Skip to content

feat(search): add Z.AI Coding Plan Search via MCP protocol - #2238

Merged
diegosouzapw merged 3 commits into
cheaper-inference:release/v3.8.0from
andrewmunsell:feature/zai-search-provider
May 14, 2026
Merged

feat(search): add Z.AI Coding Plan Search via MCP protocol#2238
diegosouzapw merged 3 commits into
cheaper-inference:release/v3.8.0from
andrewmunsell:feature/zai-search-provider

Conversation

@andrewmunsell

@andrewmunsell andrewmunsell commented May 14, 2026

Copy link
Copy Markdown
Contributor

Uses the MCP SDK (@modelcontextprotocol/sdk, already a dependency) to call the web_search_prime tool on api.z.ai/api/mcp/web_search_prime/mcp. The MCP endpoint works with Coding Plan API keys, while the REST API (/api/paas/v4/web_search) requires a separate pay-as-you-go balance.

The MCP SDK handles session initialization (handshake → Mcp-Session-Id) transparently. Z.ai double-encodes the results array as a JSON string inside the MCP text content, so the handler unwraps it accordingly.

Reuses existing Z.ai chat credentials via SEARCH_CREDENTIAL_FALLBACKS. Cost and free quota are both 0 (pricing not yet documented upstream). Injects safeOutboundFetch into the MCP transport for URL guard coverage.

Validation

Tested: 67 search-related unit tests pass. Live curl confirmed real results from the Coding Plan web_search_prime tool.

Reviewer Notes

  • The Z.ai search provider is different than others in that it uses an MCP client to access to the endpoint, not an HTTP call. This is due to Z.ai limiting which endpoints the Coding Plan users can access

@dependabot
deps: bump mermaid from 11.14.0 to 11.15.0 (cheaper-inference#2178)
41946c4 
Bumps [mermaid](https://github.com/mermaid-js/mermaid) from 11.14.0 to 11.15.0.
- [Release notes](https://github.com/mermaid-js/mermaid/releases)
- [Commits](https://github.com/mermaid-js/mermaid/compare/mermaid@11.14.0...mermaid@11.15.0)

---
updated-dependencies:
- dependency-name: mermaid
  dependency-version: 11.15.0
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
gemini-code-assist[bot]
gemini-code-assist Bot reviewed May 14, 2026
View reviewed changes

@gemini-code-assist gemini-code-assist Bot left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Code Review

This pull request introduces a new search provider, 'Z.AI Coding Plan Search', which utilizes the Model Context Protocol (MCP) for web search execution. The changes include adding the provider configuration to the registry, implementing the MCP execution logic in the search handler, and adding comprehensive unit tests. Feedback identifies several critical and medium-severity issues: the tryZaiMCPProvider call is missing a globalStartTime parameter necessary for timeout management, the implementation fails to respect user-overridden base URLs in both the handler and the validator, and there is a lack of safety checks when parsing JSON from the MCP tool. Additionally, the logging logic in tryZaiMCPProvider incorrectly records a success status before execution and should be moved to the success path.

Comment thread open-sse/handlers/search.ts Resolved
Comment thread open-sse/handlers/search.ts Resolved
Comment thread open-sse/handlers/search.ts Resolved
Comment thread open-sse/handlers/search.ts Resolved
Comment thread src/lib/providers/validation.ts Resolved
@andrewmunsell
feat(search): add Z.AI Coding Plan Search via MCP protocol
15c4b53 
Uses the MCP SDK (@modelcontextprotocol/sdk, already a dependency) to
call the web_search_prime tool on api.z.ai/api/mcp/web_search_prime/mcp.
The MCP endpoint works with Coding Plan API keys, while the REST API
(/api/paas/v4/web_search) requires a separate pay-as-you-go balance.

The MCP SDK handles session initialization (handshake → Mcp-Session-Id)
transparently. Z.ai double-encodes the results array as a JSON string
inside the MCP text content, so the handler unwraps it accordingly.

Reuses existing Z.ai chat credentials via SEARCH_CREDENTIAL_FALLBACKS.
Cost and free quota are both 0 (pricing not yet documented upstream).
Injects safeOutboundFetch into the MCP transport for URL guard coverage.
Uses resolveSearchBaseUrl for consistency with other providers.

tryZaiMCPProvider respects globalStartTime with AbortController timeout,
handles AbortError for timeout vs connection-failure separation, and
only logs saveCallLog on the success path with results_count.

The zai-search validator in validation.ts respects providerSpecificData
for custom base URLs, matching the SearXNG validator pattern.

Tested: 67 search-related unit tests pass. Live curl confirmed real
results from the Coding Plan web_search_prime tool.
@andrewmunsell
andrewmunsell force-pushed the feature/zai-search-provider branch from 3001ef7 to 15c4b53 Compare May 14, 2026 02:11
@diegosouzapw
diegosouzapw changed the base branch from main to release/v3.8.0 May 14, 2026 02:53
@diegosouzapw
diegosouzapw merged commit 0caca47 into cheaper-inference:release/v3.8.0 May 14, 2026
1 of 2 checks passed
@diegosouzapw

diegosouzapw commented May 14, 2026

Copy link
Copy Markdown
Collaborator

Hey @andrewmunsell! Thanks for the MCP-based Z.AI search integration — clever pattern for working around the REST-vs-Coding-Plan key restriction.

Integrated as a squash merge with one reviewer adjustment: replaced the JSON.parse(parsed) double-decode in unwrapZaiContent with a Zod schema (ZaiSearchResultsSchema) that validates the unwrapped array shape before we trust it. Same upstream quirk preserved (parsed → string → parsed array) but now any shape regression upstream lands in a typed error path instead of corrupting results. Also tightened the content array filter to handle malformed/non-array toolResult.content. The MCP transport, fallback credentials, and unit-test mocks are unchanged. Thanks again!

diegosouzapw added a commit that referenced this pull request May 14, 2026
@diegosouzapw
test: fix post-merge test breakages from #2227 #2233 #2238
831f64e 
- antigravity: AntigravityCredentials.projectId widened to string|null
  to match base ProviderCredentials shape post-#2227 squash merge.
- responses-handler: heartbeat assertion updated for #2233's new
  openai-responses-in-progress shape (was: keepalive comment).
- search-registry: expected count is now 12 (ollama-search +
  zai-search both landed in this release).
diegosouzapw added a commit that referenced this pull request May 14, 2026
@diegosouzapw
docs(changelog): add 18 missing PR entries and fix contributor credits
c49d817 
Deep audit of all 320 commits since v3.7.9 found:
- 18 merged PRs not documented in CHANGELOG (4 features, 10 bug fixes, 1 security, 2 chores, 1 debug improvement)
- 3 contributors entirely missing from credits table (@NomenAK with 12 PRs, @kang-heewon, @one-vs)
- 4 existing contributors with inaccurate PR counts (@oyi77 8→12, @ddarkr 2→3, @andrewmunsell 2→3, @nickwizard 2→3)

New entries added:
- feat: #2135 (1proxy settings), #2227 (antigravity project ID), #2238 (Z.AI Search), #2240 (CLI Suite)
- fix: #2217, #2218, #2219, #2221, #2222, #2223, #2224, #2231, #2233, #2236, #2242, #2243
- security: #2209 (stack trace exposure)
- chore: #2228, #2234

Total contributors updated from 50+ to 55+.
This was referenced May 14, 2026
Merged
Merged
Merged
Merged
HouMinXi pushed a commit to HouMinXi/OmniRoute that referenced this pull request Aug 2, 2026
@andrewmunsell
feat(search): add Z.AI Coding Plan Search via MCP protocol (cheaper-i…
4ebafd6 
…nference#2238)

Integrated into release/v3.8.0 with Zod schema validation replacing JSON.parse(parsed)
HouMinXi pushed a commit to HouMinXi/OmniRoute that referenced this pull request Aug 2, 2026
@diegosouzapw
test: fix post-merge test breakages from cheaper-inference#2227 cheap…
1c93672 
…er-inference#2233 cheaper-inference#2238

- antigravity: AntigravityCredentials.projectId widened to string|null
  to match base ProviderCredentials shape post-cheaper-inference#2227 squash merge.
- responses-handler: heartbeat assertion updated for cheaper-inference#2233's new
  openai-responses-in-progress shape (was: keepalive comment).
- search-registry: expected count is now 12 (ollama-search +
  zai-search both landed in this release).
HouMinXi pushed a commit to HouMinXi/OmniRoute that referenced this pull request Aug 2, 2026
@diegosouzapw
docs(changelog): add 18 missing PR entries and fix contributor credits
2a1c652 
Deep audit of all 320 commits since v3.7.9 found:
- 18 merged PRs not documented in CHANGELOG (4 features, 10 bug fixes, 1 security, 2 chores, 1 debug improvement)
- 3 contributors entirely missing from credits table (@NomenAK with 12 PRs, @kang-heewon, @one-vs)
- 4 existing contributors with inaccurate PR counts (@oyi77 8→12, @ddarkr 2→3, @andrewmunsell 2→3, @nickwizard 2→3)

New entries added:
- feat: cheaper-inference#2135 (1proxy settings), cheaper-inference#2227 (antigravity project ID), cheaper-inference#2238 (Z.AI Search), cheaper-inference#2240 (CLI Suite)
- fix: cheaper-inference#2217, cheaper-inference#2218, cheaper-inference#2219, cheaper-inference#2221, cheaper-inference#2222, cheaper-inference#2223, cheaper-inference#2224, cheaper-inference#2231, cheaper-inference#2233, cheaper-inference#2236, cheaper-inference#2242, cheaper-inference#2243
- security: cheaper-inference#2209 (stack trace exposure)
- chore: cheaper-inference#2228, cheaper-inference#2234

Total contributors updated from 50+ to 55+.
Poid-ZA pushed a commit to Poid-ZA/OmniRoute that referenced this pull request Aug 5, 2026
@andrewmunsell
feat(search): add Z.AI Coding Plan Search via MCP protocol (cheaper-i…
7cbaa8a 
…nference#2238)

Integrated into release/v3.8.0 with Zod schema validation replacing JSON.parse(parsed)
Poid-ZA pushed a commit to Poid-ZA/OmniRoute that referenced this pull request Aug 5, 2026
@diegosouzapw
test: fix post-merge test breakages from cheaper-inference#2227 cheap…
c74e150 
…er-inference#2233 cheaper-inference#2238

- antigravity: AntigravityCredentials.projectId widened to string|null
  to match base ProviderCredentials shape post-cheaper-inference#2227 squash merge.
- responses-handler: heartbeat assertion updated for cheaper-inference#2233's new
  openai-responses-in-progress shape (was: keepalive comment).
- search-registry: expected count is now 12 (ollama-search +
  zai-search both landed in this release).
Poid-ZA pushed a commit to Poid-ZA/OmniRoute that referenced this pull request Aug 5, 2026
@diegosouzapw
docs(changelog): add 18 missing PR entries and fix contributor credits
41becc9 
Deep audit of all 320 commits since v3.7.9 found:
- 18 merged PRs not documented in CHANGELOG (4 features, 10 bug fixes, 1 security, 2 chores, 1 debug improvement)
- 3 contributors entirely missing from credits table (@NomenAK with 12 PRs, @kang-heewon, @one-vs)
- 4 existing contributors with inaccurate PR counts (@oyi77 8→12, @ddarkr 2→3, @andrewmunsell 2→3, @nickwizard 2→3)

New entries added:
- feat: cheaper-inference#2135 (1proxy settings), cheaper-inference#2227 (antigravity project ID), cheaper-inference#2238 (Z.AI Search), cheaper-inference#2240 (CLI Suite)
- fix: cheaper-inference#2217, cheaper-inference#2218, cheaper-inference#2219, cheaper-inference#2221, cheaper-inference#2222, cheaper-inference#2223, cheaper-inference#2224, cheaper-inference#2231, cheaper-inference#2233, cheaper-inference#2236, cheaper-inference#2242, cheaper-inference#2243
- security: cheaper-inference#2209 (stack trace exposure)
- chore: cheaper-inference#2228, cheaper-inference#2234

Total contributors updated from 50+ to 55+.
muhamadgalihsaputra pushed a commit to niyatna/NiyatnaRoute that referenced this pull request Sep 27, 2026
@andrewmunsell
feat(search): add Z.AI Coding Plan Search via MCP protocol (cheaper-i…
21af91a 
…nference#2238)

Integrated into release/v3.8.0 with Zod schema validation replacing JSON.parse(parsed)
muhamadgalihsaputra pushed a commit to niyatna/NiyatnaRoute that referenced this pull request Sep 27, 2026
@diegosouzapw
test: fix post-merge test breakages from cheaper-inference#2227 cheap…
7f42258 
…er-inference#2233 cheaper-inference#2238

- antigravity: AntigravityCredentials.projectId widened to string|null
  to match base ProviderCredentials shape post-cheaper-inference#2227 squash merge.
- responses-handler: heartbeat assertion updated for cheaper-inference#2233's new
  openai-responses-in-progress shape (was: keepalive comment).
- search-registry: expected count is now 12 (ollama-search +
  zai-search both landed in this release).
muhamadgalihsaputra pushed a commit to niyatna/NiyatnaRoute that referenced this pull request Sep 27, 2026
@diegosouzapw
docs(changelog): add 18 missing PR entries and fix contributor credits
861ef68 
Deep audit of all 320 commits since v3.7.9 found:
- 18 merged PRs not documented in CHANGELOG (4 features, 10 bug fixes, 1 security, 2 chores, 1 debug improvement)
- 3 contributors entirely missing from credits table (@NomenAK with 12 PRs, @kang-heewon, @one-vs)
- 4 existing contributors with inaccurate PR counts (@oyi77 8→12, @ddarkr 2→3, @andrewmunsell 2→3, @nickwizard 2→3)

New entries added:
- feat: cheaper-inference#2135 (1proxy settings), cheaper-inference#2227 (antigravity project ID), cheaper-inference#2238 (Z.AI Search), cheaper-inference#2240 (CLI Suite)
- fix: cheaper-inference#2217, cheaper-inference#2218, cheaper-inference#2219, cheaper-inference#2221, cheaper-inference#2222, cheaper-inference#2223, cheaper-inference#2224, cheaper-inference#2231, cheaper-inference#2233, cheaper-inference#2236, cheaper-inference#2242, cheaper-inference#2243
- security: cheaper-inference#2209 (stack trace exposure)
- chore: cheaper-inference#2228, cheaper-inference#2234

Total contributors updated from 50+ to 55+.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@diegosouzapw diegosouzapw Awaiting requested review from diegosouzapw diegosouzapw is a code owner
1 more reviewer
@gemini-code-assist gemini-code-assist[bot] gemini-code-assist[bot] left review comments
Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@andrewmunsell @diegosouzapw