Move Firecrawl API key from top-level config into Agents.Tools

Firecrawl is a tool used by agents (tracker mapping, third-party
assessor), so its configuration belongs under AgentsConfig rather than
as a standalone Config field. Adds AgentToolsConfig to hold agent tool
credentials and updates all config propagation consumers.

Signed-off-by: Émile Ré <emile@probo.com>

contrib/helm/charts/probo/templates/deployment.yaml

@@ -232,8 +232,8 @@ spec:
             - name: OPENAI_MAX_TOKENS
               value: {{ .Values.probo.openai.maxTokens | quote }}
             {{- end }}
-            # Firecrawl Integration
-            {{- if .Values.probo.firecrawl.apiKey }}
+            # Agent Tools
+            {{- if .Values.probo.agentTools.firecrawlApiKey }}
             - name: FIRECRAWL_API_KEY
               valueFrom:
                 secretKeyRef:

contrib/helm/charts/probo/templates/secret.yaml

@@ -35,9 +35,9 @@ stringData:
   openai-api-key: {{ .Values.probo.openai.apiKey | quote }}
   {{- end }}
 
-  # Optional Firecrawl API key
-  {{- if .Values.probo.firecrawl.apiKey }}
-  firecrawl-api-key: {{ .Values.probo.firecrawl.apiKey | quote }}
+  # Optional Firecrawl API key (agent tools)
+  {{- if .Values.probo.agentTools.firecrawlApiKey }}
+  firecrawl-api-key: {{ .Values.probo.agentTools.firecrawlApiKey | quote }}
   {{- end }}
 
   # Optional SAML secrets

contrib/helm/charts/probo/values-production.yaml.example

@@ -159,9 +159,9 @@ probo:
     modelName: "gpt-4o"
     maxTokens: 4096
 
-  # Firecrawl web search (optional, used by tracker mapping agent)
-  # firecrawl:
-  #   apiKey: "CHANGE_ME_FIRECRAWL_API_KEY"
+  # Agent tools (optional, shared across agents)
+  # agentTools:
+  #   firecrawlApiKey: "CHANGE_ME_FIRECRAWL_API_KEY"
 
   # Tracker mapping agent (optional, auto-links tracker patterns to vendors)
   # trackerMapping:

contrib/helm/charts/probo/values.yaml

@@ -257,9 +257,10 @@ probo:
     modelName: "gpt-4o"
     maxTokens: 4096
 
-  # Firecrawl web search integration (optional, used by tracker mapping agent)
-  firecrawl:
-    apiKey: ""
+  # Agent tools (optional, shared across agents)
+  agentTools:
+    # Firecrawl web search API key (used by tracker mapping and third-party assessor agents)
+    firecrawlApiKey: ""
 
   # Tracker mapping agent (optional, requires openai.apiKey or anthropic key)
   trackerMapping:

pkg/bootstrap/builder.go

@@ -176,9 +176,6 @@ func (b *Builder) Build() (*probodconfig.FullConfig, error) {
 					CacheTTL:       b.getEnvIntOrDefault("WEBHOOK_CACHE_TTL", 86400),
 				},
 			},
-			Firecrawl: probodconfig.FirecrawlConfig{
-				APIKey: b.getEnv("FIRECRAWL_API_KEY"),
-			},
 			Agents: probodconfig.AgentsConfig{
 				Providers: map[string]probodconfig.LLMProviderConfig{
 					"openai": {
@@ -214,6 +211,9 @@ func (b *Builder) Build() (*probodconfig.FullConfig, error) {
 					Temperature: b.getEnvFloatPtr("AGENT_TRACKER_MAPPING_TEMPERATURE"),
 					MaxTokens:   b.getEnvIntPtr("AGENT_TRACKER_MAPPING_MAX_TOKENS"),
 				},
+				Tools: probodconfig.AgentToolsConfig{
+					FirecrawlAPIKey: b.getEnv("FIRECRAWL_API_KEY"),
+				},
 			},
 			CustomDomains: probodconfig.CustomDomainsConfig{
 				RenewalInterval:   b.getEnvIntOrDefault("CUSTOM_DOMAINS_RENEWAL_INTERVAL", 3600),

pkg/bootstrap/builder_test.go

@@ -197,8 +197,8 @@ func TestBuilder_Build_Defaults(t *testing.T) {
 	assert.Equal(t, 5, cfg.Probod.Notifications.Webhook.SenderInterval)
 	assert.Equal(t, 86400, cfg.Probod.Notifications.Webhook.CacheTTL)
 
-	// Firecrawl — empty by default
-	assert.Empty(t, cfg.Probod.Firecrawl.APIKey)
+	// Agents tools — Firecrawl empty by default
+	assert.Empty(t, cfg.Probod.Agents.Tools.FirecrawlAPIKey)
 
 	// Agents config — default
 	assert.Equal(t, "openai", cfg.Probod.Agents.Default.Provider)
@@ -378,8 +378,8 @@ func TestBuilder_Build_CustomValues(t *testing.T) {
 	assert.Equal(t, "slack-signing-secret", cfg.Probod.Notifications.Slack.SigningSecret)
 	assert.Equal(t, 10, cfg.Probod.Notifications.Webhook.SenderInterval)
 	assert.Equal(t, 3600, cfg.Probod.Notifications.Webhook.CacheTTL)
-	// Firecrawl
-	assert.Equal(t, "fc-test-key", cfg.Probod.Firecrawl.APIKey)
+	// Agents tools — Firecrawl
+	assert.Equal(t, "fc-test-key", cfg.Probod.Agents.Tools.FirecrawlAPIKey)
 	// Agents — providers
 	assert.Equal(t, "openai", cfg.Probod.Agents.Providers["openai"].Type)
 	assert.Equal(t, "sk-test-key", cfg.Probod.Agents.Providers["openai"].APIKey)

pkg/probod/third_party_assessor.go

@@ -52,7 +52,7 @@ func (impl *Implm) buildThirdPartyAssessor(
 		Model:           agentCfg.ModelName,
 		MaxTokens:       maxTokens,
 		ChromeAddr:      impl.cfg.ChromeDPAddr,
-		FirecrawlAPIKey: impl.cfg.Firecrawl.APIKey,
+		FirecrawlAPIKey: impl.cfg.Agents.Tools.FirecrawlAPIKey,
 		Logger:          l.Named("third-party-assessor"),
 	}), nil
 }

pkg/probod/tracker_mapping.go

@@ -49,6 +49,6 @@ func (impl *Implm) buildTrackerMappingConfig(
 	return cookiebanner.TrackerMappingConfig{
 		LLMClient:       llmClient,
 		Model:           agentCfg.ModelName,
-		FirecrawlAPIKey: impl.cfg.Firecrawl.APIKey,
+		FirecrawlAPIKey: impl.cfg.Agents.Tools.FirecrawlAPIKey,
 	}, nil
 }

pkg/probodconfig/config.go

@@ -47,11 +47,6 @@ type (
 		TSAURL string `json:"tsa-url"`
 	}
 
-	// FirecrawlConfig contains Firecrawl web scraping API configuration.
-	FirecrawlConfig struct {
-		APIKey string `json:"api-key"`
-	}
-
 	// Config represents the probod application configuration.
 	Config struct {
 		BaseURL           string                  `json:"base-url"`
@@ -66,7 +61,6 @@ type (
 		Agents            AgentsConfig            `json:"llm"`
 		EvidenceDescriber EvidenceDescriberConfig `json:"evidence-describer"`
 		ChromeDPAddr      string                  `json:"chrome-dp-addr"`
-		Firecrawl         FirecrawlConfig         `json:"firecrawl"`
 		CustomDomains     CustomDomainsConfig     `json:"custom-domains"`
 		SCIMBridge        SCIMBridgeConfig        `json:"scim-bridge"`
 		ESign             ESignConfig             `json:"esign"`

pkg/probodconfig/llm_config.go

@@ -40,6 +40,12 @@ type (
 		MaxConcurrency int `json:"max-concurrency"`
 	}
 
+	// AgentToolsConfig holds API keys and settings for external tools
+	// that agents can use (web search, scraping, etc.).
+	AgentToolsConfig struct {
+		FirecrawlAPIKey string `json:"firecrawl-api-key"`
+	}
+
 	// AgentsConfig groups LLM provider credentials and per-agent model
 	// settings. Default is used as a fallback when an agent-specific field
 	// is zero-valued.
@@ -50,6 +56,7 @@ type (
 		EvidenceDescriber  LLMAgentConfig               `json:"evidence-describer"`
 		ThirdPartyAssessor LLMAgentConfig               `json:"third-party-assessor"`
 		TrackerMapping     LLMAgentConfig               `json:"tracker-mapping"`
+		Tools              AgentToolsConfig             `json:"tools"`
 	}
 )