# Firecrawl web data starter kit

Firecrawl is a web data API: a service your software asks to turn specified pages into readable text or organized fields. This kit helps a small business approve a narrow collection job, protect its account key, budget credits, and decide what needs legal review. It accompanies [Firecrawl for Small Business](https://jwatte.com/blog/firecrawl-web-data-api-small-business/). The examples are illustrations, not tested customer deployments. We read the documentation and selected source code on November 3, 2026; we did not install or run Firecrawl.

## The working flow

```text
Approved URLs → Map finds URLs; Scrape/Crawl reads pages
                                      ▼
                           Markdown + source URL + time
                                      ▼
                                Human review
                                      ▼
                             Assistant or report

Own site, written permission, or public use allowed by terms?
  No → Get written permission first
  Yes ▼
Login, paywall, CAPTCHA, IP block, or owner refusal?
  Yes → Stop and ask a lawyer
  No ▼
Personal data and copyright concerns resolved?
  No → Stop and review rights and privacy
  Yes → Go ahead with limits and logs
```

Hosted work goes through Firecrawl's servers. A local MCP program connected to the hosted API does not make collection local. MCP, the Model Context Protocol, lets an assistant call a program's tools. Markdown is readable text with simple heading, list, and link marks. Neither format conversion nor successful collection establishes a right to reuse the material.

## Setup checklist for the owner and IT person

- [ ] Name the owner, reviewer, purpose, approved pages, allowed fields, and expiry date for this job.
- [ ] Read the target's terms and robots.txt, its instructions for crawlers. Get written permission for uncertain uses.
- [ ] Read Firecrawl's terms, privacy policy, and applicable additional policies. Section 5.d.1 requires express authorization for commercial purposes. Keep the order form or written confirmation covering your intended business use.
- [ ] Have a person create and approve the Firecrawl account and API key. The README advertises agent signup; keep agreement acceptance and payment approval with the person.
- [ ] Keep the real key in a private configuration or secret manager. Do not put it in page code, a public repository, screenshots, or this worksheet. Replace an exposed key promptly.
- [ ] Set the account's pay-as-you-go monthly limit to `0` for a pilot, and set per-key credit limits. A blank overage limit means unlimited top-ups. Manual purchases do not count toward that limit.
- [ ] Begin with one owned public page, markdown only, and compare the result against the original.
- [ ] Keep site text as untrusted source material. Do not let instructions found in it authorize payments, commands, new targets, or publication.
- [ ] Record source address, observation time, credit use, and review outcome. Set a deletion date.

The following are exact alternative SDK install commands from the main README's SDK sections, reproduced for review. An SDK is a library of functions for calling the API. We did not execute these commands:

```bash
pip install firecrawl
```

```bash
npm install firecrawl
```

For local MCP, the documentation requires Node.js 22 or later and npm/npx. Node.js runs JavaScript; npm manages packages and npx launches them. The main README does not publish minimum versions for every language SDK. Its MCP configuration is:

```json
{
  "mcpServers": {
    "firecrawl-mcp": {
      "command": "npx",
      "args": ["-y", "firecrawl-mcp"],
      "env": {
        "FIRECRAWL_API_KEY": "fc-YOUR_API_KEY"
      }
    }
  }
}
```

The key above is a placeholder. Using this configuration can download and launch the package. IT should inspect and pin a reviewed version before business use. Exposing tools to an assistant also exposes ways to spend credits. Enable only the operations needed for the approved work. Keep interaction actions and open ended Agent tasks outside the first pilot. The README lists n8n and Zapier integrations; their plans and data handling need a separate review.

## Scope and safe settings

These are proposed pilot controls, not Firecrawl guarantees or legal safe harbors:

- Approve exact public URLs and paths before requesting page contents. Search and Map discover candidates; discovery is not permission.
- Set Crawl `limit: 10` for an initial trial, then use the approved job's actual page ceiling. Never rely on an omitted limit or the credit balance to define scope.
- Keep `ignoreRobotsTxt: false`, `allowExternalLinks: false`, `allowSubdomains: false`, and `crawlEntireDomain: false`.
- Set a `delay` of at least one second, or slower if the owner requires it. The Crawl reference says delay forces concurrency to one. Concurrency is simultaneous work, not an entitlement to load a site.
- Start with markdown only. Approve PDF parsing and AI format charges separately. Use fresh results when checking current facts; the Scrape reference's `maxAge: 0` requests a fresh collection.
- Decide whether `storeInCache: false` is appropriate. It avoids the documented index/cache storage but is not a complete zero-retention agreement. Change-tracking snapshots persist without expiry according to their documentation.
- Ask Firecrawl how to stop escalation in the approved workflow. Its default routing can retry with enhanced access. Do not use rotating addresses, stored copies, interactive actions, or another identity to get past an owner's denial. If restrictions cannot be enforced, use the owner's approved feed or another delivery method.
- Never include login credentials, customer portals, payment pages, or private records in this starter job.

## Credit budget worksheet

US dollars before tax. Public pricing read November 3, 2026 at 21:34 UTC, browser checked at 21:36 UTC. Annual figures are the site's displayed monthly equivalents with yearly billing; exact annual checkout totals were not verified.

| Plan | Monthly billing | Annual billing monthly equivalent | Credits/month | Concurrent browsers | Credits per $5 top-up |
|---|---:|---:|---:|---:|---:|
| Free | $0 | $0 | 1,000 | 2 | Unavailable |
| Hobby | $19 | $16 | 5,000 | 5 | 1,000 |
| Standard | $99 | $83 | 100,000 | 25 | 2,000 |
| Growth | $399 | $333 | 500,000 | 50 | 2,500 |
| Scale | $749 | $599 | 1,000,000 | 100 | 5,000 |
| Enterprise | Custom | Custom | Custom | Custom | Custom |

Source: [Firecrawl pricing](https://www.firecrawl.dev/pricing). Confirm the full annual invoice: displayed savings and rounded monthly figures do not consistently produce the same total. Read account controls before paying. The pricing FAQ gives Scale one month of rollover and Enterprise custom rollover; the billing docs describe annual-plan conditions, so confirm eligibility for your billing term. Hobby, Standard, and Growth ordinary credits do not roll over. Purchased extra credits expire on subscription cancellation.

| Budget line | Your quantity | Calculation |
|---|---|---|
| Basic page reads, including repeat checks | ____ | Pages × checks × 1 |
| Map calls | ____ | Calls × 1 |
| Searches | ____ | For each query: round results up to groups of 10, then × 2 |
| Full pages collected from Search | ____ | Add their scrape and format charges |
| JSON, Question, or Highlight output | ____ | Add 4/page for each selected chargeable format |
| PDF documents | ____ | Budget separately by parsed page and chosen formats |
| Basic or text-difference change tracking | ____ | No extra charge over base scrape |
| JSON change tracking | ____ | 5/page total |
| Monitor basic checks | ____ | 1/page/check plus 1 per changed page judged; format costs can apply |
| Monitor deterministic extraction | ____ | Pricing summary lists 7/page/check |
| Browser interaction | ____ | 2/minute code only, 7 with AI prompt, one minute minimum; zero-data-retention option adds 2; initial scrape separate |
| Agent | ____ | Dynamic; do not assume a per-page price; 5 free daily runs advertised |
| Other account jobs | ____ | Add all shared usage |
| Planned credits plus explicit contingency | ____ | Compare with allowance |

Map has conflicting labels on the pricing page: its small table says per page, while its FAQ, summary, and dedicated docs say per call. This worksheet uses per call. A returned error page can still cost a basic credit. An AI model, workflow service, storage, tax, and staff time are separate costs.

Budget record:

```text
Business and job:
Plan and billing term:
Date prices checked:
Pages and checks per month:
Base credits:
Additional formats/features:
Other account use:
Planned total and contingency:
Per-key credit cap:
Monthly automatic top-up cap in USD:
Person allowed to buy extra credits:
AI/workflow/storage costs separately approved:
Reviewer and review date:
```

## Five use cards

All workloads are illustrations using ordinary permitted web pages. Specialized data-provider products can have different charges. Each individual example fits Free's 1,000 monthly credits when no other work uses the balance.

| Illustration | Permission basis and settings | Monthly credit math | Human check |
|---|---|---|---|
| Repair shop's own help library | Owned public content; exclude private and licensed material; one Map call, markdown only | 1 + 500 × 1 = 501 | Approve warranty answers and any llms.txt guide |
| Bicycle retailer's vendor or competitor watch | Terms permit collection and reuse, or written permission; 40 fixed URLs, four checks; basic change tracking | 40 × 4 × 1 = 160 | Confirm real price/policy changes and snapshot retention |
| Contractor's public RFP/grant listings | Each agency permits the use; 25 fixed pages, four checks; attachments separately scoped | 25 × 4 × 1 = 100 | Verify closing date and amendments on official notice |
| Accounting firm's cited research | Review each source's terms before collecting contents; 20 searches of 10 results, 100 approved reads | 20 × 2 + 100 × 1 = 140 | Verify claims, write original analysis, review quotations |
| Cleaning company's directory facts | Each directory permits collection; 30 ordinary HTML listings, four checks; no reviewers' profiles | 30 × 4 × 1 = 120 | Compare public business facts to approved master record |

Combined use is `501 + 160 + 100 + 140 + 120 = 1,021 credits`. It exceeds Free by 21 and fits Hobby's 5,000 credits at $19 monthly. For comparison, 500 JSON pages cost `500 × (1 + 4) = 2,500 credits`. These examples do not price a separate AI subscription; basic API collection does not require one.

## Permission record for each target

- [ ] Site owner and person authorized to approve collection identified.
- [ ] Public source URLs and allowed paths recorded.
- [ ] Terms URL, version/date, permitted purpose, and robots instructions reviewed.
- [ ] Ownership, applicable terms permission, or written authorization documented. Public visibility alone is insufficient.
- [ ] Allowed fields, frequency, pace, date range, and maximum pages agreed.
- [ ] Firecrawl's hosted processing, storage, any assistant provider, and reuse purpose disclosed where required.
- [ ] Personal information excluded or lawful basis and handling reviewed.
- [ ] Copyright and redistribution limits recorded; attribution does not replace permission.
- [ ] Retention/deletion date, review contact, withdrawal process, and stop conditions agreed.
- [ ] Login, paywall, CAPTCHA, IP block, or refusal triggers a stop and review. No circumvention.

## Permission request email

```text
Subject: Permission to collect a limited set of your public pages

Hello [name],

We would like to collect [exact URLs or paths] for [business purpose].
We propose [maximum pages] at [frequency and pace] during [dates],
keeping only [fields]. Firecrawl would process the pages on its hosted
service; [other approved provider] would receive [specified data].

We would retain the results until [date] and use them for [internal
analysis or precisely described publication]. We would link to your
original pages and follow your terms and robots instructions.

We will stop on an access restriction or your request. We will not
access private pages, use accounts, or work around a block.

Are you authorized to approve this use, and may we proceed on these
terms? Please identify any required API, license, exclusions, or limits.
We will wait for your written reply before starting.

Thank you,
[human name, business, contact details]
```

A person reviews and sends this email. Silence is not permission.

## Risk table

| Risk | Law or contract | How to lower it |
|---|---|---|
| Continuing after permission is revoked | CFAA and state computer crime laws | Stop, retain the notice, seek written permission and a lawyer's review |
| Using a permitted page for a forbidden purpose | Target terms and Firecrawl terms | Approve purpose, method, retention, and downstream use in writing |
| Overloading a site | CFAA damage provisions and other claims | Small scope, agreed pace, stop conditions, logs |
| Collecting personal data unnecessarily | Applicable privacy laws, including CCPA where covered | Minimize fields, assess coverage and exclusions, limit retention and vendors |
| Republishing copyrighted material | Copyright rights and fair use | Review licenses, quote only as justified, cite sources, obtain counsel for close calls |
| Operating a modified covered service without the required source offer | AGPL section 13 and distribution duties | Inventory components, preserve notices, provide required corresponding source |
| Unexpected spending | Subscription and overage terms | Explicit limits, per-key caps, no blank overage limit, named buyer |
| Wrong or hostile page content reaches an assistant | Business accuracy and security responsibility | Treat output as untrusted; person approves facts and actions |

The CFAA is not a blanket ban on public-page collection. Van Buren narrowed one access theory; hiQ's public-page preliminary injunction did not eliminate contract liability, and the dispute later settled. Power Ventures involved written revocation and IP barriers; its opinion says an IP block alone is insufficient without more. Our stop-on-denial rule is an operating safeguard, not a definitive legal finding. Ask a lawyer licensed where you operate.

## AGPL and self-hosting checklist

- [ ] Identify covered components. The root/core is AGPL-3.0; separately checked Python, JavaScript, Elixir, and Ruby SDK license files are MIT. The README's reference to some MIT UI components is not a blanket core exception.
- [ ] Read GNU AGPL section 13: a modified covered version offered over a network must prominently offer its users corresponding source at no charge. Review separate distribution obligations in sections 5 and 6.
- [ ] Preserve required notices and record modifications. Have a license reviewer assess product integration; merely using an MIT client does not relicense the backend.
- [ ] Have IT assess the self-host guide's Git, Docker, Docker Compose v2, and curl prerequisites. Its evaluation stack disables authentication and is not ready for exposure to an untrusted network.
- [ ] Provide authentication, network restrictions, encrypted connections, durable storage, backups, resource sizing, monitoring, and an upgrade/rollback owner before production use.
- [ ] Check which Cloud features are missing and which optional providers would receive data. Self hosting alone does not prove that every request stays inside your business.
- [ ] Budget actual infrastructure and labor. An owned server may avoid new rental cost but still needs maintenance. AWS Lightsail listed a Linux/Unix public IPv4 server with 4 GB memory, 2 virtual processors, and 80 GB disk for $24/month on the read date. That is a price comparison, not a tested Firecrawl capacity recommendation. The self-host guide supplies no verified universal minimum size.
- [ ] Use `server + backup/storage + external providers + IT hours × actual hourly cost` as the worksheet. Do not label labor free.

## Sources and read times

All reads are November 3, 2026 UTC. California and settlement citations use supplied home-browser excerpts reviewed at 21:39. The article contains fuller case qualifications and source notes.

- [Main README](https://github.com/firecrawl/firecrawl#readme), 21:34: commands, MCP configuration, account setup, n8n/Zapier links, responsibility and robots statements.
- [Pricing](https://www.firecrawl.dev/pricing), 21:34 and browser 21:36; [billing](https://docs.firecrawl.dev/billing), 21:35: prices, credits, overage and rollover. [Map](https://docs.firecrawl.dev/features/map), [Search](https://docs.firecrawl.dev/features/search), [Scrape](https://docs.firecrawl.dev/features/scrape), [Agent](https://docs.firecrawl.dev/features/agent), [Monitor](https://docs.firecrawl.dev/features/monitoring), and [change tracking](https://docs.firecrawl.dev/features/change-tracking), 21:35: feature charges and limitations.
- [Crawl reference](https://docs.firecrawl.dev/api-reference/endpoint/crawl-post), [Scrape reference](https://docs.firecrawl.dev/api-reference/endpoint/scrape), and [local MCP](https://docs.firecrawl.dev/mcp-server/local), 21:35: settings and requirements.
- [Interact](https://docs.firecrawl.dev/features/interact), 21:43: code-only and AI-prompt prices, minimum session charge, and separate initial scrape cost.
- [Terms of Service](https://www.firecrawl.dev/terms-of-service) and [privacy policy](https://www.firecrawl.dev/privacy-policy), 21:35: commercial authorization, prohibited uses, responsibility, hosted data and retention. A separate acceptable-use document was not independently verified.
- [Self-host guide](https://docs.firecrawl.dev/contributing/self-host), 21:34 to 21:35; [Lightsail pricing](https://aws.amazon.com/lightsail/pricing/), 21:37: operations and server rental comparison.
- [Core license](https://github.com/firecrawl/firecrawl/blob/main/LICENSE), 21:34; [Python](https://github.com/firecrawl/firecrawl/blob/main/apps/python-sdk/LICENSE), [JavaScript](https://github.com/firecrawl/firecrawl/blob/main/apps/js-sdk/LICENSE), [Elixir](https://github.com/firecrawl/firecrawl/blob/main/apps/elixir-sdk/LICENSE), and [Ruby](https://github.com/firecrawl/firecrawl/blob/main/apps/ruby-sdk/LICENSE) licenses, 21:35; [GNU AGPL](https://www.gnu.org/licenses/agpl-3.0.en.html#section13), 21:35: license boundary.
- [CFAA](https://www.law.cornell.edu/uscode/text/18/1030), [Van Buren](https://www.supremecourt.gov/opinions/20pdf/19-783_k53l.pdf), [hiQ appeal](https://cdn.ca9.uscourts.gov/datastore/opinions/2022/04/18/17-16783.pdf), [hiQ contract order](https://storage.courtlistener.com/recap/gov.uscourts.cand.312704/gov.uscourts.cand.312704.404.0.pdf), and [Power Ventures](https://cdn.ca9.uscourts.gov/datastore/opinions/2016/12/09/13-17102.pdf), 21:34; [hiQ settlement report](https://newmedialaw.proskauer.com/2022/12/08/hiq-and-linkedin-reach-proposed-settlement-in-landmark-scraping-case/), excerpt reviewed 21:39: access and contract risk.
- [RFC 9309](https://www.rfc-editor.org/rfc/rfc9309), [CCPA overview](https://oag.ca.gov/privacy/ccpa), and [copyright § 106](https://www.law.cornell.edu/uscode/text/17/106), 21:34; [copyright § 107](https://www.law.cornell.edu/uscode/text/17/107), 21:35; [California § 502](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?sectionNum=502.&lawCode=PEN), excerpt reviewed 21:39; [Texas § 33.02](https://statutes.capitol.texas.gov/?artSec=33.02&chapter=PE.33&code=PE&tab=2), browser 21:37: protocol, privacy, copyright, and state laws.

This kit is informational, not legal advice. Mentions of third parties are nominative fair use. No affiliation or endorsement is implied.