RFC: deterministic policy layer for agent tool calls (credit caps, interact egress, self-host SSRF)

The observation

Firecrawl sits exactly where prompt injection enters agents: scraped page content becomes LLM context. Three concrete risks for key holders and self-hosters:

1. Credit burn: an injected agent loop calling /v2/crawl or /v2/agent (effort=high) with large limits spends real money on the user's key. No per-session deterministic budget exists client-side.
2. Interact exfil: the interact browser can click/scroll/write. A poisoned page can steer writes that type sensitive values into attacker-controlled forms.
3. Self-host SSRF: scrape/crawl targets like 169.254.169.254 or RFC1918 ranges on self-hosted deployments.

Proposal (optional, default-off)

A deterministic pre-call policy hook (client SDK / MCP server side):

1. Per-session credit + request caps across crawl/agent/interact (fail-closed budget).
2. URL/egress allowlist + private-IP/metadata blocklist for interact navigation and scrape targets (self-host).
3. Signed receipts for blocked calls for audit. Shadow mode default; hard blocks via flag; zero behavior change when off.

Question for maintainers

Interest in this as an optional hardening layer? Happy to contribute implementation + tests if welcome. (Hardening proposal, not a vuln disclosure — sensitive details via SECURITY.md.)