MCP Scanner

firecrawl-fastmcp

https://mcp.firecrawl.dev/mcp · scanned 2026-10-17

1 of 3 tools can change data, send it out or run code. That's normal for a useful server, and it's where an approval step helps.

• firecrawl_search56 · Medium

  Runs code or commands · Sends data out

  Search web, news, or image sources and return ranked results with query-relevant highlights. Each web result is a title, URL, and description; use `firecrawl_scrape` on a result URL when the excerpt is not enough. Authenticated search also returns matching Alexandria data providers in data.tools (c…

  • Description mentions “executes” → runs code or commands
  • Server annotation openWorldHint → sends data out
• firecrawl_scrape23 · Low

  Sends data out · Exports data

  Scrape one URL and return its content: markdown by default, or HTML, links, screenshots, branding data, a targeted answer, or JSON matching a supplied schema. Use it when the request identifies a page and needs its content or defined fields. Use `firecrawl_search` when additional web sources are ne…

  • Name contains “scrape” → exports data
  • Input field “url” → sends data out
  • Server annotation openWorldHint → sends data out
• firecrawl_parse15 · Low

  Sends data out

  Parse one supported document into markdown, HTML, links, summary, targeted answers, or JSON matching a schema. Supported inputs include common HTML, PDF, Word, RTF, OpenDocument, and spreadsheet files; PDF parsing can be bounded with `pdfOptions.maxPages`. Local MCP reads `filePath` from the server…

  • Description mentions “upload” → sends data out

Badge for your README

MarkdownCopy

[![Scanned by Vulnify](https://api.vulnify.io/public/mcp-scanner/servers/mcp-firecrawl-dev-mcp.svg)](https://www.vulnify.io/scanner/mcp-firecrawl-dev-mcp?utm_source=badge&utm_medium=readme&utm_campaign=scanner-badge)

Automated heuristic result, scanned on 2026-10-17. It is based only on the tool names, descriptions, schemas and annotations this server publishes; no tool was called. It is not a security audit or certification, and not an endorsement of or accusation against the server or its operator. A high score is not a vulnerability finding, and a low score does not mean the server is safe. Vulnify is not affiliated with this server or its operator; names and marks belong to their owners. Server owner? Write to security@vulnify.io from an address at the server's domain to remove or correct this page, or scan it again to update it. We reply within 5 business days.

To exclude your server (and its subdomains) from the scanner and remove its public page, write to security@vulnify.io from an address at its domain. We process requests within 5 business days: the page stops being shown and its stored result is deleted. To fix an error instead, tell us what's wrong or scan the server again.