI
Opens with this page as the source. We add nothing else to the prompt.
- What is the Firecrawl MCP server?
- Is Firecrawl safe to connect to an agent?
- What credentials does Firecrawl need?