Live Web Search¶

Grounding an answer in the live internet means pulling untrusted text into the prompt — which is exactly how indirect prompt injection works. G1-Proxy searches, then screens every fetched page through the detector and grounds the answer only in the ones that pass. One boolean on the chat body turns it on.

Use it¶

What it does. Set web_search: true on any chat request. The proxy searches, screens each fetched page through the detector, keeps only the safe ones as grounding context, and cites them back in geodesia.rag. On by default (GW_WEBSEARCH_ENABLED=1).

curl -s http://localhost:8080/gw/v1/chat/completions \
  -H "Content-Type: application/json" \
  -d '{
    "model": "my-model",
    "stream": false,
    "web_search": true,
    "messages": [{"role":"user","content":"What were the headline announcements at the latest Apple event?"}]
  }' | jq '{answer: .choices[0].message.content, sources: [.geodesia.rag.sources[]?.url]}'

import httpx

r = httpx.post("http://localhost:8080/gw/v1/chat/completions", json={
    "model": "my-model",
    "stream": False,
    "web_search": True,
    "messages": [{"role": "user", "content": "What were the headline announcements at the latest Apple event?"}],
}, timeout=120).json()

print(r["choices"][0]["message"]["content"])
for s in (r["geodesia"].get("rag") or {}).get("sources", []):
    print(" •", s.get("url"))

const r = await fetch("http://localhost:8080/gw/v1/chat/completions", {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({
    model: "my-model",
    stream: false,
    web_search: true,
    messages: [{ role: "user", content: "What were the headline announcements at the latest Apple event?" }],
  }),
}).then(r => r.json())

console.log(r.choices[0].message.content)
console.log(r.geodesia.rag?.sources?.map((s: any) => s.url))

What comes back — the ordinary chat response. The pages that were searched, read or blocked arrive as research events when stream: true, and the grounding sources under geodesia.rag.

Settings API¶

What it does. Two routes on G1-Proxy that read and set the search provider's API key out-of-band. The key is written to a file outside the image with mode 0600 and is never returned in clear — only a masked hint.

# read
curl -s http://localhost:8080/gw/v1/glad/websearch/config | jq

# set (or replace)
curl -s -X POST http://localhost:8080/gw/v1/glad/websearch/config \
  -H "Content-Type: application/json" \
  -d '{"api_key": "tvly-abc…wxyz"}' | jq

# remove
curl -s -X POST http://localhost:8080/gw/v1/glad/websearch/config \
  -H "Content-Type: application/json" -d '{"api_key": ""}' | jq

import httpx

c = httpx.Client(base_url="http://localhost:8080/gw", timeout=30)

cfg = c.get("/v1/glad/websearch/config").json()
print(cfg["provider"], cfg["key_source"], cfg["key_hint"])

if cfg["env_locked"]:
    raise SystemExit("key is pinned by the environment — change it there, not here")

r = c.post("/v1/glad/websearch/config", json={"api_key": "tvly-abc…wxyz"})
if r.status_code == 409:
    print(r.json()["error"])
else:
    print("stored:", r.json()["key_hint"])

const BASE = "http://localhost:8080/gw"

const cfg = await fetch(`${BASE}/v1/glad/websearch/config`).then(r => r.json())
if (cfg.env_locked) throw new Error("key is pinned by the environment")

const res = await fetch(`${BASE}/v1/glad/websearch/config`, {
  method: "POST",
  headers: { "Content-Type": "application/json" },
  body: JSON.stringify({ api_key: "tvly-abc…wxyz" }),
})
if (res.status === 409) console.warn((await res.json()).error)

What comes back

{
  "enabled": true,
  "provider": "tavily",
  "has_key": true,
  "key_hint": "tvly-ab…wxyz",
  "key_source": "file",
  "env_locked": false
}

Routes¶

How it works¶

1. Search — the gateway queries a search provider (see below).
2. Fetch — each result page is downloaded and its readable text extracted (scripts/nav/boilerplate stripped).
3. Screen — each page is scored on the firewall axes. A page is blocked if it trips rag_jailbreak, answer_safety, prompt_safety, or jailbreak.
4. Ground — the surviving safe pages become the grounding context (verified again by the normal halluc_context pass), and the model answers from them with Source 1, Source 2, … citations.
5. Stream events — in the chat UI you see, in real time, which pages were read vs blocked and why.

Search providers¶

The provider is chosen automatically: if a Tavily key is present, Tavily is used; otherwise DuckDuckGo. If a Tavily call fails for any reason, the gateway transparently falls back to DuckDuckGo rather than failing the whole feature.

Setting it up with a Tavily API key¶

1. Get a Tavily key¶

Create a free account at tavily.com and copy your API key — it looks like tvly-xxxxxxxxxxxxxxxxxxxx. The free tier is enough for evaluation; paid tiers raise the monthly search quota.

2. Provide the key to the gateway¶

There are three ways to configure the key. They are checked in this precedence order:

GW_WEBSEARCH_API_KEY=tvly-xxxxxxxxxxxxxxxxxxxx \
  python -m glad_minimal.gateway.geodesia_gateway --host 0.0.0.0 --port 8800 ...

GW_WEBSEARCH_API_KEY=tvly-xxxxxxxxxxxxxxxxxxxx

mkdir -p /app/var
printf '%s' 'tvly-xxxxxxxxxxxxxxxxxxxx' > /app/var/websearch_tavily.key
chmod 600 /app/var/websearch_tavily.key

3. (Optional) tune the provider¶

Force a provider or adjust limits with the environment variables below. Leaving everything unset gives the sensible defaults (Tavily when a key exists, 5 results, screen 6 pages).

4. Confirm it is live¶

curl -s http://localhost:8080/gw/v1/glad/websearch/config
# {"enabled": true, "provider": "tavily", "has_key": true, "key_hint": "tvly-ab…wxyz", "key_source": "file", "env_locked": false}

Then send a request with web_search: true — see Use it.

Streaming research events¶

When stream: true, the gateway emits research events before the answer so the UI can narrate the search:

If the search returns nothing usable (engine rate-limited, all pages unfetchable, or all blocked), the gateway instructs the model to answer from its own knowledge and append a one-line note that live results weren't available — rather than emitting a flat "I cannot search the web" refusal.

Environment variables¶