dsh-web-search-anysearch

A DeepSeek Harness (dsh) plugin that provides web search through AnySearch — "AI Search Infrastructure for Agents".

Requires dsh >= 0.2.0-rc.2 — this plugin targets the dsh RC/stable line only (CI and releases resolve the newest of the latest/next dist-tags at runtime). The alpha line is no longer supported.

The plugin registers a WebSearchProvider (id: "anysearch") with the official ctx.web capability seam, so the model keeps calling the same web_search tool with the same citation formatting and bounds. No third-party SDK is used: the transport follows AnySearch's own reference CLI (anysearch-ai/anysearch-skill).

How it talks to AnySearch

Per the official interface spec (scripts/shared/doc_spec.md in the skill repo):

• POST https://api.anysearch.com/mcp — JSON-RPC 2.0 tools/call, stateless (no initialize, no session, one connection per request).
• Authorization: Bearer <API_KEY> is optional — anonymous access works with lower rate limits. A free key is available at anysearch.com/console/api-keys.
• max_results is capped at 10 by the API.
• Responses are structured Markdown for agents; the provider parses result blocks into citeable sources, and degrades to passing the whole payload through as content if the format ever drifts — a search never fails just because the parser did.
• Raw node:https per request (not fetch/undici), matching the official CLI and avoiding a known undici connection-pool hang on this endpoint.

Vertical routing (domain/sub_domain via get_sub_domains), batch_search, and extract remain richer MCP/skill-layer features; this provider deliberately exposes the general search tool to dsh's model-facing web_search (a domain can be pinned in config). Point an MCP client at AnySearch for the full toolset.

Install

One command:

dsh plugin --profile <name> add @aiwayds/dsh-web-search-anysearch

dsh plugin installs the package into the profile (via pnpm) and registers it in dsh.profile.bundles automatically — the package declares dsh.bundle, so the official CLI reconciles the layer stack by itself. Restart dsh. That is the whole install: the plugin mounts itself AND claims the web_search default at the bundle layer, so with zero configuration the model's web_search tool runs on AnySearch (anonymous access needs no key).

Local development: dsh plugin --profile <name> add link:/path/to/dsh-web-search-anysearch (relative path specs anchor to your invoking directory). The manual route — adding the dependency and the bundle entry to ~/.dsh/profiles/<name>/package.json yourself and running pnpm install there — works identically.

@deepseek-ai/* packages are peer dependencies by design: they must resolve to the profile's single shared dsh closure. Putting them in dependencies installs a second cordis instance and crashes the loader.

Uninstall

dsh plugin --profile <name> remove @aiwayds/dsh-web-search-anysearch

The host auto-cleans the whole install: the bundles entry is spliced out of the profile's package.json, the dependency is removed, and the plugin's patch layer drops with the package — including the searchProvider: anysearch claim the patch placed on the host web row, so web_search reverts to the host default (deepseek-official). Restart dsh and it is as if the plugin was never installed.

There is no on-disk state to clean up: the plugin is stateless (no cache, no config writes). The optional API key, if you ever stored one, lives in the host-owned credentials document — remove it there if unwanted.

One caveat: if you hand-copied the selection into your own patch layer (searchProvider: anysearch in the profile or home cordis.patch.yml), that line outlives the plugin — searches then fail gracefully with WEB_PROVIDER_UNAVAILABLE (no provider with that id is registered) until you delete the line.

Configure (all optional)

API key — only needed for higher rate limits. Anonymous access is valid AnySearch usage; when the anonymous quota runs out, the search error names the credential to configure. Store the key in dsh's managed credentials document (~/.dsh/.credentials.yaml):

version: 1
refs:
  ANYSEARCH_API_KEY: <your_key>

Or fill it from the GUI: Settings → Plugins → the dsh-web-search-anysearch bundle → its web-search-anysearch row → Configure. That page writes the reference the row's own configuration names — apiKeyEnv, or ANYSEARCH_API_KEY when config names none — through dsh's credentials service and reports whether a key is currently configured. Because that field is live, re-pointing apiKeyEnv moves the page and the provider together instead of splitting them — a settings write applies to the next search, a patch edit at the next start — and a key staged on the page is dropped if the reference changes under it. The field is write-only — a stored key never rides a response back to the page — and a blank field keeps the current key. One more click (Clear key, which asks once) removes the reference again, returning searches to the anonymous limits. A key supplied by the launching environment or a .env fallback is read-only, and the page says so instead of offering a write.

Both routes land in the same document under the same reference, so they are interchangeable: a key typed in the GUI is visible to a hand edit and vice versa. Nothing is written into a configuration file, and the provider re-resolves the reference on every search, so no restart is needed either way.

Keep another engine as the default? Your own patch layer always outranks the plugin's bundle patch — one entry, no need to touch the plugin:

# profile cordis.patch.yml or ~/.dsh/cordis.patch.yml
- id: web
  config:
    searchProvider: tavily   # or deepseek-official, exa, ...

Verify which engine owns web_search:

dsh --profile <name> --dump-config | grep -A3 'id: web$'

Plugin config (all optional; via a patch layer, read at startup):

Behavior

• Markdown result blocks map to sources: title, url, snippet text; relative date:/sitelinks: annotations stay inside the snippet (no ISO dates → publishedAt is never set); duplicate URLs dedupe.
• Seam error contract: cancellation as WEB_ABORTED; transport failures, non-2xx statuses, JSON-RPC errors, and isError tool results as WEB_PROVIDER_ERROR with the provider's message surfaced.
• available() is a local check only (parseable endpoint) — anonymous access means no key is required to be usable.

Develop

npm install
npm run check   # tsc --noEmit
npm test        # build + node --test (transport runs against a local HTTP server;
                #  markdown fixtures come from real API payloads)

After editing src/, run npm run build and restart dsh.

The browser half (src/client.ts → lib/client.js) is a classic script the Web page evaluates directly, so npm run build also runs scripts/build-client.mjs: TypeScript always marks a .ts file in this package as a module, and that step strips the marker it adds and fails the build if the artifact ever carries module syntax. npm test covers the Client half too — artifact shape, the row page it claims, and the credential writes it performs.

License

MIT