One API covers search, scraping, crawling, and browser actions
Firecrawl puts five related jobs behind one service: web search, single-page scraping, URL mapping, site crawling, and browser interaction. A response can contain markdown, HTML, screenshots, structured JSON, links, images, or page metadata. That common shape is useful for an agent that must find a source and then extract it without switching between a search provider, browser runner, and HTML cleaner.
The hosted API is the shortest route into the product. Its README shows Python, JavaScript, Go, Java, Rust, Ruby, .NET, PHP, and Elixir clients, plus a CLI and an MCP server. A Claude Code skill is also available. Self-hosting serves a different buyer: someone willing to own the browser fleet, queues, database, network egress, and upgrades in exchange for infrastructure control.
What happened when we ran it
Our run used commit 9835405 in a fresh unprivileged Debian container with 3 CPUs, 8 GB of RAM, Node.js 22, and no secrets. The checkout contained 1,764 files, about 304,255 lines of source, and 51.3 MB before installation. From apps/api, pnpm installed 727 packages in 66 seconds and left 692 MB on disk.
The build failed with exit code 2 after 9 seconds. TypeScript could not resolve @mendable/firecrawl-rs or its type declarations. The same missing import appeared in sitemap handling and scraper code for documents, Fire-engine, PDFs, Playwright, attributes, images, links, metadata, and element removal. The log does not say whether that package needed generation, a separate download, or a different build entry point, so we cannot assign a cause beyond the unresolved module.
Vitest ran for 256 seconds and exited 1. Of 2,166 tests, 1,930 passed, 183 failed, and 53 were skipped. The summary counted 90 failed test files, 138 passed files, and 5 skipped files. Its final failures covered authenticated v0 search and crawl-status routes, crawl cancellation, and LLM extraction. One test reached its 120-second timeout. Those lines show several failing areas, but they do not establish one shared cause.
The repository has 31 CI workflow files, a Dockerfile, and monorepo workspaces. Our scan found no top-level tests directory, although the 2,166-test run plainly exercised a large suite under apps/api. A successful 66-second install is encouraging for contributors. The failed compiler step and 183 failed tests still mean this exact checkout did not pass clean-room development gates.
Hosted use avoids the self-host operating burden
A hosted trial needs a Firecrawl API key and a client call. Search can return page content with results, while crawl and batch operations use job IDs that the SDKs poll. Browser interaction can click, type, wait, scroll, and expose a CDP connection. This is enough surface area to test extraction quality on your own troublesome pages before making any infrastructure decision.
Release v2.11.0, published June 19, 2026, added PII redaction, a deterministic JSON format, broader video discovery, CDP access, and monitor changes. The README also says the cloud service contains features beyond the open-source edition. Check the exact endpoint you need against the self-host documentation before treating a hosted example as a promise about the community deployment.
The default Compose stack needs security and persistence work
The checked-in Compose baseline runs the Firecrawl API and workers, Playwright, Redis, RabbitMQ, and NuQ PostgreSQL. FoundationDB is an optional queue backend. Only port 3002 is published by default, and the guide recommends keeping the NuQ PostgreSQL queue until an operator intentionally chooses FoundationDB. AI-dependent work needs OpenAI, an OpenAI-compatible endpoint, or Ollama. Proxy and search-provider settings are separate choices.
The guide is unusually direct about what remains unfinished for production. USE_DB_AUTHENTICATION=false is the recommended first-run setting, not a secure public deployment. Redis, RabbitMQ, and NuQ PostgreSQL have no persistent volumes in the root Compose file. Operators must add authentication, TLS, network policy, backups, recovery tests, monitoring, resource limits, scaling rules, and rollback procedures before exposing the API or trusting jobs to survive service replacement.
Two open issues show why callers must verify output
Issue 4375 documents a self-hosted /v2/search path that can hit a malformed DuckDuckGo result URL, log an internal error, then answer HTTP 200 with success: true and an empty result. A caller cannot distinguish that failure from a legitimate search with no matches. The report says using a SearXNG endpoint avoids that path, but applications should still alert on suspicious empty responses instead of treating the status field as sufficient evidence.
Issue 4047 reports Fire-engine decoding every response as UTF-8. Pages served as Shift_JIS, EUC-KR, GBK, Windows-1251, or ISO-8859 can therefore reach markdown with damaged characters. Issue 4393 describes a different class of drift: onlyCleanContent exists in server schemas but was absent from 9 SDKs and the OpenAPI description, allowing the Python client to discard the option without warning. Multilingual or schema-sensitive pipelines need fixtures that compare requested options with returned content.
August activity is current despite the June release
GitHub recorded 172,982 stars, 75 open issues, and 555 open issues and pull requests combined when we fetched the repository on August 27, 2026. The last push was also August 27. Issue 4426 was opened that day, and issue 3782 received an update, so current activity is visible in both code and issue work. Release v2.11.0 is older than the latest push, which is not evidence of abandonment.
Firecrawl earns a hosted trial when one API can replace several web-data components. The 727-package install completed, but the 9-second build failure and 183 failed tests make the source route a conditional choice. Require a clean build of the exact tag, run the relevant E2E routes with your providers, and test persistence and authentication before a self-hosted instance carries production traffic.