Firecrawl MCP Server: Setup, API Keys and the Open CVE (Oct 2026)

Q: What's the Firecrawl MCP server URL?

https://mcp.firecrawl.dev/v2/mcp for keyless or API-key use, and https://mcp.firecrawl.dev/v2/mcp-oauth for OAuth sign-in. The OAuth URL is for your MCP client, not a page to open in a browser.

On this page

Firecrawl MCP Server: Setup, API Keys and the Open CVE (Oct 2026)

The Firecrawl MCP server is Firecrawl's official server for scraping, crawling, web search and document parsing. TrustedMCP grades it B. Use the hosted server with OAuth, don't set FIRECRAWL_API_URL on a local install until the open file-read CVE is fixed, and treat fetched pages as untrusted.

What it connects

The firecrawl-mcp-server README lists these main tools:

firecrawl_scrape: fetches one URL as Markdown or structured JSON.
firecrawl_search: searches the web, optionally with page content.
firecrawl_map: lists a site's URLs without fetching them.
firecrawl_crawl and firecrawl_check_crawl_status: crawl many pages of a site as a job.
firecrawl_parse: turns PDFs, Word files, spreadsheets and other documents into Markdown or JSON.
firecrawl_interact: clicks, types and navigates in a cloud browser session.
firecrawl_agent: runs multi-source research and returns structured data.
firecrawl_credit_usage: reports remaining and historical credits.

There are also research, developer search, government search, page monitoring and feedback tools. The README says the full profile lists 27 tools by default.

You can use the hosted server at https://mcp.firecrawl.dev/v2/mcp or run it locally with npx -y firecrawl-mcp.

Setup

These snippets come from the README and Firecrawl's MCP docs.

Claude Code (hosted, OAuth):

claude mcp add --transport http firecrawl https://mcp.firecrawl.dev/v2/mcp-oauth

Then complete sign-in via /mcp. You approve a team in the browser, and each connection gets its own key that the client never sees.

Claude Code (hosted, keyless):

claude mcp add --transport http firecrawl https://mcp.firecrawl.dev/v2/mcp

Claude Desktop (local, API key):

{
  "mcpServers": {
    "mcp-server-firecrawl": {
      "command": "npx",
      "args": ["-y", "firecrawl-mcp"],
      "env": {
        "FIRECRAWL_API_KEY": "YOUR_API_KEY_HERE"
      }
    }
  }
}

VS Code (.vscode/mcp.json):

{
  "inputs": [
    {
      "type": "promptString",
      "id": "apiKey",
      "description": "Firecrawl API Key",
      "password": true
    }
  ],
  "servers": {
    "firecrawl": {
      "command": "npx",
      "args": ["-y", "firecrawl-mcp"],
      "env": {
        "FIRECRAWL_API_KEY": "${input:apiKey}"
      }
    }
  }
}

The listing also has the Cursor config.

The safer setup

Prefer the hosted OAuth endpoint. No key sits in a file on your machine, and you can revoke the connection under Connected apps in your Firecrawl settings.

If you run it locally, keep the key out of the config. The Claude Desktop snippet above puts the key in plain text. Reference it from your environment instead, as shown in keeping API keys out of your MCP config. In VS Code, the ${input:apiKey} form with "password": true prompts for the key and doesn't store it in the file, so .vscode/mcp.json is safe to commit. Never commit a file that holds a real fc- key.

For an unattended client on the hosted server, keep the URL as https://mcp.firecrawl.dev/v2/mcp and send the key in a header: Authorization: Bearer <FIRECRAWL_API_KEY>. The README says: "Never put an API key in the server URL. Never put an API key in an agent chat."

Don't set FIRECRAWL_API_URL unless you need a self-hosted Firecrawl API, for the reason below.

The open CVE: firecrawl_parse can read local files

CVE-2026-85606 (published 4 Sep 2026, CWE-22 path traversal). The VulnCheck advisory says: "firecrawl-mcp-server 3.20.2 contains an arbitrary local file read vulnerability in the firecrawl_parse tool that accepts unconstrained filePath arguments without directory containment validation." VulnCheck lists affected versions as 3.24.0 and earlier and doesn't name a fixed version.

The original report, issue #306, is still open with no maintainer reply. The reporter read /etc/passwd through the tool and warns that prompt injection could steer the model into reading .env files or keys. A fix, PR #447 ("keep firecrawl_parse inside the parse root"), was opened on 21 Oct 2026 and hasn't been merged. The repo has no published GitHub security advisory.

Who is affected: the README says local direct file parsing "currently requires FIRECRAWL_API_URL pointing to a self-hosted Firecrawl API", and that the hosted endpoint "cannot read your filesystem." So the risk applies to a local server pointed at a self-hosted API. That gives the mitigation:

Use the hosted server, or
Run locally with only FIRECRAWL_API_KEY and don't set FIRECRAWL_API_URL.

If you must self-host, run the MCP server in a container or as a user that can't read your secrets, and rotate any keys it could reach.

Security notes

Fetched pages are untrusted input. Scrape, crawl, search and interact return text from any URL the model picks. A page can carry instructions aimed at your agent. Keep tool approval on for any other server that can write or run commands, so injected text can't act through it.

The key is account-wide. OAuth and API keys both reach "the full tool surface on your team's plan", per Firecrawl's docs. Anyone holding the key can spend your team's credits.

Credits add up. Search costs 2 credits, and asking for page content with results is billed as scrapes. Crawls and agent runs can touch many pages; the agent tool takes a maxCredits limit, and the README says the API defaults to 2,500 when it's omitted. Set crawl limits, and use firecrawl_credit_usage to see what was spent, by day, endpoint or API key.

Local HTTP mode accepts only localhost hosts and origins by default. Don't bind it to 0.0.0.0 on an untrusted network.

See the 5-minute safety check for the general process.

Why it grades B

Maintenance is strong: it's Firecrawl's own open-source server with frequent releases. The hosted server uses HTTPS and does its fetching on Firecrawl's side. Authentication is the weaker part. It's optional, since the keyless tier works with no sign-in, and when you do sign in, OAuth or a key acts for your whole team with no scopes.

The biggest deduction is the open CVE above. It only bites in a self-hosted setup, but it's unpatched and the report has had no public response, so we count it in full.

Full breakdown on the Firecrawl MCP listing; the method is in how TrustedMCP scores servers.

Frequently asked questions

Is the Firecrawl MCP server free?

The server is open source. The hosted endpoint has a keyless free tier: in the docs' words, "No account or key. Search, Scrape, and Parse within daily limits." Crawl, map, agent and the other tools need an account. Firecrawl's MCP docs don't list prices, so check your Firecrawl plan for credit amounts.

What's the Firecrawl MCP server URL?

https://mcp.firecrawl.dev/v2/mcp for keyless or API-key use, and https://mcp.firecrawl.dev/v2/mcp-oauth for OAuth sign-in. The OAuth URL is for your MCP client, not a page to open in a browser.

Is Firecrawl MCP safe to use?

The hosted server with OAuth and tool approval on is a reasonable setup. Avoid pointing a local install at a self-hosted API until CVE-2026-85606 is fixed.

Firecrawl MCP vs Tavily MCP?

Both fetch and search the web. Tavily grades A, partly because it has no open CVE. See the Tavily MCP guide and the best MCP server for SEO and search.

Why did my agent follow instructions from a scraped page?

The page text came back as tool output and the model read it. That's prompt injection, not a Firecrawl bug. Keep approval on for tools that write.

More: MCP tool annotations explained · Search category