Scope keyless-unavailable tool pointers to authenticated sessions (stacked on #436)

[rakshith48]

Stacked on #436.

Problem

Keyless sessions (hosted /v2/mcp without auth, and stdio without a key) list only firecrawl_search, firecrawl_scrape and firecrawl_parse. FastMCP serves one static description per tool, so keyless agents read the same search and scrape copy as authenticated ones, which tells them to:

• call firecrawl_feedback after an Alexandria task (search and scrape),
• read contracts with firecrawl_find_tools (search),
• use Alexandria mode (scrape),
• reach for firecrawl_map / firecrawl_crawl (scrape).

None of those tools is listed for them. On main the feedback sentences start at characters 4,589 (search) and 3,306 (scrape), past Claude Code's 2,048-character cut, so only Codex saw them. #436 moves them to 1,146 and 1,399, so keyless Claude Code agents would start seeing them too.

Fix

• Search: "On an authenticated session, tool matches are discovery … or read its full contract with firecrawl_find_tools; after an Alexandria task, call firecrawl_feedback …" plus "Keyless sessions return web results only."
• Scrape: "Alexandria mode, on an authenticated session with Alexandria access: … and its results include a feedbackTool pointer …", and "on an authenticated session, firecrawl_map lists a site's URLs and firecrawl_crawl collects a set of pages."
• The scrape-first pointer and the "Authenticated search also returns…" lead were already scoped.

Per-session descriptions would need a FastMCP change (the tools/list handler returns tool.description as registered), so this scopes the wording instead.

Test

The keyless smoke test now fails if any sentence in a keyless-listed description names an unlisted firecrawl_* tool (research tools excepted) or Alexandria mode without saying it applies to authenticated sessions. It caught the map/crawl pointer, which predates #436. Suite 120/120. Descriptions stay under the cap: search 1,872, scrape 1,545.

🤖 Generated with Claude Code

---

Summary by cubic

Scopes tool descriptions for keyless sessions so unlisted tool references and Alexandria mode pointers only appear in authenticated-session copy.

• Search and scrape descriptions now qualify firecrawl_find_tools, firecrawl_feedback, firecrawl_map, firecrawl_crawl, and Alexandria mode as authenticated-session features, and search notes keyless sessions get no Alexandria matches in data.tools.
• The keyless smoke test now fails if any sentence in a keyless-listed description references an unlisted tool or Alexandria mode without an "authenticated" qualifier; it caught the existing map/crawl pointer.

^{Written for commit 5b6839d. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 2 files

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

[cubic-dev-ai]

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

<sub>Requires human review: This PR changes tool descriptions to scope unlisted tool references to authenticated sessions and strengthens a smoke test. It alters user-facing copy for keyless sessions and relies on prior unmerged changes, so human review is warranted.

Re-trigger cubic</sub>