36 search engines, zero API keys, one DeepSeek Harness plugin

What it does

It’s a plugin for DeepSeek Harness (dsh) that registers itself as the web_search provider via the official WebSearchProvider seam. The motivation is specific: dsh’s built-in search requires DEEPSEEK_API_KEY, so third-party model users either get no search at all, or get silently billed through their DeepSeek account. This plugin offers 36 engines — DuckDuckGo, Bing, SearXNG, Baidu, Zhihu, arXiv, and many more — with a default fallback chain covering 28 of them, so a search never just fails.

The interesting bit

The failure handling is unusually thoughtful for glue code: quota/auth errors cool down that engine for the session, bot-walls cool down the whole HTML-SCRAPER family for 10 minutes, timeouts retry once, and parse failures don’t cool down anything. Multi-key rotation is per-key, cooldowns persist to disk, and a diagnostics panel tells you exactly why each engine is currently unavailable. Someone got rate-limited one too many times and turned it into engineering.

Key highlights

• Zero-cost engines work with no key or registration; paid ones (Exa, Tavily, etc.) still get tried since several offer keyless free tiers
• Multi Search mode fans out all engines in the query’s language pool concurrently, dedupes by eTLD+1, with a shared 30-second budget
• Beyond search: web_fetch with SSRF protection, platform search (GitHub, Reddit, HN, Bilibili…), 41 keyless vertical sources, and a research tool that produces cited Markdown evidence packs
• Prompt-injection defense: untrusted web text wrapped in <untrusted-web-content> boundaries, snippets cleaned and truncated to 300 chars
• 5-minute LRU result cache (50 entries) to spare free engines from rate limits

Caveats

• The 5 HTML-SCRAPER engines (Baidu, 360, Sogou, WeChat, Toutiao) are off by default — they scrape pages, trigger captchas, and cool down your entire egress IP for 10 minutes when they do
• Multi mode multiplies quota consumption; the README says so itself
• cache_search needs Node ≥ 22.13 (or an experimental flag) for node:sqlite, otherwise it silently no-ops

Verdict

If you run DeepSeek Harness without an official key — or you’re tired of invisible billing when using third-party models — this is a genuinely useful fix. If you don’t use dsh at all, it’s a well-documented curiosity about how to build a resilient search abstraction.