Free Models, No API Key, and a README That Refuses to Lie

The pitch is almost offensive in its simplicity: install one plugin into dsh — the DeepSeek harness — and a set of frontier models appears in your picker. No account, no API key, no quota dashboard, no credit card. Muse Spark 1.3, MiMo V2.6, and the rest, free, with no usage cap. That claim is currently circulating as short-form video — there are YouTube shorts titled things like “Free AI Models, No Signup or API Key” and “Free DeepSeek and Kimi models with no API key?” riding the repo’s appearance on GitHub trending — and the natural reaction of any experienced developer is to assume the catch is being hidden somewhere.

The repo’s own README is the most interesting rebuttal to that suspicion I’ve read in a while, because it hides nothing — including the parts where the project is just glue, the parts it hasn’t verified, and the parts where it previously shipped bugs that lied to users.

What it actually is

Strip away the settings pages and the usage dashboard, and dsh-our-free-model is a well-mannered client for someone else’s free tier. The upstream is a single source: OpenCode’s Zen gateway at opencode.ai. That lane is public and keyless by design — the plugin sends a literal public bearer token, identifies itself with client fingerprint headers, and the gateway meters free quota per session, blocks by region, and returns 429s when you push too hard. The plugin doesn’t unlock anything; it rides a lane OpenCode already leaves open, and its job is to make that lane behave like a normal model provider inside the harness.

That’s glue code, and the README is refreshingly upfront about the hierarchy: the free access is OpenCode’s product decision, the model catalog and quota policy belong to the upstream, and the plugin’s contribution is plumbing plus honesty. What elevates it above typical free-tier wrappers is how much of the plumbing turns out to be nontrivial, and how much of the honesty is structural rather than cosmetic.

The README as lab notebook

The document’s most unusual feature is its acceptance section, which records every claim alongside how it was verified — and distinguishes three tiers of evidence with a discipline most corporate QA departments don’t manage. An offline fake kernel test proves the code logic without touching the network. A real upstream test means the plugin genuinely hits the gateway but on a hand-built context. A real kernel test means the plugin was actually installed in dsh and clicked through in a browser. The README explicitly says the team got burned once by conflating these tiers, and the tables now label every row.

It goes further. When new assertions were added, the authors ran mutation testing — reverting each of nine fixes in a temporary copy and confirming the corresponding suite went red, nine for nine. When a release manifest drifted from the actual files (six files, more than the two an issue had reported), they traced the recurrence to Windows editors writing CRLF into a working tree that git status reports as clean, then added a standing assertion that converts all twenty-six files to CRLF and re-checks. When three test suites turned out to be “looking like tests” without testing anything — one had never sent a single request, another compared counts from two different populations, a third used a hardcoded port that silently hung when colliding with another process — the README documents the failure modes in detail rather than quietly fixing them.

This is the genuinely special part of the project. Free-model wrappers are a commodity; a maintainer who writes “the tests that looked like tests” and explains exactly how they deceived him is not.

Three findings worth stealing

Beyond the culture, the repo contains technical findings that apply to anyone building against OpenAI-compatible gateways.

First: the reasoning-effort field is a no-op on this lane. The authors sampled it repeatedly across three nominal effort levels and found the thinking-token counts statistically indistinguishable. A control that does nothing is worse than no control, so they implemented effort as hard output-token budgets — 2,048, 8,192, and the model’s ceiling for Light, Balanced, and Deep — with the budget doubled for models whose thinking can’t be disabled, since thinking and visible output share one allowance. The settings page prints the actual number each tier will enforce per model. The logged thinking tokens rise monotonically with the tier, which is more than most effort sliders can claim.

Second: trust the body, not the header. Under load, the gateway returns complete SSE streams labeled with a JSON content-type. The old code believed the header, parsed the stream as a single JSON document, failed, and — worse — let the availability prober mark a perfectly working model as unroutable, removing it from the picker for a cycle. The fix sniffs the first chunk (up to four kilobytes) by shape and feeds the already-read bytes back into the stream, losing nothing in latency. The README’s framing is exact: an error object carrying status 200 shouldn’t be allowed to fire a working model.

Third: statistics that refuse to flatter. An earlier version reported 2,941 tokens per second on a lane that actually delivered about forty. The cause wasn’t the gateway — packets arrived as genuine incremental delivery — but the numerator and denominator measured different time spans: 291 reasoning tokens that never streamed out at all were generated before the first visible token, and the timing window opened at that token. Dividing a whole completion by the seconds the answer took to land isn’t decode speed. The fix strips unstreamed reasoning tokens from the numerator, rejects windows too short to time, aggregates as total tokens over total seconds rather than averaging per-call rates (a single one-millisecond window once inflated a 26-call mean by three orders of magnitude), and shows a dash for models whose answers land in one or two big frames. A dashboard that displays a dash instead of a flattering number is a small act of engineering ethics.

There’s also a bounded recovery mechanism for the specific failure where a long-thinking turn ends with only thinking, no body, and the stream closes without a proper terminal frame. Rather than replay the turn, the plugin sends one additional request carrying the received thinking as checkpoint text, capped at two physical requests per logical turn, with time and token budgets and a refusal to recover turns that already produced body text or tool calls. It has worked once in real use on MiMo V2.6 Flash at Deep effort and failed once at the 480-second deadline — and the README says exactly that, noting other models haven’t been individually verified.

Where it sits in the free-API landscape

Context matters here, because 2026’s free-LLM-API market is genuinely crowded. NVIDIA’s NIM catalog offers 120-plus open-weight models through one key with no credit card, as one detailed guide explains — a shop window for NVIDIA’s enterprise product, but a real free tier. OpenRouter’s free tier runs 50 requests a day unfunded, rising to 1,000 after a ten-dollar credit purchase. Google AI Studio offers some of the highest free token throughput around, with a one-million-token context window at no cost. Comparisons of the major providers now read like consumer reports, complete with criteria — model quality, rate limits, latency, data policy, commercial terms.

Against that field, dsh-our-free-model’s differentiator is the absence of the signup step itself. Every other option requires an account and a key; this one requires literally nothing, because the underlying lane is public by construction. The trade is proportionate: you get open-weight models, not closed frontier ones; you get dev-and-test access, not production; and your prompts still leave your machine for someone else’s servers — the same four caveats every honest free-API guide names. The plugin’s contribution to that bargain is transparency about where the traffic goes: a dedicated section enumerates every outbound target — the Zen gateway for inference and model lists, the plugin’s own repo for announcements and update manifests, and three IP-geolocation services used solely to determine which region gate applies to you. No proxy pools, no middlemen, and a promise that any future source will be documented before the feature ships.

The surrounding ecosystem is not so tidy. The widely-circulated awesome-free-llm-apis list — a natural companion to this kind of project — had a commit in October 2026 removing a malicious security-audit workflow described as a credential stealer. That’s the ambient risk profile of the free-API space, and it makes the plugin’s own security posture look almost quaintly careful: the local OpenAI-compatible forwarding port binds loopback only and refuses routable addresses outright, keys live in a 0600 file compared with timing-safe equality, announcement HTML renders through a strict whitelist tested against XSS corpora, and the plugin’s HTTP routes sit behind the same trust fence as the kernel’s own API — a hole the authors found and fixed in their own prefix-priority routing.

The catches, stated plainly

The project’s dependence is structural: everything valuable about it is somebody else’s product decision. OpenCode could meter the lane, fingerprint harder, or shut it tomorrow, and the plugin’s only recourse — as its README admits — is to honestly remove models from the picker. “No usage cap” means no billing apparatus, not infinite throughput; the lane rate-limits per session and returns 429s, which the plugin surfaces as a temporary state rather than hiding. Some models are slow upstream — one recorded a first token over thirty seconds — and the dashboard says so rather than smoothing it over.

The trust model of in-app upgrades is conventional but worth naming: whoever can push to the repo can push arbitrary code to every installation, the same trust as installing any plugin update, with SHA-256 manifests guarding file integrity and nothing guarding intent. The source is plain JavaScript by necessity — anyone with the directory can read the gateway logic — and the README treats that as an inherent property of the distribution form rather than a problem obfuscation could solve. Region-gated models stay visible but quarantined in their own picker group, which is the right call: hiding them would make the region block indistinguishable from a bug.

Outlook

The open question is sustainability, and it isn’t the plugin’s to answer. Free lanes like this one exist because the operator wants a low-friction on-ramp; the plugin’s job is to be a good citizen of that lane — accurate availability probing, honest rate-limit reporting, no fake controls — and on the evidence of the README, it’s doing that job with more rigor than the assignment requires. The maintainers’ own bar is visible in the details: kernel quirks that wasted their debugging time (a retry policy that silently produces NaN backoff delays, a single interrupted tool call permanently poisoning a session) are documented for the next person writing a provider plugin, not hoarded.

If the lane survives, the interesting legacy won’t be the free models — those are OpenCode’s to give or take. It’ll be the artifact itself: a project whose acceptance criteria distinguish what was tested from what was assumed, whose dashboards prefer a dash to a lie, and whose author documents his own mistakes with the same care as his fixes. In a corner of the AI tooling world currently saturated with wrappers making maximal claims, that’s the rare thing.