A web research engine for AI agents that refuses to ask for keys

What it does

DonSeTch is a local MCP server and CLI that lets AI agents fetch pages, run keyless web searches, and crawl sites from a single Rust binary. It converts pages into clean markdown, handles PDFs with OCR, and tries to stay invisible to bot detection without proxying the fetch layer. The entire three-tool surface is designed to squeeze into roughly 3.5k tokens of MCP context.

The interesting bit

Instead of faking a browser fingerprint, it drives Chrome’s BoringSSL natively so the TLS ClientHello emergently matches Chrome’s own. It also learns per-domain behavior—cookie lifetimes, warm starts, and routing—so repeat fetches often skip the headless browser entirely after the first visit.

Key highlights

• Keyless search across 10+ backends, fused by cross-engine consensus and local semantic reranking; BYOK is optional, not required.
• PDF parsing fuses glyph and rendered pixel streams deterministically, with per-region trust audits and automatic OCR for scanned pages.
• A “solve-and-bounce” flow lets a headless browser crack anti-bot challenges, then hand cookies back to the lightweight fetch tier and sleep.
• v3 adds token-saving tricks: reference handles shrink URLs to a few tokens, probe mode returns MATCH/NO-MATCH instead of full pages, and re-fetches report section-level diffs.
• The fetch tier refuses to use proxies by design (they burn the stealth guarantee), while search and crawl can optionally route through them.

Caveats

• Linux ARM64 builds currently lack OCR and semantic reranking because the ONNX Runtime prebuilt deadlocks on that target, and PDF parsing can hang in some loader paths.
• The fetch tier deliberately has no proxy configuration path; only search and crawl can be routed through proxies, so fetches always use the local IP.

Verdict

Developers building AI agents that need keyless web research with a minimal MCP context footprint should look here. Teams that require guaranteed geo-rotation or a proxy-dependent fetch pipeline should look elsewhere.