Firecrawl MCP server

What it does

firecrawl-mcp is Firecrawl's own MCP server, MIT licensed and published from firecrawl/firecrawl-mcp-server. It gives an agent the Firecrawl API: scrape a page to markdown or JSON, list a site's URLs, crawl a section of a site, search the web, and run Firecrawl's research agent across several sites. It also schedules recurring page monitors, drives a live browser session, and searches indexes of papers, code and US government documents. Statio runs version 3.29.1 with your Firecrawl API key. Every call spends credits from the Firecrawl team that owns the key.

Tools

Version 3.29.1 lists 26 tools once its two feedback tools are switched off with FIRECRAWL_NO_SEARCH_FEEDBACK=1 and FIRECRAWL_NO_ENDPOINT_FEEDBACK=1. Those two send feedback on past results to Firecrawl. Statio starts it with them off and in safe mode, which keeps all 26 tools but removes scrape's actions and crawl's webhook. The server sets annotations on every tool, but the read-only hint means "doesn't change state", not "free", so the last column says what each call does to your account or to a live site.

Two annotations are worth a second look. firecrawl_scrape reports itself as not read-only here, and the source shows why: outside Firecrawl's hardened HTTP mode (CLOUD_SERVICE=true), scrape accepts the click, write, press and executeJavascript actions, so a "read" can submit a form. Statio runs the server in safe mode, so its scrape takes no actions. firecrawl_interact_stop is marked destructive, though all it does is end a session, while firecrawl_crawl and firecrawl_agent carry no destructive hint despite being the calls that spend the most credits.

firecrawl_parse needs a file it can upload. Run locally against Firecrawl's cloud API with a key, the README says it can't read and upload local files, so expect it to be of little use through a hosted connection.

Set it up

Create an API key in the Firecrawl dashboard under API Keys. It starts with fc-. The server has no setting that narrows what the key may call, and every call spends the team's credits, so limits have to come from the tools you allow.

Claude Code, directly:

claude mcp add firecrawl -e FIRECRAWL_API_KEY=fc-your-key -e FIRECRAWL_NO_SEARCH_FEEDBACK=1 -e FIRECRAWL_NO_ENDPOINT_FEEDBACK=1 -- npx -y firecrawl-mcp@3.29.1

Cursor, directly, in ~/.cursor/mcp.json or .cursor/mcp.json:

{
  "mcpServers": {
    "firecrawl": {
      "command": "npx",
      "args": ["-y", "firecrawl-mcp@3.29.1"],
      "env": {
        "FIRECRAWL_API_KEY": "${env:FIRECRAWL_API_KEY}",
        "FIRECRAWL_NO_SEARCH_FEEDBACK": "1",
        "FIRECRAWL_NO_ENDPOINT_FEEDBACK": "1"
      }
    }
  }
}

Firecrawl also hosts the server at https://mcp.firecrawl.dev/v2/mcp, with the key sent as Authorization: Bearer <key>. Without a key that endpoint offers only scrape, search and parse, rate limited. The hosted server runs in safe mode, which drops the page-changing scrape actions and crawl webhooks.

The client tutorials, How to add MCP servers to Claude Code and How to set up MCP servers in Cursor, explain config scopes and how to keep the key out of files you commit.

Through Statio: install Firecrawl from the catalog, paste the key under the server's Credentials, and grant tools under Permissions. A new server has no grants, so nobody can call it until you add some. The desktop app then writes your client configs. The manual entry is the local proxy URL with the server name from your dashboard, http://127.0.0.1:7777/firecrawl/mcp, added in Claude Code with claude mcp add --transport http firecrawl <url> or as a "url" in Cursor. Tools missing after that? Start a fresh session, then work through How to debug an MCP server that won't connect.

What to hold back

Firecrawl doesn't write to your systems, so the risk here is mostly spend and what the agent reads.

firecrawl_agent and firecrawl_crawl are the expensive calls. An agent run spends up to 2,500 credits unless the caller passes a lower maxCredits, and the model choosing the arguments is the one you're trying to limit. A crawl fetches every page it finds up to its limit, and the whole result comes back into the agent's context, which Firecrawl's README warns can exceed token limits. Each crawl result reports creditsUsed, which is the number to watch. Most agents that look things up need firecrawl_scrape, firecrawl_search and firecrawl_map, which already cover a known page, a query and a site's URL list. Check firecrawl_credit_usage with the key's breakdown after a few days to see which agent is spending.

The monitor tools leave something running after the session ends. firecrawl_monitor_create in its simple form schedules a check every 30 minutes, and those checks keep running until someone pauses or deletes the monitor. It can also send every diff to a webhook URL the agent picks. Keep the create, update, run and delete tools for a person, and give agents firecrawl_monitor_list and the check readers if they need to report on monitors you set up.

firecrawl_interact acts on live sites. Firecrawl's own description warns that form submissions there "can create persistent external side effects", and it runs Bash, Python or Node code in the browser session. A named profile can save cookies from a logged-in session. Run with npx, the same goes for firecrawl_scrape's actions, which a tool grant can't separate from plain scraping. Through Statio they're off, because Statio starts the server in safe mode.

Webhooks are sent by Firecrawl's servers, not by the process Statio runs. Statio's egress list for this server allows only api.firecrawl.dev, but that limits the server process, so it doesn't stop Firecrawl from posting results to a URL the agent supplied. Safe mode removes crawl's webhook, but firecrawl_monitor_create still takes one, so grant it only to an agent you'd let send data anywhere.

Every page this server returns is text written by someone else, and some pages contain instructions aimed at AI agents. A research agent that holds only reading tools can be misled, but it can't act on it. An agent that holds Firecrawl next to write tools on another server, such as a ticketing or email server, can be talked into using them. Keep scraping agents and acting agents apart, or keep the write tools on the other server behind a person.

With Statio you grant each tool separately, so one agent can have scrape, search and map while another also gets crawl. MCP permissions covers how grants and denies combine.

Questions