# fastCRW vs Firecrawl MCP (slim)

> Firecrawl MCP scores 75 (BB) to fastCRW's 64.3 (B) for web search. Prices, MCP, x402, uptime and agent notes side by side.

- Full: https://www.anchorterminal.com/compare/crw-vs-firecrawl-mcp.md (~6,200 tokens) · this version ~2,930 tokens · JSON https://www.anchorterminal.com/compare/crw-vs-firecrawl-mcp.json · canonical https://www.anchorterminal.com/compare/crw-vs-firecrawl-mcp
- Index: https://www.anchorterminal.com/llms.txt · API: https://www.anchorterminal.com/api/v1/index.json · MCP: https://www.anchorterminal.com/mcp · Updated: 2026-11-07
- Licence: CC BY 4.0, credit Anchor Terminal and link this page (https://www.anchorterminal.com/terms/#data)

Firecrawl MCP scores 75 (BB) on agent readiness against fastCRW's 64.3 (B), and leads in 5 of 7 scored categories. fastCRW leads on maintenance & community. Both do web search.

- fastCRW: B 64.3, rank #478 of 1486 · https://www.anchorterminal.com/tools/crw.min.md
- Firecrawl MCP: BB 75, rank #72 of 1486 · https://www.anchorterminal.com/tools/firecrawl-mcp.min.md
- fastCRW, good for Agents that want Firecrawl-style scrape, crawl, map, search and extract at lower per-page cost, or a small self-hosted engine. Ahead on Maintenance & community, 93 against 87. Also Free to start without a card; No incidents deducted, where Firecrawl MCP loses 3 points for them.
- Firecrawl MCP, good for Agents that need the whole pipeline (find URLs, scrape to markdown, crawl, monitor) from one server, and for trying without an account. Ahead on Reliability, 78 against 50; Security & auth, 70 against 40; Payments & pricing, 50 against 35; Transparency & trust, 75 against 60. Also Agent-ready, a grade of BB or better.

| Category | fastCRW | Firecrawl MCP |
| --- | --- | --- |
| Reliability (16%) | 50 | 78 |
| Performance (10%) | pending | pending |
| Schema & documentation (13%) | 91 | 91 |
| Agent ergonomics (13%) | 91 | 92 |
| Security & auth (14%) | 40 | 70 |
| Payments & pricing (10%) | 35 | 50 |
| Task success (10%) | pending | pending |
| Maintenance & community (7%) | 93 | 87 |
| Transparency & trust (7%) | 60 | 75 |

| Fact (where they differ) | fastCRW | Firecrawl MCP |
| --- | --- | --- |
| Kind | HTTP API | MCP server |
| Vendor | Nanofy OÜ | Firecrawl (Mendable) |
| Hosted endpoint | `https://fastcrw.com/mcp` | `https://mcp.firecrawl.dev/v2/mcp` |
| Transports | stdio, Streamable HTTP | stdio, Streamable HTTP, SSE (legacy) |
| Licence | AGPL-3.0 | MIT |
| Tools exposed | 11 | 27 |
| MCP registry | `io.github.fastcrw/crw` | `io.github.firecrawl/firecrawl-mcp-server` |
| Last release | 2026-11-04 | 2026-10-27 |
| Terms last updated | 2026-04-04 | 2024-11-05 |
| Privacy policy last updated | no date given | 2024-12-26 |
| Terms restrict automated access | yes | not found in the text |
| Terms restrict benchmarking | yes | not found in the text |
| Terms or service can change without notice | not found in the text | yes |
| Arbitration or class-action waiver | not found in the text | yes |
| Popularity | 1.2k stars, 881 npm/wk | 7.5k stars, 29k npm/wk |
| Agent reviews | none | 3.5/5 (8) |

Why the edge:
- Security & auth, Firecrawl MCP +30: fastCRW 40 (The hosted MCP server publishes RFC 9728 metadata naming its own authorisation server, with PKCE S256, dynamic client registration and one scope, `mcp:tools`, and the API takes revocable Bearer keys from the dashboard. No key scopes or second scope found (22). The authentication page documents fastcrw.com/mcp/<API_KEY> as a way in, a key in the URL path, so less 10 (12 of 30). Tools mostly read, and data-source calls check approvals, but there is no read-only key or confirmation step for monitors (8 of 20). Managed LLM extraction, summaries and answers wrap scraped text in a nonce fence (crates/crw-extract/src/untrusted.rs), and the hardening guide treats pages as untrusted, but the MCP docs give agents no guidance on scraped content (7 of 15). Each response reports `creditsUsed`; no per-call log in the docs (5 of 15). SECURITY.md names security@fastcrw.com and GitHub private reporting with a 48-hour acknowledgement, and CI runs CodeQL and OpenSSF Scorecard. security.txt answers 404, and no bounty or certification found (8 of 20). 12 + 8 + 7 + 5 + 8 = 40.); Firecrawl MCP 70 (OAuth on the hosted endpoint `/v2/mcp-oauth`, a separate OAuth identity for the search-only endpoint, and plain revocable keys as `Authorization: Bearer`. Keys locked to endpoints and formats, and IP allowlists, are Enterprise only (25 of 30). The README says never to put a key in the server URL. 3.29.1 removed the credential-in-path route from the repository's service image, and it was never documented as an option, so no deduction. 3.36.0 checks Host and Origin in local HTTP mode against DNS rebinding. Keyless and search-only surfaces limit what a session can do, write tools carry destructiveHint, and Alexandria provider terms need explicit user consent and `confirmed: true` (18 of 20). Retained Alexandria results tell the model that source content is data, not instructions, and Enterprise Threat Protection blocks risky URLs, off by default. The API's opt-in `checkPromptInjection` classifier is now a top-level scrape option for any format, markdown included, and for crawl, search and monitors (+4 credits, 403 `SCRAPE_PROMPT_INJECTION_DETECTED`). The MCP tool schemas still don't expose it, so an agent using this server can't turn it on (8 of 15). firecrawl_credit_usage shows spend, by endpoint and by day since 3.34.0, but its description says it can't attribute single jobs, URLs or MCP clients, and we found no per-call log for operators (5 of 15). SOC 2 Type II on the Enterprise page, and security.txt valid to 10 June 2027 with a Bugcrowd vulnerability disclosure programme, re-read on 1 November. CVE-2026-116066 (High in GitHub's unreviewed database, published 25 October), a DNS-rebinding SSRF in the Firecrawl API's Playwright service before 2.11.586, was fixed in a public commit on 21 October that cites issue #5256. No bug bounty found (14 of 20).)
- Reliability, Firecrawl MCP +28: fastCRW 50 (Graded on the hosted lines, for the hosted API and MCP server an agent would call; the self-hosted engine would read higher on the local lines. fastcrw.com/status is a first-party page with a live health check and a 99.9% monthly uptime objective, but no components with history (10 of 20). It lists no incidents and keeps no history we could read (5). Concurrency per plan is published, 3 on Free to 150 on Scale, while the request-rate guard above it is deliberately unpublished (12 of 15). The rate-limits page documents Retry-After and X-RateLimit headers, gives exponential backoff code, and separates 429 (retry) from 402 (stop). No idempotency keys for crawl, extract or monitor starts (13 of 15). Pricing mentions an SLA only as 'Premier + SLA' on Enterprise, with no terms, and the terms promise no uptime (0). The hosted service is sold on paid plans with no beta label, though the engine is at 0.41.0 (10). 10 + 5 + 12 + 13 + 0 + 10 = 50.); Firecrawl MCP 78 (Better Stack status page at status.firecrawl.dev with history (20). Four incidents in the 90 days to 1 November 2026, all partial degradations of api.firecrawl.dev, the longest 56 minutes on the /interact `prompt` field on 27 August (06:00 to 06:56 UTC in the feed) and the others 7, 16 and 46 minutes, with none after 15 September. The 20 July /interact incident has left the window (20). Rate limits published per plan and endpoint, from 10 scrapes a minute on Free to 10,000 on Scale, plus concurrent browsers and a per-IP daily cap for keyless use, re-read on 1 November (15). The Errors reference, linked from the rate-limit page, says 429s carry `Retry-After` when available, marks every error retryable or not, and gives backoff advice per code. No idempotency keys for calls that start crawl, agent or monitor jobs (13 of 15). SLA on Enterprise only, per the pricing page, with no terms published (0). GA (10). 20 + 20 + 15 + 13 + 0 + 10 = 78.)
- Payments & pricing, Firecrawl MCP +15: fastCRW 35 (No x402, MPP or L402 (0). Plans are public with credit costs per operation and top-up prices per block of credits, $9 per 1,000 on Hobby down to $299 per 500,000 on Scale, but top-ups need a plan, so between plan-only and per-unit (15 of 20). 500 one-off credits with no card, plus up to 500 from onboarding tasks (20). Hosted keys need a person to sign up in a browser; the free self-hosted engine runs with no account but isn't the graded surface (0). 0 + 15 + 20 + 0 = 35.); Firecrawl MCP 50 (No x402, MPP or L402 in the README, pricing page or agent onboarding guide, re-read on 1 November (0). Plans are public with per-endpoint credit costs (1 a page, search 2 per 10 results, +4 for JSON formats), and $5 top-ups only on paid plans, so between plan-only and per-unit (15 of 20). Free plan with 1,000 credits a month, no card (20). The hosted keyless endpoint gives scrape, search and parse with no signup, but crawl, map and agent need a key. The agent onboarding guide adds key routes through Stripe Projects and, on supported platforms, a WorkOS ID-JAG assertion, both of which start from a person's existing login (15 of 20).)
- Transparency & trust, Firecrawl MCP +15: fastCRW 60 (The engine and MCP server are AGPL-3.0 and the SDKs MIT, while the hosted control plane is closed under terms that name no legal entity (25 of 30). The terms say crawled data is handled transiently with zero data retention for approved accounts, but the privacy policy is undated, names no controller, gives no retention periods and mentions no DPA (10 of 30). The CHANGELOG flags breaking changes, deprecated v2 extract routes return a warning on every response, and the October 2026 402 change is dated in the docs, with no standing notice policy (10 of 20). Local data-source telemetry is disclosed with an opt-out. The privacy policy names Stripe, Google Analytics, Google Ads and an X pixel, but infrastructure and search providers are unnamed and no data location is given (8 of 20). 25 + 10 + 10 + 8 = 53.); Firecrawl MCP 75 (MIT (30). Zero data retention on Enterprise and a DPA from Standard up, but the privacy policy, re-read on 1 November, still dates from 26 December 2024, keeps personal data until you ask for deletion and gives no retention period for scraped content (12 of 30). The v1 endpoints are kept as legacy alongside v2 and the pricing change of 4 September 2026 was dated, but we found no deprecation policy (8 of 20). Data stored in the United States, and Stripe, PostHog, Crisp and Vercel Analytics are named, with no full subprocessor list (10 of 20).)
- Maintenance & community, fastCRW +6: fastCRW 93 (v0.41.0 on 4 November 2026, matching the registry and npm (30). 16 dated releases in the 90 days from 8 August, from 0.37.0 to 0.41.0 (20). Five open issues on 6 November, the newest from 1 November with five and two comments; the support page says email is answered within a business day. Reply authors weren't read (18 of 25). In the official MCP registry as io.github.fastcrw/crw, a GitHub-verified namespace, with current Python and TypeScript SDKs (15). CI runs cargo test on the workspace, with Dependabot, CodeQL and release-please (10). 30 + 20 + 18 + 15 + 10 = 93.); Firecrawl MCP 87 (firecrawl-mcp 3.36.0 on 27 October 2026, matching the registry (30). 43 version bumps in the 90 days from 3 August to 1 November, 12 of them since 17 October (20). Reported bugs from July and August (#325, #357, #373) show no fix in the repository's commits to 29 October. Issue states and reply times couldn't be read on 1 November (12 of 25, per the 1 October check). io.github.firecrawl/firecrawl-mcp-server at 3.36.0 in the official registry under a GitHub-verified namespace, published 27 October and marked latest (15). CI builds and tests on push and pull request to main, with npm trusted publishing and, since 23 October, a signed container image (10). 30 + 20 + 12 + 15 + 10 = 87.)