What we observed firecrawl-fastmcp do, and what it declares

We found no contradiction between this server's declarations and the behaviour we observed — having executed 25 of 25 declared tools, and reached a conclusion about 0 of 145 declared arguments. That is a statement about what we reached, not a clearance for what we did not.

01 How much of your server we reached

One cell per declared tool, in name order. Height of fill is the share of that tool's declared arguments we reached a conclusion about. This is the bound on everything that follows: a tool we could not reach is not a tool we cleared.

arguments we classifieddeclared, not determinedtool never reachedcarries a contradiction

Tools executed

25 of 25 tools (100.0%)

Arguments concluded

0 of 145 arguments (0.0%)

Strong enough to enforce

0 of 145 arguments

Tools with an observed effect

0 of 25 tools

These are counts of what our instrumentation reached, not a score for your server. A low figure here is a statement about this run.

02 Contradictions

No tool of this server was observed doing something its own annotations rule out, among the tools we reached.

A disagreement is held back for one of three reasons: nothing tied it to the call rather than to the server's own background activity; it rests on prose rather than on an annotation you made; or the observation behind it cannot support the claim, as an outbound HTTP method cannot witness a modification. None of the three is a reason to drop it, so all of them are listed under Withheld below.

03 Where authority lands, and what it carries

These arguments were observed deciding where an effect lands — a path, a destination, a command line — rather than deciding what it contains. They are the ones worth validating before they are filled from anything a model produced or a document supplied.

No argument of this server reached a confidence we would build a control on.

Read that beside the reach above, not instead of it. It means we did not establish authority, which is different from establishing that there is none.

04 Per tool

Every tool this server declares, whether or not we reached it. Declarations are quoted as published.

05 What we could not tell

An argument we could not classify is not an inert argument. The first says we did not find out; the second says we perturbed it and watched nothing change. Absence of a finding in this document is not evidence of absence, and we would rather print this section than let you read it that way.

Not determined: 145 of 145 arguments (100.0%)

06 What we withheld, and why

Two kinds of thing are held back from the findings above. Effects that landed inside a call's observation window but could not be tied to the call — a runtime's own cache directory, a background telemetry flush — and disagreements that rest on prose or on an annotation you never made.

Nothing was withheld.

08 Method, conditions and limits

Every tool was executed under instrumentation inside a confined sandbox. Each perturbed value carried a unique token; a claim exists here only where that token reappeared in an observed channel, and which region of the channel it landed in is what separates an argument that steers a destination from one that supplies content. Your declarations were recorded as claims under test, never as facts.

What this method cannot see:

• A tool we could not reach is not a tool we cleared. Reach is the ceiling on everything below.
• A `path` argument that may mean a directory is not offered one, so `list_directory`-shaped tools are frequently unreached.
• The input generator fills every optional argument, so a tool that rejects two options together errors on every probe and yields nothing.
• Branch selection varies one gate at a time, so an argument reachable only under a combination of modes is not reached at all.
• Process interposition is not syscall coverage, and an internal network blocks a raw socket without the sink seeing it — so “blocked” and “observed” are not the same set.
• Effects that propagate no marker — a directory listing, for instance — are invisible to this method and are not reported as absent.
• Ambient activity landing inside a call's observation window is separated from the tool's own by canary attribution and resource ubiquity. An asynchronous telemetry flush that appears under only a few tools escapes both.
• A canary in a URL query string lands in the path region and so reads as target rather than payload. For an endpoint selector that is right; for a search term it overstates.

09 How to respond

If you think a finding here is wrong, the evidence id beside it is the thing to argue with. Each one resolves to a stored observation in the appendix below, recorded at the moment it happened.

If a tool is listed as never reached and you know why — an argument shape our generator would not produce, a resource that must exist first, a credential we did not have — that is the most useful reply we can get. Reach is the ceiling on this whole document.

Nothing in this report has been published anywhere. It was generated for you.

10 Evidence

Every observation cited above, as recorded. This is the whole basis for the document — nothing here was reconstructed after the fact.