v3.2.0 — Free-first search router, provider routing, semantic dedup/rerank

Agent Search MCP v3.2.0

Free search remains the complete default product. This release adds explicit,
budgeted paid-provider escalation for users who bring their own API keys,
without turning configured credentials into implicit spending authorization.

Highlights

• SEARCH_PROVIDER_MODE=free_first remains the default and does not call paid
  providers automatically.
• quality_escalation calls the first configured optional provider only when
  free evidence is insufficient; paid_first reverses the order.
• free_only is a hard no-spend policy, including explicit paid-engine
  requests.
• Parallel and waterfall search share one provider-routing policy and one
  evidence contract.
• fasm doctor --json reports local readiness without network probes or secret
  values.
• Request budgets, provider cooldown, exact-cache support, structured failures,
  and Search Evidence Packets improve operational traceability.
• The project-owned DuckDuckGo Web → HTML → Lite chain no longer depends on
  Python/ddgs.
• Stable Streamable HTTP supplies Node's built-in Web Crypto implementation
  when Node 18 does not expose it globally.
• Wiby adds an official, zero-key JSON source for independent small-Web
  discovery without adding a browser runtime.
• Tencent Web Search API, Bocha, and Serper are optional BYOK adapters; their
  provider-controlled trial quotas are not treated as permanent free access.

Compatibility and verification

• Runtime: Node.js >=18.17.
• The earlier 16-adapter candidate passed packed-install, doctor, launcher,
  stdio, and tool-discovery smoke on Windows and Linux x64 with Node 18.20.8,
  20.20.2, and 22.23.1.
• Its exact commit, SHA-256, packed contents, and six-cell matrix are retained
  in the candidate evidence.
• The HTTP and tool-surface changes changed package source after that matrix.
  The retained tarball is historical evidence only; a publishable artifact
  must be rebuilt from the final PR commit and replayed across the same matrix.
• Default offline suite: 742 passed; two live-network tests remain explicitly
  gated.
• Lint passes with zero errors and zero warnings; future warnings fail the gate.
• One earlier bounded release smoke used one DDG adapter attempt with no
  automatic retry and returned a non-empty result set through MCP stdio. The
  adapter expansion did not repeat that provider call because it did not change
  the DDG/Sogou request chains. This remains a point-in-time regression check,
  not an availability measurement.
• No search accuracy or provider-availability percentage is claimed by this
  release.
• The dedicated news tool was removed before release after bounded validation
  could not establish a dependable Bing News RSS response.

Configuration

# Default: zero-key search only
SEARCH_PROVIDER_MODE=free_first

# Optional BYOK escalation
SEARCH_PROVIDER_MODE=quality_escalation
PAID_ENGINE_ORDER=brave,exa,tavily,youcom,tencent_wsa,bocha,serper
BRAVE_API_KEY=...

Available modes are free_first, quality_escalation, paid_first, and
free_only. Default routing selects only the first credentialed entry in
PAID_ENGINE_ORDER; multiple paid providers require explicit engines.

The MCP Registry metadata exposes all seven optional provider credentials and
the two spend controls. Its package name, description, and version are checked
against package.json.

Known audit note

The lock file and all six smoke cells resolve @hono/node-server 1.19.15,
which the official GHSA-frvp-7c67-39w9 advisory lists as the patched 1.x
release. npm audit's registry payload still uses the broader <2.0.5 range and
therefore reports two moderate findings. Agent Search MCP does not register the
affected serve-static handler; the release records the metadata mismatch
instead of downgrading MCP SDK or forcing the Node 20-only Hono 2.x line.