fix(annotations): align firecrawl_search readOnlyHint with scrapeOptions.actions

[syf2211]

Summary

Set readOnlyHint: false on the full-surface firecrawl_search tool because it accepts scrapeOptions.actions (click, write, executeJavascript) that can mutate pages visited during search result scraping.

Motivation

Fixes #311

MCP clients that honor readOnlyHint: true may skip confirmation prompts for tools that can drive browser interactions. The full firecrawl_search schema includes scrapeOptions.actions, but the annotation claimed read-only — inconsistent with firecrawl_scrape and other tools that expose the same action surface.

Changes

• Change readOnlyHint from true to false on the main firecrawl_search registration in src/index.ts
• Leave the search-profile firecrawl_search variant at readOnlyHint: true (it rejects scrapeOptions via a strict schema)
• Add regression assertions in tests/mcp-smoke.test.mjs and tests/mcp-search-profile.test.mjs

Tests

npm run build
node --test tests/mcp-smoke.test.mjs -t "local keyless stdio"
node --test tests/mcp-search-profile.test.mjs

• local keyless stdio omits feedback tools... — passes, asserts full-surface readOnlyHint === false
• All 22 mcp-search-profile tests — pass, including search-profile readOnlyHint === true

Note: three pre-existing failures in mcp-smoke.test.mjs on this environment (keyless tool filtering / deprecated extract registration) are unrelated to this change.

Notes

• Reviewed with composer-2.5: APPROVE
• Optional follow-up: mirror firecrawl_scrape by using readOnlyHint: SAFE_MODE when cloud safe mode strips actions from the schema

---

Summary by cubic

Aligns the firecrawl_search annotation with its behavior by setting readOnlyHint to false when the tool accepts scrapeOptions.actions. Previously it claimed read-only, which let MCP clients skip confirmation for actions that can mutate visited pages.

• Change: Update src/index.ts to set readOnlyHint: false for the full-surface firecrawl_search. Keep the search-profile variant at readOnlyHint: true because its schema rejects scrapeOptions.
• Tests: Add assertions in tests/mcp-smoke.test.mjs (expects false) and tests/mcp-search-profile.test.mjs (expects true) to prevent regressions.
• Impact: No schema/API changes. MCP clients may now prompt for confirmation when using the full-surface tool. No migration required.

^{Written for commit 9e53c85. Summary will update on new commits.}

[cubic-dev-ai]

No issues found across 3 files

<sub>Auto-approved: Tightly scoped annotation fix: readOnlyHint now reflects that firecrawl_search accepts scrapeOptions.actions, with regression tests pinning both variants. No schema or behavior change; simple metadata correction with no human-owned tradeoff.

Re-trigger cubic</sub>