Web Search Plus for Hermes

The evidence shows read-only CI permissions; a standard-library core; separately installed or explicitly enabled DonSeTch, Jev, and commercial providers; and exclusion of DonSeTch, Octen, and TinyFish from automatic routing by default. The README explains which providers receive queries, URLs, and page data, and discloses training, retention, billing, and enterprise-ZDR differences. Keys go to an environment file, the Jev key file requires mode 600, and keys are excluded from config.json. Version 4.3.2 documents URL validation, same-origin redirects, response-size limits, provider-error isolation, and an untrusted-web-data notice. Results retain original links, providing strong attribution. Deductions: ordinary searches and extracts do not require per-call confirmation; confirmation is chiefly expressed through installation, configuration, and provider selection. Rollback has migration, backup/restore, and kill-switch documentation pointers, but the supplied text does not show the complete recovery procedure. Dependency controls include pinned optional versions, process separation, and npm --ignore-scripts, but no Python dependency manifest, dependency audit, or vulnerability-scan result is included.

The README's features, versions, compatibility statements, and test commands are consistent with the CI workflow, isolation fixtures, and provider-discovery tests. Tests preserve DNS security validation, isolate mutable state, fail closed on duplicate provider IDs, and produce typed diagnostics for broken modules. CI covers Python 3.10 through 3.12, Ruff, pytest, generated-artifact checks, schema boundaries, and compilation. Dependency availability is reduced because several capabilities rely on external APIs, self-hosted endpoints, or separately installed DonSeTch/typesafe-sdk; the public Keenable tier explicitly has rate limits and no SLA, while other parsed DonSeTch versions are only compatible_unverified. Failure-message evidence is strong, although the static sample does not establish every external provider's failure behavior.

The material distinguishes current-information search, research, extraction of known URLs, no-paid-key self-hosting, explicit sensitive providers, and the native Hermes backend. Boundaries are concrete: SearXNG does not extract, Jev is not a search provider, Octen full-content and answer APIs are disabled, TinyFish purpose/fetch parameters are omitted, and DonSeTch is a separate process. Trigger precision is strong because higher-risk providers remain explicit or require auto_allow, Jev is opt-in, and news classification requires 0.95 confidence. Python, Hermes reload behavior, Windows support, CLI/Gateway operation, self-hosting, and environment configuration are covered, so no material deductions were warranted.

The README has a clear quick start, tool descriptions, task-oriented documentation map, development commands, and links to normative contracts. Installation, upgrades, migrations, examples, FAQ, limitations, stable interfaces, release notes, and changelog paths are explicit; tool naming and legacy configuration compatibility are also described. MIT metadata agrees with the complete LICENSE. Maintenance-responsibility points were deducted because the repository and copyright identify Robby/robbyczgw-cla and provide an update path and contribution guide, but the publisher is not enterprise-registry verified and the supplied files do not establish a formal support channel, maintenance commitment, or multi-maintainer governance.

The output is designed for agent use and includes structured search results, original URLs, cleaned page content, optional quality reports, cache age, and provider diagnostics. Multi-provider fallback, combined search and extraction, retained sources, routing, and local options provide clear marginal value over a single-provider interface. Cost-benefit controls are strong: one provider is sufficient, self-hosted and key-free choices exist, commercial services and Jev are optional, and Monid billing and public-tier limits are disclosed. A minor evidentiary limitation remains because performance percentages and provider counts are asserted primarily by the README without the underlying benchmark data in the supplied files.

Most claims are mapped to specific release notes, the changelog, provider guides, architecture material, or normative contracts; the supplied tests and CI configuration independently support several fail-closed, diagnostic, and isolation claims. The documentation carefully distinguishes tested versions, compatible_unverified versions, independent dependencies, external terms, and inferred behavior. Cross-source corroboration is not full because the evidence set is mostly first-party repository material: only selected README claims are backed by supplied code/tests, while provider-policy claims, live performance figures, and the complete security posture lack independent corroboration here.