github · firecrawl-mcp-serverb6d8acd1fd6a

Evidence

/**

 * Firecrawl Monitor tools.

 *

 * Monitors run recurring scrapes/crawls and diff each result against the last

 * retained snapshot. The SDK exposes monitor methods, but its HttpClient

 * injects a top-level `origin` field into every POST/PATCH body and

 * /v2/monitor rejects that with "Unrecognized key in body". Until the SDK

 * strips `origin` for monitor requests, we hit /v2/monitor directly via fetch

 * — same pattern the CLI uses.

 */

import { z } from 'zod';

import type { ContentResult

Remediation

Missing annotation: add `{ annotations: { destructiveHint: true } }` as the 4th argument to `server.tool(...)` (TS) or pass `destructive_hint=True` to the `@mcp.tool(...)` decorator (Python). readOnly-lying: remove the `readOnlyHint: true` / `read_only_hint=True` assertion, or refactor the handler so it no longer calls the destructive sink. Do not suppress with a waiver — clients rely on these hints for user-facing confirmation.

Evidence

#!/usr/bin/env node

import { Server } from '@modelcontextprotocol/sdk/server/index.js';

import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';

import { SSEServerTransport } from '@modelcontextprotocol/sdk/server/sse.js';

import {

  Tool,

  CallToolRequestSchema,

  ListToolsRequestSchema,

} from '@modelcontextprotocol/sdk/types.js';

import FirecrawlApp, {

  type ScrapeOptions,

  type MapOptions,

  type Document,

} from '@mendable/firecrawl-js';

import { StreamableHTTP

Remediation

Apply auth middleware at the route or router level: - Express / Fastify / Koa: `passport.authenticate(...)`, `requireAuth`, `verifyToken`, or an equivalent JWT middleware applied via `router.use(authMw)` or as a per-route handler. - FastAPI: `Depends(get_current_user)`, `OAuth2PasswordBearer`, `HTTPBearer`, or `verify_jwt` dependency. - Flask: `@login_required`, `@auth_required`, `@jwt_required`, or call `verify_jwt_in_request()` in the handler. Mounting MCP behind a s

Evidence

) {

    return;

  }

  console.log(

    '[MCP_SEARCH_AUTH]',

    JSON.stringify({

      auth_mode: searchCompanionAuthMode(request, session),

      outcome,

      profile: 'companion',

      // Unique only to this telemetry record; it is not a cross-service

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

: {}),

    ...(code ? { code } : {}),

  };

  console.error('[MCP_ACTION]', JSON.stringify(payload));

  const secret = normalizeHeader(process.env.FIRECRAWL_MCP_ACTION_LOG_SECRET);

  const apiUrl = normalizeHeader(process.env.FIRECRAWL_API_URL);

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

const elapsedMs = () => Date.now() - startedAt;

  let response: Response;

  try {

    response = await fetch(getOAuthIntrospectionEndpoint(), {

      method: 'POST',

      headers: {

        'Content-Type': 'application/x-www-form-urlencoded',

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

apiKey: string,

  origin?: string

): Promise<any> {

  const response = await fetch(`${resolveApiBaseUrl()}${pathName}`, {

    method: 'POST',

    headers: {

      'Content-Type': 'application/json',

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

headers['x-firecrawl-keyless-ip'] = session.keylessClientIp;

    headers['x-firecrawl-keyless-secret'] = process.env.KEYLESS_PROXY_SECRET;

  }

  const response = await fetch(`${resolveApiBaseUrl()}${path}`, {

    method: 'POST',

    headers,

    body: JSON.stringify(body),

Remediation

Pass timeout= on every call: - HTTP: `requests.get(url, timeout=5)`, `httpx.get(url, timeout=5.0)` - Node fetch: `AbortSignal.timeout(5000)` - Subprocess: `subprocess.run(["cmd"], timeout=30, check=True)` Pick a value short enough to fail fast and retry.

Evidence

parameters: z

    .object({

      scrapeId: z.string().trim().min(1).optional(),

      url: z.string().trim().url().optional(),

      prompt: z.string().trim().min(1).optional(),

      code: z.string().trim().min(1).optional(),

      language: z.enum(['bash', 'python', 'node']).optional(),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

);

const valuableSourceSchema = z.object({

  url: z.string().url(),

  reason: z.string().max(1000).optional(),

});

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

}

const scrapeParamsSchema = z.object({

  url: z.string().url(),

  formats: z

    .array(

      z.enum([

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

valuableSources: z

        .array(

          z.object({

            url: z.string().url(),

            reason: z.string().max(1000).optional(),

          })

        )

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

`,

  outputSchema: mapOutputSchema,

  parameters: z.object({

    url: z.string().url(),

    search: z.string().optional(),

    sitemap: z.enum(['include', 'skip', 'only']).optional(),

    includeSubdomains: z.boolean().optional(),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

valuableSources: z.array(valuableSourceSchema).max(50).optional(),

      missingContent: z.array(missingContentSchema).max(50).optional(),

      querySuggestions: z.string().max(2000).optional(),

      url: z.string().url().optional(),

      pageNumbers: z.array(z.number().int().positive()).max(100).optional(),

      metadata: z.record(z.string(), z.unknown()).optional(),

    }).superRefine((value, ctx) => {

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

Crawl results can be large; use conservative limits when full-site coverage is unnecessary. Webhooks and interactive scrape actions are unavailable in safe mode. Returns the crawl ID, status, and page data.

`,

  parameters: z.object({

    url: z.string(),

    prompt: z.string().optional(),

    excludePaths: z.array(z.string()).optional(),

    includePaths: z.array(z.string()).optional(),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

`,

    outputSchema: deprecatedToolOutputSchema,

    parameters: z.object({

      query: z.string().min(1),

      k: z.number().int().min(1).max(100).optional(),

    }),

    canList: () => false,

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

scrapeId: z.string().trim().min(1).optional(),

      url: z.string().trim().url().optional(),

      prompt: z.string().trim().min(1).optional(),

      code: z.string().trim().min(1).optional(),

      language: z.enum(['bash', 'python', 'node']).optional(),

      timeout: z.number().min(1).max(300).optional(),

      scrapeOptions: scrapeParamsSchema.omit({ url: true }).partial().optional(),

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

const scrapeToolParamsSchema = scrapeParamsSchema

  .extend({

    url: z.string().url().optional(),

    timeout: z.number().int().positive().optional().describe("Execution timeout in milliseconds."),

    requestId: z

      .string()

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

text: z.string().optional(),

              key: z.string().optional(),

              direction: z.enum(['up', 'down']).optional(),

              script: z.string().optional(),

              fullPage: z.boolean().optional(),

            })

          )

Remediation

Shape the schema to the tool's actual intent: - Zod: chain `.enum([...])`, `.regex(/.../)`, or `.max(n)`; prefer `z.enum([...])` or `z.literal(...)` when the value set is small. - Pydantic: use `Literal["a", "b"]` or `Field(max_length=..., pattern=r"...")`. - JSON Schema: add `"enum"`, `"pattern"`, or `"maxLength"` to the property. An overbroad schema is an "overpowered tool" — the model has nothing to prevent it from calling the tool with input far beyond what the tool's prose contract

Evidence

"lint": "eslint src/**/*.ts",

    "lint:fix": "eslint src/**/*.ts --fix",

    "format": "prettier --write .",

    "prepare": "npm run build",

    "publish-prod": "npm run build && npm publish",

    "publish-beta": "npm run build && npm publish --tag beta"

  },

Remediation

Prefer libraries that do not require install-time code execution: - Drop `postinstall`/`preinstall`/`prepare` scripts if the work can happen at runtime or build-time instead. - Ship pre-built native binaries rather than compiling via a custom `cmdclass` or `build_ext` override. - For Dockerfiles: replace `RUN curl … | sh` with a pinned download + checksum verification + explicit `RUN` of a named script. - If the hook is unavoidable, document exactly what it does so downstream reviewers

Evidence

# Generated by https://smithery.ai. See: https://smithery.ai/docs/config#dockerfile

# Use a Node.js image as the base for building the application

FROM node:22-alpine AS builder

# Enable pnpm via corepack

RUN corepack enable && corepack prepare pnpm@10.17.1 --activate

# Set the working directory inside the container

WORKDIR /app

# Copy package.json and pnpm-lock.yaml to install dependencies

COPY package.json pnpm-lock.yaml ./

# Install dependencies (ignoring scripts to prevent running the pr

Remediation

Create and switch to a non-root user before the CMD / ENTRYPOINT: RUN adduser --system --uid 1000 app USER 1000 Or reuse the base image's shipped non-root account (e.g. `USER nobody`, `USER nonroot` on distroless). Multi-stage builds only need the USER directive in the final stage.

Evidence

## Service image: Node (FastMCP) + NGINX sidecar in one container

# 1) Build stage

FROM node:22-alpine AS builder

WORKDIR /app

# Enable pnpm via corepack

RUN corepack enable && corepack prepare pnpm@10.17.1 --activate

COPY package.json pnpm-lock.yaml pnpm-workspace.yaml ./

COPY patches ./patches

# Install dev dependencies for the build, but skip scripts to avoid running

# the package "prepare" script before the source code is copied.

RUN pnpm install --frozen-lockfile --ignore-scripts

COPY .

Remediation

Create and switch to a non-root user before the CMD / ENTRYPOINT: RUN adduser --system --uid 1000 app USER 1000 Or reuse the base image's shipped non-root account (e.g. `USER nobody`, `USER nonroot` on distroless). Multi-stage builds only need the USER directive in the final stage.

Evidence

steps:

      - name: 'Checkout GitHub Action'

        uses: actions/checkout@main

      - name: 'Login to GitHub Container Registry'

        uses: docker/login-action@v1

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

password: ${{secrets.GITHUB_TOKEN}}

      - name: 'Set up Docker Buildx'

        uses: docker/setup-buildx-action@v1

      - name: 'Build Service Image'

        uses: docker/build-push-action@v2

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

contents: read

    steps:

      - uses: actions/checkout@v5

      - name: Install pnpm

        uses: pnpm/action-setup@fc06bc1257f339d1d5d8b3a19a8cae5388b55320 # v4

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

version: 10

      - name: Set up Node.js

        uses: actions/setup-node@v4

        with:

          node-version: "20"

          cache: "pnpm"

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

runs-on: ubuntu-latest

    steps:

      - uses: actions/checkout@v3

      - name: Setup pnpm

        uses: pnpm/action-setup@v4

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

uses: docker/setup-buildx-action@v1

      - name: 'Build Service Image'

        uses: docker/build-push-action@v2

        with:

          context: .

          file: ./Dockerfile.service

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

- uses: actions/checkout@v3

      - name: Setup pnpm

        uses: pnpm/action-setup@v4

        with:

          version: 10

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

password: ${{ secrets.GITHUB_TOKEN }}

      - name: 'Set up Docker Buildx'

        uses: docker/setup-buildx-action@v1

      - name: 'Build Service Image'

        uses: docker/build-push-action@v2

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

uses: actions/checkout@main

      - name: 'Login to GitHub Container Registry'

        uses: docker/login-action@v1

        with:

          registry: ghcr.io

          username: ${{ github.actor }}

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

uses: actions/checkout@main

      - name: 'Login to GitHub Container Registry'

        uses: docker/login-action@v1

        with:

          registry: ghcr.io

          username: ${{github.actor}}

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

runs-on: ubuntu-latest

    steps:

      - name: 'Checkout GitHub Action'

        uses: actions/checkout@main

      - name: 'Login to GitHub Container Registry'

        uses: docker/login-action@v1

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

version: 10

      - name: Use Node.js

        uses: actions/setup-node@v3

        with:

          node-version: '22.x'

          cache: 'pnpm'

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

uses: docker/setup-buildx-action@v1

      - name: 'Build Service Image'

        uses: docker/build-push-action@v2

        with:

          context: .

          file: ./Dockerfile.service

Remediation

Pin every `uses:` to a 40-character commit SHA. Trailing comment with the version helps reviewers: `uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v4.1.1` Automate the migration with `pinact` (https://github.com/suzuki-shunsuke/pinact) or `ratchet` (https://github.com/sethvargo/ratchet). Add a `pinact run --check` pre-commit hook so future PRs stay pinned. Re-pin when the action releases a new version — Dependabot can do this automatically with `version-update-strategy: inc

Evidence

# Changelog

## [Unreleased]

### Added

- `firecrawl_agent` now exposes the optional `effort` (`low`, `medium`, `high`), `maxCredits`, and `strictConstrainToURLs` parameters that `POST /v2/agent` already accepts, and forwards them in the request body.

### Changed

- The search surface (`/v2/mcp-search`) now exposes `firecrawl_find_tools` and `firecrawl_scrape` alongside its six search tools, so agents can execute the Alexandria providers that `firecrawl_search` already returns. Both carry surf

Remediation

Add a structured invocation log to every authenticated MCP tool handler. A minimum example: Python (FastMCP): import logging logger = logging.getLogger(__name__) @mcp.tool() def my_tool(args, ctx): logger.info( "tool.invoke", extra={ "tool": "my_tool", "user_id": ctx.user_id, "request_id": ctx.request_id, }, ) ... TypeScript (@modelcontextprotocol/sdk): import pi

Evidence

/**

 * Firecrawl Monitor tools.

 *

 * Monitors run recurring scrapes/crawls and diff each result against the last

 * retained snapshot. The SDK exposes monitor methods, but its HttpClient

 * injects a top-level `origin` field into every POST/PATCH body and

 * /v2/monitor rejects that with "Unrecognized key in body". Until the SDK

 * strips `origin` for monitor requests, we hit /v2/monitor directly via fetch

 * — same pattern the CLI uses.

 */

import { z } from 'zod';

import type { ContentResult

Remediation

Add a structured audit-event emit immediately after every destructive sink. Minimum schema: actor, action, target, outcome, request_id. Python: from acme.audit import audit_log @mcp.tool() def delete_record(token: str, record_id: str) -> dict: actor = verify_token(token) db.execute("DELETE FROM records WHERE id = %s", (record_id,)) audit_log( actor=actor.sub, action="delete_record", target=record_id, outcome=