Summary

• Firecrawl, zero-setup. Adds a keyless firecrawl-free provider for both web_search and web_fetch — clean Firecrawl results and page scrapes with no API key, no account. Previously Firecrawl was keyed-only.
• Now possible because Firecrawl shipped a keyless tier (/v2/search and /v2/scrape answer anonymously).
• Opt-in, not default. Selectable via tools.web.{search,fetch}.provider: firecrawl-free (or onboarding). autoDetectOrder keeps it behind the existing keyless defaults, so a fresh install's behavior is unchanged. No default/auto-selection change.
• No paid-credential coupling. The keyless providers advertise an empty credentialPath and requiresCredential: false, so secret resolution never targets the paid Firecrawl key (this adds genuine keyless support to the web-fetch provider contract, matching web-search).
• Additive and safe: the keyed firecrawl providers and firecrawl_search / firecrawl_scrape tools are unchanged; any configured keyed provider still wins; no new config keys.

What should reviewers focus on?

• The keyless path in firecrawl-client.ts (no Authorization, openclaw-firecrawl UA, key optional); keyless credential handling (empty credentialPath, requiresCredential: false); and provider registration in the public-artifact barrels + manifest.

Linked context

Was this requested by a maintainer or owner? No — external contribution.

Real behavior proof (required for external PRs)

• Behavior addressed: keyless web_search and web_fetch return live results with no API key.
• Real environment tested: macOS, built from source; live calls to api.firecrawl.dev/v2/search and /v2/scrape with no Authorization header.
• Exact steps or command run after this patch: pnpm build, then exercised the real provider path keyless — runFirecrawlSearch({ keyless: true, query: "openclaw github" }) and runFirecrawlScrape({ keyless: true, url: "https://example.com" }) — plus the firecrawl-tools tests and the web-fetch provider contract suite.
• Evidence after fix:
  • search → 3 real results (openclaw.ai, github, reddit), provider: firecrawl-free, 200, no key
  • scrape → # Example Domain markdown, 200, no key
  • default selection: with no keys, the auto-detect sort picks firecrawl-free for both search and fetch
• Observed result after fix: keyless requests resolve to firecrawl-free and return real, safety-wrapped content.
• What was not tested: the agent/LLM deciding to invoke the tool (needs a configured model — orthogonal to this change); cross-OS beyond macOS.
• Proof limitations or environment constraints: free keyless results vary over time; per-Firecrawl rate limits apply.
• Before evidence: keyless requests returned 401; the providers threw "needs a Firecrawl API key".

Tests and validation

• firecrawl-tools unit tests (35 passed), web-fetch provider contract suite (3 passed incl. firecrawl-free), pnpm build, live keyless search/scrape.
• Regression: keyless path asserts no Authorization + the openclaw-firecrawl UA; registration contract updated for the new firecrawl-free search + fetch ids.

Risk checklist

• User-visible behavior change? No default change — firecrawl-free is opt-in (selectable), not auto-selected; the existing keyless default is unchanged.
• Config / migration change? No — no new config; reuses tools.web.{search,fetch}.provider; registered as non-migrated in doctor.
• Security / network change? Yes, only when explicitly selected — anonymous outbound to api.firecrawl.dev (already an allowed host), via existing web-tools guards; no credentials sent; keyless providers never target the paid credential path.
• Highest risk + mitigation: a new external-network path to Firecrawl when a user opts in. Mitigated by being opt-in (no default change), keyless (no credentials), and routed through existing web-tools endpoint guards.

Current review state

• Next action: maintainer review, with attention to the keyless-default change.
• Outstanding: full-app (TUI/agent) selection proof pending a configured model; provider-level live proof included above.