Illustration · planned interface This screen is a mockup of a graphical interface that does not exist yet. The shipped product is a command-line tool: one static binary that runs locally, with no account and no server. The finding below is a worked example, not a real scan.

Block High confidence kind: agpl-3.0.network-disclosure

AGPL-3.0 §13 network-use disclosure

npm:firecrawl@1.2.3 · AGPL-3.0-only · node_modules/firecrawl

Why this blocks you

You declared modified: true and network_exposed: true. AGPL-3.0 §13 attaches an obligation the moment both are true — and it attaches to the users of your service, not to the people you distribute to.

The clause

Notwithstanding any other provision of this License, if you modify the Program, your modified version must prominently offer all users interacting with it remotely through a computer network (if your version supports such interaction) the opportunity to receive the Corresponding Source of your version by providing access to the Corresponding Source from a network server at no charge, through some standard or customary means of facilitating copying of software. AGPL-3.0-only §13 · gnu.org/licenses/agpl-3.0.txt · retrieved 2026-09-20

Evidence

The finding resolves to a file and a line range. Nothing in this verdict is asserted without one — a test fails the build on any rendered finding that lacks a citation.

node_modules/firecrawl/LICENSE — lines 1–9 of 661

1  GNU AFFERO GENERAL PUBLIC LICENSE
2  Version 3, 19 November 2007
3
4  Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
5  Everyone is permitted to copy and distribute verbatim copies
6  of this license document, but changing it is not allowed.
7
8                              Preamble
9
…
508 13. Remote Network Interaction; Use with the GNU General Public License.

matched by: licence-text hash confidence: exact 661 lines total

Why it fired — the predicate trace

Every finding carries the predicate that produced it, evaluated against your declared intent. This is the whole reason the decision layer is pure: the same trace reproduces the same finding, forever.

corpus agpl-3.0.network-disclosure → and( use.modified == true, use.network_exposed == true )

intentuse.modified truefrom clearance.config.yml:22

use.network_exposed truefrom clearance.config.yml:23

resultand(true, true) TRUE → BLOCKHigh

The evaluation is three-valued, not boolean. If you had left territories undeclared, this same predicate would have evaluated to UNKNOWN rather than false — and the verdict would have been UNDETERMINED, not SHIP. That distinction is the product.

Suggested fix

Action: replace

Swap firecrawl for crawl4ai — Apache-2.0, same capability, no §13 obligation under your intent.

Fix confidence: medium capability match: crawler + extractor

firecrawlAGPL-3.0

crawl4aiApache-2.0

A fix is a suggestion, never an instruction. Its confidence is stated separately from the finding's — a HIGH finding can carry a MEDIUM fix, and the interface says so.

What would change this verdict

Set to false

use.modified→ SHIP CONDITIONAL

If you consume firecrawl unmodified, §13 does not attach. Note that patching a single vendored file counts as modification — the common misconception runs the other way.

Not network-exposed

use.network_exposed→ SHIP CONDITIONAL

A local CLI that never offers the software over a network is outside §13 — but the GPL distribution duties in §4–6 still apply if you ship the binary.

Changing intent to make a blocker disappear is recorded. The verdict carries the intent hash sha256:9f2b…, so a statement produced from a weakened intent is visibly produced from a weakened intent. That is deliberate.

How a MEDIUM finding reads differently

Ambiguity is not hidden in a tooltip. When confidence is below HIGH, the interface shows the exact text that is ambiguous, and the reading that was rejected.

Condition Medium confidence hey-gem weights · Community v2

A commercial gate applies above 1,000 monthly active users.

"Commercial use is permitted for organisations with fewer than one thousand (1,000) monthly active users, or for a period of twelve (12) months from first deployment, whichever is later." LICENSE.md §3.2

Reading taken

The gate applies at 1,000 MAU, and you declared 5,000.

Reading rejected

"whichever is later" could extend the window to 12 months regardless of MAU.

Both readings are shown because the clause genuinely supports both. Clearance does not pick the one that produces a tidier answer — and a MEDIUM finding can never block a build.

Informational findings based on the licence text as published on the date recorded in the corpus. This is not legal advice. Ambiguous clauses are flagged as ambiguous and carry a confidence level. Important decisions must be reviewed by a qualified professional.

Finding

idf_8a3c1e

kindagpl-3.0.network-disclosure

severityBLOCK

confidenceHIGH

layerL1 code licence

SARIF levelerror

Corpus entry

spdx_idAGPL-3.0-only

last_verified2026-09-20

obligations4

Open corpus entry

Is this verdict wrong?

Every verdict is challengeable. Report it, and the outcome is published — including when we were wrong.

The "we were wrong" process

Also affects

firecrawl-mcp Block

firecrawl-py Block

One licence can produce several findings. They are grouped by dependency id, not by scan order.