Firecrawl Monitor Skill Security Audit

66- Each check uses credits for its underlying scrape, crawl, or search, plus optional judging. See [Monitoring pricing](https://docs.firecrawl.dev/features/monitoring#pricing).67- Minimum schedule interval is **5 minutes**. Monitoring is **not available for zero-data-retention teams**.68- **Prefer one monitor over repeated one-off scrapes** whenever the user wants the same URL checked more than once.

71- **`firecrawl monitor run <id>`** triggers a check immediately — useful for smoke-testing a monitor right after creating it.72- **`--retention-days`** controls how long snapshots are kept for diffing. Lower it for high-frequency monitors to save storage.73- **External email recipients must opt in.** First time they're added, Firecrawl sends a confirmation email and they only receive alerts after they confirm. Team-owned addresses are auto-confirmed. Once a recipient unsubscribes, they must be re-added by the owner for a fresh confirmation email.

4546Each changed page in the check response then carries a per-field diff plus a snapshot of the current full extraction:47

72- **`--retention-days`** controls how long snapshots are kept for diffing. Lower it for high-frequency monitors to save storage.73- **External email recipients must opt in.** First time they're added, Firecrawl sends a confirmation email and they only receive alerts after they confirm. Team-owned addresses are auto-confirmed. Once a recipient unsubscribes, they must be re-added by the owner for a fresh confirmation email.74- **On HTTP 429 / rate-limit errors, back off once**: wait ~30s and retry once. If it persists, stop, report the rate limit as the blocking reason, and delete any monitors created for this task. Never retry in a loop.

45By default monitors diff each page's markdown and return a unified text diff. JSON-mode change tracking returns keyed per-field diffs instead — e.g. `plans[0].price: "$19/mo" → "$24/mo"` — which drop straight into a Slack message, CI step, or internal tool. The CLI flags don't cover this — pass a JSON body via positional file or piped stdin:6

4  Alert by webhook/email on web changes — use for "monitor/watch/track/alert me when": recurring checks on known URLs (prefer over repeated one-off scrapes) or web-wide watches for new results (queries + goal).5allowed-tools:6  - Bash(firecrawl *)7  - Bash(npx firecrawl-cli *)8---

1112Detect when content on a website changes and get notified by webhook or email. Firecrawl handles fetching, diffing, judging, and notifying server-side. Each page in a check is labeled `same`, `new`, `changed`, `removed`, or `error`.13

10- Restate any scope they mentioned: top N, price, role type, region, company, topic, status, or a specific entity.11- Add an `Ignore ...` sentence **only** for intent-specific exclusions (e.g. points/comments for rankings, marketing copy for pricing, general company-page updates for job listings). The judge already handles generic noise — whitespace, casing, punctuation, encoding, formatting-only changes, request/session IDs, cache busters, tracking params, generic metadata, and unrelated page chrome — so leave those out.12- Include only page-specific sections, entities, thresholds, exclusions, or business rules the user actually mentioned.13- If the user is vague or asks for "any change", keep the goal broad with no exclusions. If the user mentions noise they do not care about, include that explicitly.14

6566- Each check uses credits for its underlying scrape, crawl, or search, plus optional judging. See [Monitoring pricing](https://docs.firecrawl.dev/features/monitoring#pricing).67- Minimum schedule interval is **5 minutes**. Monitoring is **not available for zero-data-retention teams**.68- **Prefer one monitor over repeated one-off scrapes** whenever the user wants the same URL checked more than once.

68- **Prefer one monitor over repeated one-off scrapes** whenever the user wants the same URL checked more than once.69- **Silence temporarily with `update --state paused`**; reserve `delete` for monitors that are permanently done. (`--state` is an update flag; `--status` is the global CLI status flag.)70- **Filter check pages with `--page-status changed`** (or `new`, `removed`, `error`) to skip the noise from `same` pages.

74- **On HTTP 429 / rate-limit errors, back off once**: wait ~30s and retry once. If it persists, stop, report the rate limit as the blocking reason, and delete any monitors created for this task. Never retry in a loop.75- **Monitor-triggered scrapes default `maxAge` to `0`** — every check performs a fresh scrape unless `scrapeOptions.maxAge` is set explicitly in a JSON payload.76

67- Minimum schedule interval is **5 minutes**. Monitoring is **not available for zero-data-retention teams**.68- **Prefer one monitor over repeated one-off scrapes** whenever the user wants the same URL checked more than once.69- **Silence temporarily with `update --state paused`**; reserve `delete` for monitors that are permanently done. (`--state` is an update flag; `--status` is the global CLI status flag.)70- **Filter check pages with `--page-status changed`** (or `new`, `removed`, `error`) to skip the noise from `same` pages.