ReadonlyCapabilitiesWhat this driver can do. Declared by the class, never read from the database.
ProtectedconfigConfiguration from the metadata record, set during Initialize.
Why this driver is unavailable, for diagnostics. Null when it is available.
Keyless, so always available — which is the entire reason it is the fallback.
Execute a search. Called only when IsAvailable is true.
ProtectedGetRead a non-secret setting from the record's ProviderConfig JSON.
ProtectedGetRead a credential value, preferring the decrypted MJ: Credentials record and falling back
to an environment variable.
The fallback exists because the web search actions this engine supersedes read their keys
from mj.config.cjs / the environment, and a host upgrading should not have to migrate its
secrets into the Credential store on the same day it gains the engine.
key within the credential record's decrypted values, e.g. apiKey
environment variable consulted when no credential value is present
Receive configuration from the provider's metadata record.
The default stores it; override to do additional setup, and call super.Initialize(...).
Whether this driver may participate in searches. False until CheckAvailability says otherwise.
ProtectedMarkMark this driver operational. Call from CheckAvailability.
ProtectedMarkMark this driver unusable, with a reason an administrator can act on.
ProtectedResolveThe effective result cap: the caller's request, bounded by the metadata override (when set) and then by the vendor's own hard cap.
Clamped rather than rejected — a caller asking for 50 wants as many as possible, and most vendors reject the whole request when asked for more than they serve.
StaticGetEnumerate every registered driver with its capabilities, for admin UI dropdowns.
Instantiates each registration to read Capabilities, so a driver's constructor must stay
side-effect free.
Searches through DuckDuckGo's Instant Answer API.
This is a last resort, and it is ordered last for good reasons. The Instant Answer API is not a web search API: it returns disambiguation topics and an abstract, not a ranked result set, so it answers only a minority of queries and returns nothing at all for many ordinary ones. It also rate-limits aggressively and without documentation.
It earns its place because it needs no credential, so a host that has configured nothing still gets some web capability rather than a hard failure. Treat a deployment that relies on it as unconfigured, not as working — configure Brave or Tavily for real coverage.
Why there is no HTML fallback
An earlier version fell back to fetching and regex-parsing DuckDuckGo's HTML results page, which answered far more queries. It was removed deliberately: running regular expressions over remote HTML is running them over attacker-influenceable input, and the parser carried two high-severity findings — polynomial backtracking in the result patterns (the
[^"]*…[^"]*shape) and incomplete sanitization in its tag-stripping.Hardening those patterns would have narrowed the surface; deleting the parser removes it. For a fallback inside a last-resort provider that this engine already tells operators not to rely on, the capability was not worth the exposure — and "the regex looks safe now" is exactly the kind of claim that is true when written and wrong later. Anything needing real web coverage should configure a provider with an API.