Firecrawl MCP — agentic threat model

Not certain from the listing — relies on external LLMs for structured extraction. The primary threat is indirect prompt injection where scraped web content contains adversarial instructions that hijack the downstream model's behavior.

Acts as a dynamic data ingestion pipeline. Threats include data poisoning and ingestion of malicious payloads from untrusted web pages, which are then converted to markdown/JSON and fed directly into the agent's context.

Exposes powerful tools (scrape, crawl, map, search, extract) via the Model Context Protocol (MCP). Insecure tool integration or lack of input validation on URLs could allow SSRF or unauthorized internal network scanning.

Holds and manages a sensitive Firecrawl API key. If the host environment or MCP server is compromised, this credential can be exfiltrated. Requires secure sandboxing to prevent local file access during execution.

Not certain from the listing — no built-in guardrails, content filtering, or anomaly detection are mentioned to inspect scraped content for malicious injection patterns before passing it to the model.

Not certain from the listing — lacks explicit mention of authentication, authorization policies, or compliance audits for handling scraped personal data (GDPR/CCPA) or respecting robots.txt dynamically.

Designed to be used by other agents within an MCP ecosystem. A compromise of this agent (e.g., via poisoned crawl results) can propagate malicious payloads to orchestrator agents, leading to cascading failures.