firecrawl-mcp 3.29.0 → 3.29.1

package/README.md

@@ -287,11 +287,21 @@ Hosted Firecrawl can issue OAuth **access tokens** (`fco_…`) via the authoriza
 
 Use **access** tokens (`fco_…`) only. Refresh tokens (`fcr_…`) must be exchanged at the token endpoint, not passed to the scrape/search API.
 
+#### Hardened HTTP preset (`CLOUD_SERVICE=true`)
+
+`CLOUD_SERVICE=true` serves the tools over streamable HTTP on `PORT` (default `3000`), bound to `0.0.0.0`, with stricter defaults for a shared deployment:
+
+- every request must carry a credential (an API key or an OAuth access token);
+- safe mode: scrape is read-only (see the scrape tool below);
+- `firecrawl_parse` accepts uploads only and never reads local files.
+
+`FASTMCP_ENDPOINT` selects the surface: `/v2/mcp` (default) serves the full tool set, `/v2/mcp-oauth` the account surface, and `/v2/mcp-search` (which also requires `FIRECRAWL_MCP_SEARCH_OAUTH_ONLY=true`) the [search-only surface](#search-only-surface-hosted) described below.
+
 #### Search-only surface (hosted)
 
-In hosted mode (`CLOUD_SERVICE=true`) a second in-process instance serves the [search-only endpoint](#search-only-endpoint). The bundled service has a fixed deployment contract: nginx routes `/v2/mcp-search` to the instance on local port `3001`, and the OAuth protected-resource identifier is `https://mcp.firecrawl.dev/v2/mcp-search`.
+In hosted mode (`CLOUD_SERVICE=true`) a second in-process instance serves the [search-only endpoint](#search-only-endpoint) on local port `3001`. The hosted deployment's reverse proxy routes `/v2/mcp-search` to that port, and the OAuth protected-resource identifier is `https://mcp.firecrawl.dev/v2/mcp-search`.
 
-`FIRECRAWL_MCP_SEARCH_ENABLED` (default `true`) is the supported operational toggle; set it to `false` to prevent the search instance from starting. The Node process also accepts `FIRECRAWL_MCP_SEARCH_PORT`, `FIRECRAWL_MCP_SEARCH_ENDPOINT`, and `FIRECRAWL_MCP_SEARCH_RESOURCE_URL` for isolated tests. Those overrides do not reconfigure the bundled nginx routes or the authorization server allowlist and must not be used independently in the hosted deployment.
+`FIRECRAWL_MCP_SEARCH_ENABLED` (default `true`) is the supported operational toggle; set it to `false` to prevent the search instance from starting. The Node process also accepts `FIRECRAWL_MCP_SEARCH_PORT`, `FIRECRAWL_MCP_SEARCH_ENDPOINT`, and `FIRECRAWL_MCP_SEARCH_RESOURCE_URL` for isolated tests. Those overrides do not reconfigure the deployment's proxy routes or the authorization server allowlist and must not be used independently in the hosted deployment.
 
 The search instance requires authentication for every request (including `tools/list`) and rejects OAuth tokens whose audience does not match its own resource.
 
@@ -453,7 +463,7 @@ Scrape content from a single URL with advanced options.
 
 **Branding format:** Extracts comprehensive brand identity (colors, fonts, typography, spacing, logo, UI components) for design analysis or style replication.
 **Privacy:** Set `redactPII: true` to return content with personally identifiable information redacted.
-**Hosted server:** On the hosted server (`CLOUD_SERVICE=true`) scrape is read-only. It takes no browser `actions` and cannot accept provider terms. A named `profile` loads saved browser state without saving changes to it, and the full endpoint's `firecrawl_search` treats `scrapeOptions.profile` the same way. To save browser state to a profile, open the page with `firecrawl_interact` (see below). An organization admin accepts terms in the dashboard.
+**Hardened HTTP preset and the hosted server:** With `CLOUD_SERVICE=true`, as on the hosted server, scrape is read-only. It takes no browser `actions` and cannot accept provider terms. A named `profile` loads saved browser state without saving changes to it, and the full endpoint's `firecrawl_search` treats `scrapeOptions.profile` the same way. To save browser state to a profile, open the page with `firecrawl_interact` (see below). An organization admin accepts terms in the dashboard.
 
 **Returns:**
 

package/dist/index.js

@@ -3,17 +3,6 @@
 // src/index.ts
 import dotenv from "dotenv";
 
-// src/headers.ts
-function normalizeHeader(value) {
-  if (value == null) return void 0;
-  const v = Array.isArray(value) ? value[0] : value;
-  const trimmed = typeof v === "string" ? v.trim() : "";
-  return trimmed || void 0;
-}
-function withoutTrailingSlash(value) {
-  return value.replace(/\/+$/, "");
-}
-
 // src/alexandria-feedback.ts
 import { z } from "zod";
 var detail = z.string().trim().min(1).max(2e3);
@@ -3530,6 +3519,17 @@ The historical view returns periods sorted by start date with \`startDate\`, \`e
   });
 }
 
+// src/headers.ts
+function normalizeHeader(value) {
+  if (value == null) return void 0;
+  const v = Array.isArray(value) ? value[0] : value;
+  const trimmed = typeof v === "string" ? v.trim() : "";
+  return trimmed || void 0;
+}
+function withoutTrailingSlash(value) {
+  return value.replace(/\/+$/, "");
+}
+
 // src/recovery.ts
 import { randomUUID } from "crypto";
 
@@ -4291,6 +4291,7 @@ function createFirecrawlMcpServer(options2 = {}) {
         "rawHtml",
         "screenshot",
         "links",
+        "images",
         "summary",
         "changeTracking",
         "branding",
@@ -4934,9 +4935,9 @@ For a programming question, add \`categories: ["developer"]\`; its hits return i
     }
   };
   server.addTool(findToolsTool);
-  const DEFAULT_CLOUD_API_URL2 = "https://api.firecrawl.dev";
+  const DEFAULT_CLOUD_API_URL = "https://api.firecrawl.dev";
   function resolveApiBaseUrl() {
-    return (config.apiUrl || DEFAULT_CLOUD_API_URL2).replace(
+    return (config.apiUrl || DEFAULT_CLOUD_API_URL).replace(
       /\/$/,
       ""
     );
@@ -5923,20 +5924,6 @@ function introspectionTtlMs(value, now, activeTtlMs = INTROSPECTION_ACTIVE_TTL_M
   return Math.min(activeTtlMs, value.exp * 1e3 - now);
 }
 
-// src/service/keyless-client-ip.ts
-import net from "net";
-function extractSingleTrustedClientIp(rawForwardedFor) {
-  if (Array.isArray(rawForwardedFor) && rawForwardedFor.length !== 1) {
-    return void 0;
-  }
-  const raw = Array.isArray(rawForwardedFor) ? rawForwardedFor[0] : rawForwardedFor;
-  if (typeof raw !== "string") return void 0;
-  const parts = raw.split(",").map((part) => part.trim()).filter(Boolean);
-  if (parts.length !== 1) return void 0;
-  const candidate = parts[0].replace(/^\[(.*)\]$/, "$1").toLowerCase();
-  return net.isIP(candidate) ? candidate : void 0;
-}
-
 // src/service/session-credential.ts
 import { createHmac } from "crypto";
 var managedOAuthApiKey = /* @__PURE__ */ Symbol("firecrawlManagedOAuthApiKey");
@@ -6113,9 +6100,6 @@ function makePrimaryProfile() {
 }
 
 // src/service/auth.ts
-function extractClientIp(request) {
-  return extractSingleTrustedClientIp(request?.headers?.["x-forwarded-for"]);
-}
 function extractBearerToken(headers) {
   const headerAuth = normalizeHeader(headers["authorization"]);
   if (!headerAuth?.toLowerCase().startsWith("bearer ")) return void 0;
@@ -6128,9 +6112,6 @@ function isFirecrawlOAuthAccessToken(token) {
 function isFirecrawlApiKey(token) {
   return token.startsWith("fc-");
 }
-function isLegacyKeyPathRequest(request) {
-  return normalizeHeader(request?.headers?.["x-firecrawl-key-transport"]) === "path";
-}
 function requestShouldReceiveOAuthChallenge(request, profile) {
   if (!profile.acceptApiKeys) return true;
   if (!request?.headers) return true;
@@ -6415,19 +6396,11 @@ async function authenticateRequest(request, profile, options2) {
           return {
             authType: "api-key",
             credentialError: "CREDENTIAL_INVALID",
-            firecrawlApiKey: void 0,
-            keylessClientIp: extractClientIp(request)
+            firecrawlApiKey: void 0
           };
         }
         throw new InvalidFirecrawlCredentialError();
       }
-      if (profile.allowKeyless) {
-        return {
-          authType: "keyless",
-          firecrawlApiKey: void 0,
-          keylessClientIp: extractClientIp(request)
-        };
-      }
       if (!profile.acceptApiKeys) {
         throw new Error(
           `OAuth access token required for the Firecrawl MCP resource ${profile.endpoint}`
@@ -6440,7 +6413,6 @@ async function authenticateRequest(request, profile, options2) {
     const session2 = {
       authType: resolved?.source === "oauth" ? "oauth" : "api-key",
       firecrawlApiKey: headerCred,
-      ...isLegacyKeyPathRequest(request) ? { keyTransport: "path" } : {},
       ...resolved?.metadata
     };
     return managedCred ? setManagedOAuthApiKey(session2, managedCred) : session2;
@@ -6489,18 +6461,6 @@ function emitSearchCompanionAuthTelemetry(hosted2, profile, request, outcome, se
     })
   );
 }
-function emitLegacyKeyPathTelemetry(profile, request, outcome, session) {
-  if (profile.id !== "full" || !isLegacyKeyPathRequest(request)) return;
-  console.log(
-    "[MCP_LEGACY_KEY_PATH]",
-    JSON.stringify({
-      auth_type: session?.authType ?? "none",
-      key_transport: "path",
-      outcome,
-      resource: profile.resourceUrl
-    })
-  );
-}
 function createServiceAuthenticate(profile, options2) {
   return function authenticateWithOAuthChallenge(request) {
     return authenticateRequest(request, profile, options2).then((session) => {
@@ -6512,12 +6472,6 @@ function createServiceAuthenticate(profile, options2) {
         session.credentialError ? "rejected" : "accepted",
         session
       );
-      emitLegacyKeyPathTelemetry(
-        profile,
-        request,
-        session.credentialError ? "rejected" : "accepted",
-        session
-      );
       return session;
     }).catch((error2) => {
       emitSearchCompanionAuthTelemetry(
@@ -6526,7 +6480,6 @@ function createServiceAuthenticate(profile, options2) {
         request,
         "rejected"
       );
-      emitLegacyKeyPathTelemetry(profile, request, "rejected");
       if (error2 instanceof InvalidFirecrawlCredentialError) {
         throw createInvalidCredentialResponse(error2);
       }
@@ -6553,76 +6506,6 @@ function createServiceAuthenticate(profile, options2) {
   };
 }
 
-// src/service/session.ts
-function isHostedKeylessSession(session) {
-  return session?.authType === "keyless" && !session.firecrawlApiKey;
-}
-
-// src/service/keyless.ts
-var DEFAULT_CLOUD_API_URL = "https://api.firecrawl.dev";
-function apiBaseUrl(apiUrl2) {
-  return (apiUrl2 || DEFAULT_CLOUD_API_URL).replace(/\/$/, "");
-}
-async function keylessEligible(apiBaseUrl2, clientIp, origin, { signupLink = false } = {}) {
-  const secret = process.env.KEYLESS_PROXY_SECRET;
-  if (!secret) return { eligible: false, unavailable: true };
-  try {
-    const response = await fetch(
-      `${apiBaseUrl2}/v2/keyless/eligibility${signupLink ? "?signup_link=1" : ""}`,
-      {
-        headers: {
-          ...originHeaders(origin),
-          "x-firecrawl-keyless-ip": clientIp,
-          "x-firecrawl-keyless-secret": secret
-        }
-      }
-    );
-    if (!response.ok) return { eligible: false, unavailable: true };
-    const json = await response.json().catch(() => null);
-    if (typeof json?.eligible !== "boolean") {
-      return { eligible: false, unavailable: true };
-    }
-    return {
-      eligible: json?.eligible === true,
-      ...typeof json?.reason === "string" ? { reason: json.reason } : {},
-      ...Number.isFinite(json?.retryAfterSeconds) && json.retryAfterSeconds > 0 ? { retryAfterSeconds: json.retryAfterSeconds } : {},
-      ...keylessSignupUrlFrom(json?.signupUrl) ? { signupUrl: json.signupUrl } : {}
-    };
-  } catch {
-    return { eligible: false, unavailable: true };
-  }
-}
-async function hostedKeylessSignupUrl(apiBaseUrl2, session) {
-  if (!session?.keylessClientIp) return void 0;
-  const eligibility = await keylessEligible(
-    apiBaseUrl2,
-    session.keylessClientIp,
-    requestOrigin(void 0, session),
-    { signupLink: true }
-  );
-  return eligibility.signupUrl;
-}
-async function requireKeylessEligibility(apiBase, session, origin) {
-  if (!isHostedKeylessSession(session)) return;
-  const eligibility = session?.keylessClientIp ? await keylessEligible(apiBase, session.keylessClientIp, origin) : { eligible: false };
-  if (!eligibility.eligible) {
-    const code = eligibility.unavailable ? "KEYLESS_ELIGIBILITY_UNAVAILABLE" : keylessQuotaReason(eligibility.reason) ? "KEYLESS_QUOTA_EXHAUSTED" : "KEYLESS_ACCESS_NOT_AVAILABLE";
-    const payload = recoveryPayload(code, session?.requestId, {
-      retryAfterSeconds: eligibility.retryAfterSeconds,
-      signupUrl: eligibility.signupUrl
-    });
-    throw new UserError2(String(payload.message), payload);
-  }
-}
-function keylessForwardingHeaders(session) {
-  const secret = process.env.KEYLESS_PROXY_SECRET;
-  if (!session?.keylessClientIp || !secret) return void 0;
-  return {
-    "x-firecrawl-keyless-ip": session.keylessClientIp,
-    "x-firecrawl-keyless-secret": secret
-  };
-}
-
 // src/service/search-surface.ts
 import { z as z13 } from "zod";
 function searchSurfaceScrapeDescription(safeMode) {
@@ -6750,66 +6633,7 @@ function searchSurfaceTools({
 }
 
 // src/service/tool-guard.ts
-import { randomUUID as randomUUID4 } from "crypto";
-function emitActionLog(profile, apiUrl2, toolName, status, session, error2, requestId = randomUUID4(), code) {
-  const payload = {
-    team_id: session?.teamId,
-    user_id: session?.userId,
-    api_key_id: session?.apiKeyId,
-    oauth_client_id: session?.oauthClientId,
-    auth_type: session?.authType ?? "none",
-    tool_name: toolName,
-    status,
-    request_id: requestId,
-    resource: profile.resourceUrl,
-    ...error2 ? { error_class: error2 instanceof Error ? error2.name : typeof error2 } : {},
-    ...code ? { code } : {}
-  };
-  console.error("[MCP_ACTION]", JSON.stringify(payload));
-  const secret = normalizeHeader(process.env.FIRECRAWL_MCP_ACTION_LOG_SECRET);
-  const configuredApiUrl = normalizeHeader(apiUrl2);
-  const endpoint = normalizeHeader(process.env.FIRECRAWL_MCP_ACTION_LOG_URL) ?? (configuredApiUrl ? `${withoutTrailingSlash(configuredApiUrl)}/v2/mcp/action-logs` : void 0);
-  if (!secret || !endpoint || !payload.team_id || status === "started") return;
-  const actionLogPayload = { ...payload };
-  delete actionLogPayload.code;
-  void fetch(endpoint, {
-    method: "POST",
-    headers: {
-      Authorization: `Bearer ${secret}`,
-      "Content-Type": "application/json"
-    },
-    body: JSON.stringify(actionLogPayload),
-    signal: AbortSignal.timeout(1500)
-  }).catch(() => void 0);
-}
-var AGENT_HINT_LOG_MAX_CHARS = 1e3;
-function emitAgentHintsLog(profile, toolName, status, hints, session, requestId) {
-  if (!hints) return;
-  console.error(
-    "[MCP_AGENT_HINTS]",
-    JSON.stringify({
-      tool_name: toolName,
-      status,
-      request_id: requestId,
-      auth_type: session.authType ?? "none",
-      // The companion search server shares this process and wrapper.
-      profile: session.profile ?? profile.id,
-      hint_count: hints.length,
-      hints: hints.map((hint) => hint.slice(0, AGENT_HINT_LOG_MAX_CHARS))
-    })
-  );
-}
-function createToolGuard({
-  profile,
-  apiUrl: apiUrl2,
-  apiBaseUrl: apiBaseUrl2,
-  logActions
-}) {
-  const logRejection = (toolName, session, error2, requestId, code) => {
-    if (logActions) {
-      emitActionLog(profile, apiUrl2, toolName, "error", session, error2, requestId, code);
-    }
-  };
+function createToolGuard() {
   return (tool) => {
     const keylessTool = keylessToolNames.has(tool.name);
     const execute = tool.execute;
@@ -6818,58 +6642,33 @@ function createToolGuard({
     return {
       ...tool,
       canList: (session) => (
-        // A credentialError session lists the keyless tool surface (same as a
-        // real keyless session, not the full authenticated schema) so the
-        // client proceeds past tools/list and calling any listed tool returns
-        // the CREDENTIAL_INVALID recovery payload (below). An empty list would
-        // leave MCP clients that stop after tools/list unable to ever surface
-        // the recovery guidance; the full non-keyless schema would over-disclose
-        // to a request carrying an unrecognized or invalid credential.
-        (session?.credentialError || isHostedKeylessSession(session) ? keylessTool : true) && (canList?.(session) ?? true)
+        // A credentialError session lists the keyless tool surface (not the
+        // full authenticated schema) so the client proceeds past tools/list and
+        // calling any listed tool returns the CREDENTIAL_INVALID recovery
+        // payload (below). An empty list would leave MCP clients that stop after
+        // tools/list unable to ever surface the recovery guidance; the full
+        // schema would over-disclose to a request carrying an unrecognized or
+        // invalid credential.
+        (session?.credentialError ? keylessTool : true) && (canList?.(session) ?? true)
       ),
       beforeValidate: async (args2, session) => {
-        const code = session?.credentialError ? "CREDENTIAL_INVALID" : isHostedKeylessSession(session) && !keylessTool ? "KEYLESS_TOOL_NOT_AVAILABLE" : void 0;
-        if (code) {
-          const requestId = randomUUID4();
-          const payload2 = recoveryPayload(code, requestId, {
-            signupUrl: code === "KEYLESS_TOOL_NOT_AVAILABLE" ? await hostedKeylessSignupUrl(apiBaseUrl2, session) : void 0
-          });
-          logRejection(tool.name, session, new UserError2(String(payload2.message), payload2), requestId, code);
+        if (session?.credentialError) {
+          const payload = recoveryPayload("CREDENTIAL_INVALID");
           return {
-            content: [{ type: "text", text: String(payload2.message) }],
+            content: [{ type: "text", text: String(payload.message) }],
             isError: true,
-            structuredContent: payload2
+            structuredContent: payload
           };
         }
-        const earlyResult = await beforeValidate?.(args2, session);
-        const payload = earlyResult?.structuredContent;
-        const recoveryCode = payload && typeof payload === "object" && "code" in payload && typeof payload.code === "string" ? payload.code : void 0;
-        if (earlyResult?.isError && recoveryCode) {
-          logRejection(
-            tool.name,
-            session,
-            new UserError2(`Tool validation failed: ${recoveryCode}`, payload),
-            randomUUID4(),
-            recoveryCode
-          );
-        }
-        return earlyResult;
+        return beforeValidate?.(args2, session);
       },
       execute: async (args2, context) => {
         const session = context.session;
-        const requestId = session.requestId;
         if (session.credentialError) {
-          const code = "CREDENTIAL_INVALID";
-          const payload = recoveryPayload(code, requestId);
-          logRejection(tool.name, session, new UserError2(String(payload.message), payload), requestId, code);
-          throw new UserError2(String(payload.message), payload);
-        }
-        if (isHostedKeylessSession(session) && !keylessTool) {
-          const code = "KEYLESS_TOOL_NOT_AVAILABLE";
-          const payload = recoveryPayload(code, requestId, {
-            signupUrl: await hostedKeylessSignupUrl(apiBaseUrl2, session)
-          });
-          logRejection(tool.name, session, new UserError2(String(payload.message), payload), requestId, code);
+          const payload = recoveryPayload(
+            "CREDENTIAL_INVALID",
+            session.requestId
+          );
           throw new UserError2(String(payload.message), payload);
         }
         return execute(args2, context);
@@ -6877,76 +6676,6 @@ function createToolGuard({
     };
   };
 }
-function createToolCallLogger({
-  profile,
-  apiUrl: apiUrl2,
-  logActions
-}) {
-  return (event) => {
-    const session = event.session;
-    if (event.status === "started") {
-      if (logActions) {
-        emitActionLog(profile, apiUrl2, event.tool, "started", session, void 0, event.requestId);
-      }
-      return;
-    }
-    emitAgentHintsLog(
-      profile,
-      event.tool,
-      event.status === "success" && !event.result?.isError ? "success" : "error",
-      event.agentHints,
-      session,
-      event.requestId
-    );
-    if (logActions) {
-      emitActionLog(
-        profile,
-        apiUrl2,
-        event.tool,
-        event.status,
-        session,
-        event.status === "error" ? event.error : void 0,
-        event.requestId
-      );
-    }
-  };
-}
-
-// src/service/http.ts
-function registerServiceRoutes(app, profile, { hosted: hosted2 }) {
-  const openAiAppsChallengeToken = normalizeHeader(
-    process.env.OPENAI_APPS_CHALLENGE_TOKEN
-  );
-  if (openAiAppsChallengeToken) {
-    app.get(
-      "/.well-known/openai-apps-challenge",
-      (context) => context.text(openAiAppsChallengeToken)
-    );
-  }
-  app.get("/ready", (context) => {
-    if (!hosted2) {
-      return context.json({ ok: true }, 200);
-    }
-    const searchPrimary = profile.id === "search";
-    const required = [
-      "FIRECRAWL_API_URL",
-      "FIRECRAWL_OAUTH_INTROSPECT_SECRET",
-      "MCP_DELEGATED_CREDENTIAL_SECRET"
-    ];
-    if (profile.allowKeyless) {
-      required.push("KEYLESS_PROXY_SECRET");
-    }
-    const missing = required.filter((name2) => !normalizeHeader(process.env[name2]));
-    const configuredEndpoint = getPrimaryEndpoint();
-    const resourceMatchesEndpoint = searchPrimary ? withoutTrailingSlash(profile.resourceUrl) === DEFAULT_MCP_SEARCH_RESOURCE_URL : withoutTrailingSlash(profile.resourceUrl).endsWith(configuredEndpoint);
-    if (!resourceMatchesEndpoint) {
-      missing.push(
-        searchPrimary ? "FIRECRAWL_MCP_SEARCH_RESOURCE_URL (endpoint mismatch)" : "FIRECRAWL_MCP_RESOURCE_URL (endpoint mismatch)"
-      );
-    }
-    return missing.length ? context.json({ ok: false, missing }, 503) : context.json({ ok: true }, 200);
-  });
-}
 
 // src/service/index.ts
 function createServiceHooks(profile, settings) {
@@ -6963,27 +6692,13 @@ function createServiceHooks(profile, settings) {
     hooks.outboundRequest = (session) => {
       const serviceSession = session;
       const credential = hasManagedOAuthCredential(serviceSession) ? credentialForOutboundRequest(serviceSession) : void 0;
-      const headers = keylessForwardingHeaders(serviceSession);
-      return credential || headers ? { credential, headers } : void 0;
+      return credential ? { credential } : void 0;
     };
   }
   if (!settings.hosted) return hooks;
-  const apiBase = apiBaseUrl(settings.apiUrl);
-  const logActions = !searchSurface;
   return {
     ...hooks,
-    wrapTool: createToolGuard({
-      profile,
-      apiUrl: settings.apiUrl,
-      apiBaseUrl: apiBase,
-      logActions
-    }),
-    onToolResult: createToolCallLogger({
-      profile,
-      apiUrl: settings.apiUrl,
-      logActions
-    }),
-    beforeKeylessRequest: (session, origin) => requireKeylessEligibility(apiBase, session, origin),
+    wrapTool: createToolGuard(),
     ...profile.advertiseOAuth ? {
       oauth: {
         protectedResource: {
@@ -7047,7 +6762,9 @@ var { start } = createFirecrawlMcpServer({
   ...options,
   unstable_hooks: {
     ...primaryHooks,
-    configureHttp: (app) => registerServiceRoutes(app, primaryProfile, { hosted })
+    configureHttp: (app) => {
+      app.get("/ready", (context) => context.json({ ok: true }, 200));
+    }
   }
 });
 var PORT = Number(process.env.PORT || 3e3);
@@ -7061,11 +6778,6 @@ var args = transport === "httpStream" ? {
     stateless: true
   }
 } : { transportType: "stdio" };
-if (hosted && primaryProfile.allowKeyless && !normalizeHeader(process.env.KEYLESS_PROXY_SECRET)) {
-  console.warn(
-    "[firecrawl-mcp] KEYLESS_PROXY_SECRET is missing; keyless requests will be unavailable and /ready will fail."
-  );
-}
 if (transport === "stdio" && !process.env.FIRECRAWL_API_KEY && !process.env.FIRECRAWL_API_URL) {
   console.error(
     "No FIRECRAWL_API_KEY or FIRECRAWL_API_URL set \u2014 running in keyless mode. firecrawl_scrape and firecrawl_search are free (rate-limited per IP) against the Firecrawl cloud; other tools require an API key (get one free at https://firecrawl.dev)."

package/dist/server.d.ts

@@ -110,15 +110,15 @@ declare const searchToolBaseFields: {
     includeDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
     excludeDomains: z.ZodOptional<z.ZodArray<z.ZodString>>;
     sources: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodEnum<{
-        alexandria: "alexandria";
         images: "images";
+        alexandria: "alexandria";
         web: "web";
         news: "news";
         exchange: "exchange";
     }>, z.ZodObject<{
         type: z.ZodEnum<{
-            alexandria: "alexandria";
             images: "images";
+            alexandria: "alexandria";
             web: "web";
             news: "news";
             exchange: "exchange";

package/dist/server.js

@@ -4286,6 +4286,7 @@ function createFirecrawlMcpServer(options = {}) {
         "rawHtml",
         "screenshot",
         "links",
+        "images",
         "summary",
         "changeTracking",
         "branding",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "firecrawl-mcp",
-  "version": "3.29.0",
+  "version": "3.29.1",
   "description": "MCP server for Firecrawl — search, scrape, and interact with the web, and search scientific papers. Supports both cloud and self-hosted instances. Features include web search, scraping, page interaction, batch processing, LLM-powered content analysis, and research paper search over biomedical and arXiv literature (PubMed, bioRxiv, medRxiv, arXiv) with citation-graph expansion and full-text reading.",
   "type": "module",
   "mcpName": "io.github.firecrawl/firecrawl-mcp-server",