---
title: "Search"
description: "How OMS looks things up, Solana sources first and then the web, and the limits on what it fetches."
url: https://barestate.xyz/docs/concepts/search
---

# Search

> How OMS looks things up, Solana sources first and then the web, and the limits on what it fetches.

When the model needs a fact, OMS tells it where to look and in what order, so it reaches for Solana-specific sources before the open web. This page covers that order, the tools, the limits on each, and how to turn web access off.

The order is the built-in reference and documentation tools, then the official Solana MCP server (the `solana_*` tools), then `web_search` and `web_fetch`. For program or build errors, the model prefers Solana Stack Exchange and GitHub issues and releases of the crate or tool. Queries must not contain secrets or private code.

## The tools

| Tool | What it does |
|---|---|
| `web_search` | Web search through one of several backends |
| `web_fetch` | Fetches one public `https://` page as markdown |
| `source_fetch` | Downloads a GitHub repository or an npm package into a folder outside the task, so the agent can search it |
| `solana_docs_search`, `solana_ask`, `solana_list_sections`, `solana_get_documentation` | The official Solana MCP server, `https://mcp.solana.com/mcp` by default |

The Solana server's `program_autofixer` tool is not exposed.

## Limits

Web tools run in the host OMS process, never in the sandbox. Results are framed as untrusted and capped at 16,000 bytes.

| Tool | Limits |
|---|---|
| `web_fetch` | 20 s timeout. 2,000,000 byte download. 12 pages per user request. Only the newest 3 fetched pages go to the model in full. Older ones become a one-line stub. Refuses private, loopback and link-local targets, before and after DNS lookup |
| `source_fetch` | Hosts `api.github.com`, `codeload.github.com`, `registry.npmjs.org`. 50 MiB compressed, 200 MiB extracted, 50,000 entries, 5 repositories or packages per request. Symlinks are dropped and path escapes are refused |

## Search backends

`web_search` tries backends in this order: `oms` (hosted search, only when you are signed in or when `OMS_SEARCH_URL` and `OMS_SEARCH_TOKEN` are set), then `exa`, `firecrawl`, `tavily`, `parallel` and `tinyfish`. The keys are `EXA_API_KEY`, `FIRECRAWL_API_KEY`, `TAVILY_API_KEY`, `PARALLEL_API_KEY` and `TINYFISH_API_KEY`.

If a backend returns HTTP 429 or 5xx, OMS moves to the next one, and a rate-limited backend is skipped until its `Retry-After` time (60 seconds by default). `OMS_SEARCH_URL` must be `https`, or loopback `http`, so the bearer token is never sent in clear text.

**Warning:**
With no search key and no sign-in, there is no `web_search` tool. Sign in with `/login` or set one of the keys.

## Turn web access off

```text
/web off
/web on
```

`/web` changes web search, fetch and the Solana MCP server for the current session. To launch without them, start with `--no-web`, or set `{"web":"off"}` in `config.json` in the state root. Headless runs have no web tools unless you pass `--web`. Run records count calls and name the backend that answered.