@tonydua/dsh-web-search-exa

English | 简体中文

Zero-config Exa web search for DeepSeek Harness (dsh):
no API key required — a WebSearchProvider for the ctx.web seam with an
anonymous MCP fallback plus a keyed REST path.

Built with deepseek-v4-flash inside DeepSeek Harness (dsh).

Supported versions

@tonydua/[email protected] is tested and supported with:

• @deepseek-ai/dsh 0.1.2-rc.1 (the current npm latest release)
• @deepseek-ai/dsh-web 0.1.2-rc.1
• @deepseek-ai/dsh-settings 0.1.2-rc.1 (optional; enables live Settings integration)
• @deepseek-ai/dsh-launch-environment 0.1.2-rc.1
• @deepseek-ai/cordis 4.0.2
• Node.js >=18

The dsh 0.1.2-rc.1 API is the compatibility baseline. The 0.1.5-alpha.1
alpha line is not part of this release's tested support matrix.

Features

• 🆓 Zero-config, keyless by default — searches route through Exa's hosted MCP
  server (mcp.exa.ai/mcp) with no credentials at all (Exa's documented
  unauthenticated public MCP, rate-limited).
• 🔑 Keyed REST upgrade — set EXA_API_KEY and it automatically switches to
  Exa's POST /search REST API (higher limits, no behavior change).
• 🔌 Drop-in provider — registers into the dsh ctx.web seam; the existing
  model-facing web_search / web_fetch tools, prompt sections, and result
  cards work unchanged.
• 🎛️ providerId switch — can coexist with the official
  @deepseek-ai/dsh-web-search-exa package in one profile (no duplicate-id
  collisions, no silent overrides).
• 📦 npm-publishable — MIT, ESM, bundled types, files limited to lib/.

Why this package exists (vs. the official one)

The DeepSeek Harness ships an official Exa provider,
@deepseek-ai/dsh-web-search-exa.
This package is its zero-config variant: it adds the anonymous MCP fallback
the official one does not have, and keeps the same keyed REST behavior.

Which one should I use?

• You have an EXA_API_KEY and want the officially maintained package →
  use @deepseek-ai/dsh-web-search-exa. It is the canonical implementation.
• You want to try Exa search with zero setup, no key, no cost commitment →
  use this package. It degrades gracefully: anonymous MCP by default, REST
  automatically when a key appears.
• You want both → install both and use the providerId switch (see
  Coexistence).

How it works

The anonymous MCP path sends no credentials; attribution rides the
x-exa-source: dsh-anything header. Results are normalized to the seam's
WebSearchSource shape (url, title, snippet, publishedAt) and the seam
enforces maxResults on the way back. Anonymous usage is rate-limited by Exa:
an HTTP 429 surfaces as a WEB_PROVIDER_ERROR with a hint to configure an API
key (which also switches to the REST path automatically).

Installation (into a dsh profile)

One command from npm (v0.1.4+ ships the dsh.bundle manifest — the bundle
patch inserts the provider row, so no manual patch editing is needed):

dsh plugin --profile web add @tonydua/dsh-web-search-exa

Restart dsh web. Without an API key the official DeepSeek search
provider is unavailable, so the seam auto-selects this provider — fully
zero-config. With a key configured, select Exa explicitly in your own
$DSH_HOME/profiles/web/cordis.patch.yml (applied after bundle patches):

- id: web
  name: '@deepseek-ai/dsh-web'
  config:
    searchProvider: exa

…or at runtime with the environment variable $DSH_WEB_SEARCH_PROVIDER=exa.

Local development checkout:

dsh plugin --profile web add ../plugins/dsh-web-search-exa

Then enable the provider and select it. Either merge into
$DSH_HOME/profiles/web/cordis.patch.yml (persistent):

- id: web-search-exa
  name: '@tonydua/dsh-web-search-exa'
  config:
    apiKeyEnv: EXA_API_KEY
- id: web
  name: '@deepseek-ai/dsh-web'
  config:
    searchProvider: exa

Alternatively, select the provider at runtime with the environment variable
$DSH_WEB_SEARCH_PROVIDER=exa (no config edit needed).

Restart dsh web for changes to take effect. The existing model-facing
web_search tool then routes through this provider — no tool config changes.

Runtime singleton compatibility

@deepseek-ai/dsh-tools is a dsh runtime singleton and must resolve to one
physical package instance in a profile. This provider does not depend on it;
the requirement belongs to the host profile. If another third-party plugin
installs @deepseek-ai/dsh-tools as a nested regular dependency instead of a
peer dependency, fix that plugin's dependency declaration or make the profile
package manager resolve the shared instance before debugging search errors.
Otherwise dsh's agent loop can fail before the provider is called with an
error such as Cannot read properties of undefined (reading 'prepare').

Configuration

Coexistence with the official package

Both packages register their provider under the same default provider id
(exa) and the same cordis plugin name (web-search-exa). The seam rejects
duplicate ids with WEB_DUPLICATE_PROVIDER, so installing both into one
profile without changes breaks at startup.

There is no silent override — coexistence is explicit, via the providerId
switch:

1. Keep the official package on exa (its id is fixed).
2. Give this package a distinct id — set providerId: exa-anon (any unique
   string) in this plugin's config.
3. Select the anonymous variant explicitly with
   searchProvider: exa-anon on the web seam (or
   $DSH_WEB_SEARCH_PROVIDER=exa-anon), and keep
   searchProvider: exa → the official one if you want it selectable too.

- insert:
    - id: web-search-exa
      name: '@tonydua/dsh-web-search-exa'
      config:
        providerId: exa-anon
- id: web
  name: '@deepseek-ai/dsh-web'
  config:
    searchProvider: exa-anon

Simplest alternative: install only one of the two packages per profile — the
defaults then work as-is.

In the Web panel

Status: configuration is done in the profile patch layer, not the Web UI —
this version ships no editable UI entry. The Settings UI only renders cards
that are hand-registered by client plugins for fixed namespaces (shell,
agent-loop, web-search-deepseek); it has no generic form for arbitrary
plugin namespaces. What is true today:

• Plugin inventory (Settings → Plugins): the entry appears automatically
  as web-search-exa (@tonydua/dsh-web-search-exa) once enabled — the
  inventory reads the live Cordis loader, no extra code needed.
• Settings namespace (server-side): the plugin registers the
  web-search-exa section via the current ctx.settings.installSection API, so the data layer is
  writable — but no client card binds to it, so nothing shows in the UI.
  The built-in "Web search" card edits the official
  web-search-deepseek namespace, not this plugin.
• Changing configuration today: edit the plugin's config in
  $DSH_HOME/profiles/web/cordis.patch.yml (fields and defaults in the table
  above) and restart dsh web; or set EXA_API_KEY / $DSH_WEB_SEARCH_PROVIDER
  as environment variables. The apiKey field is role('secret'): it never
  appears in describe() responses.
• Search result cards: web_search calls render the usual web cards
  (sources, snippets, dates) through dsh-tool-web, independent of the
  provider — anonymous Exa results display exactly like DeepSeek ones.

Roadmap (next version): a client-side card registered into the
settings.plugin.item slot bound to the web-search-exa namespace, so all
fields above become editable live in Settings → Plugins (mirroring how the
official cards work).

FAQ

Q: Do I need an Exa API key?
No. Without a key the provider uses Exa's free anonymous hosted MCP. With a key
it uses the REST API for higher limits.

Q: I got HTTP 429 / rate limited.
That's Exa's anonymous-MCP rate limit. Configure EXA_API_KEY (or the
apiKey field) and the provider switches to the REST path automatically.

Q: Can I run this alongside the official Exa provider?
Yes — give this package a distinct providerId and select it explicitly
(see Coexistence).

Q: Why don't I see a settings entry in the Web UI?
This version registers the web-search-exa settings namespace server-side
only; a UI card is planned for the next version. Configure through
cordis.patch.yml or environment variables for now (see
In the Web panel).

Q: Which dsh versions are supported?
This release supports dsh 0.1.2-rc.1 and its matching dsh-web,
dsh-settings, and dsh-launch-environment packages. The 0.1.5-alpha.1
line is not tested by this release.

Acknowledgements

The anonymous MCP integration follows the web_search implementation in
can1357/oh-my-pi (packages/coding-agent/src/web/search/providers/exa.ts
and src/exa/mcp-client.ts) and the
@oh-my-pi/exa plugin: same
"REST when a key exists, credential-free mcp.exa.ai/mcp otherwise" strategy,
same x-exa-source attribution header, same Title:-section response parsing.
Thanks to the oh-my-pi (omp) project for pioneering the zero-config Exa
integration.

Thanks also to Exa for providing and operating the
free, unauthenticated hosted MCP server (mcp.exa.ai/mcp) that makes this
package's zero-config default possible. Exa's hosted MCP is an official Exa
product; anonymous usage is rate-limited (see FAQ).

Changelog

See CHANGELOG.md for all notable changes.

License

MIT — see LICENSE.