Keyless: web search with zero API keys on a fresh install

Hermes Agent's keyless web tier gives a fresh install working search and page extraction with no accounts and no keys, riding a five-vendor free rotation with automatic failover. What it is, where it breaks, and the ten-minute recipe to try it.

Every new agent install used to hit the same wall in its first hour: the API-key wall. Want your agent to search the web? Sign up somewhere, generate a key, paste it into a .env file. Want it to read pages too? Sign up somewhere else. Hermes v0.20.5 took that wall down for the web tools, and this briefing covers what landed, where it breaks, and how to try it yourself in ten minutes.

What it is

Hermes exposes two web tools to the model: web_search and web_extract. One searches and returns ranked results; one fetches a URL and pulls out readable content. Behind both sits a set of backends you had to configure individually, each with its own credentials.

The keyless tier changes the default:

A fresh install with no web credentials at all gets working web_search and web_extract out of the box: requests rotate round-robin across five vendors’ public free tiers — Exa, Parallel, Tavily, Firecrawl, and Keenable — spreading load evenly, and a rate-limited request automatically retries on the next vendor in the ring (multi-hop, until one serves or all are throttled). No signup, no key.

Three mechanics matter as much as the headline:

• The privacy boundary is narrow but real. Requests carry no user identifiers; what is sent is a per-process session id, random and rotated on restart — not persistent, not personal — which also seeds each process’s starting position in the ring, so two fresh installs do not hammer the same vendor first.
• Keyed users get a rescue path. If your chosen backend fails a call, that single call retries on the keyless ring instead of erroring, and the result notes which vendor served it and why. The rescue is never sticky; the next call tries your backend again. Disable with web.keyless_rescue: false.
• Repeat calls are cached. Identical web_search calls are memoised per process and concurrent identical searches become one backend request — the first caller pays, the rest share. Extracted pages are stored under .hermes/cache/web and shared across CLI, gateway, cron, and subagent processes, with a 20-minute default TTL. Only successes are cached, and rescue-served responses never are. For cron jobs that re-check the same pages, that is free savings and free latency.

Why this matters day to day: the first thing most of us ask an agent is to go and look something up, and the old default made that the key-juggling ritual for every fresh profile, cron job, and scratch box. Now a fresh profile searches immediately, scheduled jobs stop failing on missing credentials, and the cost is zero until you outgrow the free tiers.

One revert, two bugs, one root cause

This is the feature’s second attempt: a Parallel-only first try landed on 10 June 2026 with no failover behind it, and it was reverted after four days; what shipped in v0.20.5 on 19 August is the pooled version with that failure mode removed. Days into the wild, its two public bug reports — Firecrawl’s keyless endpoint 403ing on Windows and Tavily’s keyless daily cap arriving as a body-level error code — are one root cause hit twice: the ring only advances on a hard-coded list of throttle-shaped errors, so both stop the walk with four vendors sitting idle. Both reporters were getting real work out of the ring first — one ran nine consecutive searches across several sessions — and that is its own signal: zero-key search is being used hard enough to trip vendor caps within the first week. The fix PRs (#91619, #96186) teach the ring to advance on both errors, and both were still open on 2026-08-29.

The design rule: the floor, not the plan

Anonymous free capacity is a floor, not a plan — for Hermes and well beyond it. A floor makes first contact frictionless; it is not what you build a nightly production pipeline on. Start keyless, notice when you get heavy, then pin a vendor with a key: your key always wins, and the ring drops back to failover duty.

The recipe: try it in ten minutes

Out of the box on a fresh install, there is almost nothing to do; the docs hold the full walkthrough. What you will actually use:

1. Install or update. Fresh install: curl -fsSL https://raw.githubusercontent.com/NousResearch/hermes-agent/main/scripts/install.sh | bash — existing install: hermes update.
2. Add nothing, then check detection. No keys, no web backend entry in config; on a never-configured install, the absence of credentials is the configuration. Run hermes setup, which prints the detected web backend. For a deeper check, source the venv and run python -m tools.web_tools.
3. The cache knobs, only if you need always-fresh results: lower web.cache_ttl_minutes (default 20) or set web.cache_enabled: false in config.

Cost

Zero. No subscription, no signup, no per-call billing; the ring rides five vendors’ public free tiers. For scale, the keyed free tiers run 500 credits a month on Firecrawl and 1,000 searches a month each on Tavily and Exa; beyond those, paid. The keyless tier’s anonymous limits are not published as numbers, so treat any specific figure as fiction. And if you are a Nous Portal subscriber there is a parallel path: the Tool Gateway serves managed Firecrawl with no key of your own.

Honest limits

Bursty load degrades everyone at once, because five shared free tiers rotating on the same public capacity are exactly as strong as their weakest moment; when all five throttle together, the call returns “all keyless vendors throttled” and gives up. Extraction has its own sharp edge of the same shape: batch extraction only fails over when every URL in the batch hits a throttle-shaped error, so one blocked URL in a mixed batch means no retry at all for the rest (a per-URL rescue has been proposed in open PR #97142). Above all, the vendor list and their free-tier terms can change without notice, and nothing published says what happens if a vendor withdraws its public tier; they are upstream capacity, not a contract. When predictability matters, that is the signal to pin a keyed provider.

Takeaway

The lesson is not that Hermes can search without keys. It is the pattern: give a feature a zero-configuration floor by pooling free capacity behind a failover ring, and keep the graduation path to a keyed tier short. The floor is not the plan; it is what gets you to the plan. The field report comes next: a scratch profile with no keys, pushed until a vendor throttles.