web_search searches the web with your configured provider and returns
normalized results, cached by query for 15 minutes (configurable). OpenClaw
also bundles x_search for X (formerly Twitter) posts and web_fetch for
lightweight URL fetching. web_fetch always runs locally; web_search routes
through xAI Responses when Grok is the provider, and x_search always uses
xAI Responses.
web_search is a lightweight HTTP tool, not browser automation. For
JS-heavy sites or logins, use the Web Browser. For
fetching a specific URL, use Web Fetch.Quick start
1
Choose a provider
Pick a provider and complete any required setup. Some providers are
key-free, others need an API key. See the provider pages below for
details.
2
Configure
BRAVE_API_KEY) and skip this step.3
Use it
Choosing a provider
Brave Search
Structured results with snippets. Supports
llm-context mode, country/language filters. Free tier available.Codex Hosted Search
AI-synthesized grounded answers through your Codex app-server account.
DuckDuckGo
Key-free provider. No API key needed. Unofficial HTML-based integration.
Exa
Neural + keyword search with content extraction (highlights, text, summaries).
Firecrawl
Structured results. Best paired with
firecrawl_search and firecrawl_scrape for deep extraction.Gemini
AI-synthesized answers with citations via Google Search grounding.
Grok
AI-synthesized answers with citations via xAI web grounding.
Kimi
AI-synthesized answers with citations via Moonshot web search; ungrounded chat fallbacks fail explicitly.
MiniMax Search
Structured results via the MiniMax Token Plan search API.
Ollama Web Search
Search via a signed-in local Ollama host or the hosted Ollama API.
Parallel
Paid Parallel Search API (
PARALLEL_API_KEY); higher rate limits and objective tuning.Parallel Search (Free)
Key-free opt-in. Parallel’s free Search MCP, with LLM-optimized dense excerpts and no API key.
Perplexity
Structured results with content extraction controls and domain filtering.
SearXNG
Self-hosted meta-search. No API key needed. Aggregates Google, Bing, DuckDuckGo, and more.
Tavily
Structured results with search depth, topic filtering, and
tavily_extract for URL extraction.Provider comparison
Result shape
web_search normalizes every bundled and external plugin provider at the core
tool boundary. Callers receive exactly one of these closed shapes:
kind: "results"; synthesized providers use
kind: "answer". External plugin providers whose payloads match neither shape
pass through verbatim as kind: "raw" for compatibility. Provider-specific
fields such as raw scores, excerpts, related searches, inline-citation
offsets, model ids, or session metadata are not passed through on normalized
branches. Use a provider’s dedicated tool when its richer response is part of
your workflow.
externalContent.wrapped: true is a trust marker the boundary itself makes
true: provider prose (title, snippet, siteName, content, citation
titles, error message) is stripped of any pre-existing envelope lines and
re-wrapped exactly once at the core boundary, so no provider metadata can spoof
the marker. query is always the requested query, citation and result URLs
must parse as http(s), published must be ISO-date shaped, URLs are emitted canonicalized, and a
payload carrying an error key is always reported as kind: "error" with the
raw provider code preserved inside the wrapped message. Raw passthrough
payloads keep whatever markers the provider set.
Auto-detection
Provider lists in docs and setup flows are alphabetical. Auto-detection uses a separate, fixed precedence order and only picks a provider that needs a credential (requiresCredential !== false) when it finds one configured. If
no provider is set, OpenClaw checks providers in this order and uses the
first one that is ready:
API-backed providers first:
- Brave —
BRAVE_API_KEYorplugins.entries.brave.config.webSearch.apiKey(order 10) - MiniMax Search —
MINIMAX_CODE_PLAN_KEY/MINIMAX_CODING_API_KEY/MINIMAX_OAUTH_TOKEN/MINIMAX_API_KEYorplugins.entries.minimax.config.webSearch.apiKey(order 15) - Gemini —
plugins.entries.google.config.webSearch.apiKey,GEMINI_API_KEY, ormodels.providers.google.apiKey(order 20) - Grok — xAI OAuth,
XAI_API_KEY, orplugins.entries.xai.config.webSearch.apiKey(order 30) - Kimi —
KIMI_API_KEY/MOONSHOT_API_KEYorplugins.entries.moonshot.config.webSearch.apiKey(order 40) - Perplexity —
PERPLEXITY_API_KEY/OPENROUTER_API_KEYorplugins.entries.perplexity.config.webSearch.apiKey(order 50) - Firecrawl —
FIRECRAWL_API_KEYorplugins.entries.firecrawl.config.webSearch.apiKey(order 60) - Exa —
EXA_API_KEYorplugins.entries.exa.config.webSearch.apiKey; optionalplugins.entries.exa.config.webSearch.baseUrloverrides the Exa endpoint (order 65) - Tavily —
TAVILY_API_KEYorplugins.entries.tavily.config.webSearch.apiKey(order 70) - Parallel — paid Parallel Search API via
PARALLEL_API_KEYorplugins.entries.parallel.config.webSearch.apiKey; optionalplugins.entries.parallel.config.webSearch.baseUrloverrides the endpoint (order 75)
- SearXNG —
SEARXNG_BASE_URLorplugins.entries.searxng.config.webSearch.baseUrl(order 200)
tools.web.search.provider or through
openclaw configure --section web. OpenClaw does not send managed
web_search queries to a key-free provider just because no API-backed
provider is configured.
OpenAI Responses models are an exception: while tools.web.search.provider
is unset, they use OpenAI’s native web search instead of the managed
providers above (see below). Set tools.web.search.provider to
parallel-free (or another provider) to route them through the managed path
instead.
All provider key fields support SecretRef objects. Plugin-scoped SecretRefs
under
plugins.entries.<plugin>.config.webSearch.apiKey are resolved for the
installed API-backed web search providers, including Brave, Exa, Firecrawl,
Gemini, Grok, Kimi, MiniMax, Parallel, Perplexity, and Tavily,
whether the provider is picked explicitly via tools.web.search.provider or
selected through auto-detect. In auto-detect mode, OpenClaw resolves only the
selected provider key — non-selected SecretRefs stay inactive, so you can
keep multiple providers configured without paying resolution cost for the
ones you are not using.Native OpenAI web search
Direct OpenAI Responses models (api: "openai-responses", provider openai,
no base URL or an official OpenAI API base URL) use OpenAI’s hosted
web_search tool automatically when OpenClaw web search is enabled and no
managed provider is pinned. This is provider-owned behavior in the bundled
OpenAI plugin and does not apply to OpenAI-compatible proxy base URLs or Azure
routes. Set tools.web.search.provider to another provider such as brave to
keep the managed web_search tool for OpenAI models, or set
tools.web.search.enabled: false to disable both managed search and native
OpenAI search.
Native Codex web search
The Codex app-server runtime uses Codex’s hostedweb_search tool automatically
when web search is enabled and no managed provider is selected. Native hosted
search and OpenClaw’s managed web_search dynamic tool are mutually exclusive,
so managed search cannot bypass native domain restrictions. OpenClaw uses the
managed tool when hosted search is unavailable, explicitly disabled, or
replaced by a selected managed provider. OpenClaw keeps Codex’s standalone
web.run extension disabled (features.standalone_web_search: false)
because production app-server traffic rejects its user-defined web
namespace.
- Configure native search under
tools.web.search.openaiCodex - Set
tools.web.search.provider: "codex"to provision Codex Hosted Search as the managedweb_searchprovider for any parent model. Each call runs a bounded ephemeral Codex app-server turn and fails if Codex does not emit a hostedwebSearchitem. mode: "cached"is the default preference, but Codex resolves it to live external access for unrestricted app-server turns; set"live"to request live access explicitly- Set
tools.web.search.providerto a managed provider such asbraveto use OpenClaw’s managedweb_searchinstead - Set
tools.web.search.openaiCodex.enabled: falseto opt out of Codex-hosted search; other managed providers remain available - Restricting the Codex native tool surface also keeps managed
web_searchavailable - When
allowedDomainsis set, automatic managed fallback fails closed if hosted search is unavailable so the native allowlist cannot be bypassed - Tool-disabled LLM-only runs disable both native and managed search
tools.web.search.enabled: falsedisables both managed and native search
web_search tool. That separate path remains opt-in through
tools.web.search.openaiCodex.enabled: true and only applies to eligible
openai/* models using api: "openai-chatgpt-responses".
web_search fallback through OpenClaw’s dynamic tool namespace.
Use an explicit managed provider when you need OpenClaw’s provider-specific
network controls instead of Codex-hosted search.
Selecting provider: "codex" enables the bundled codex plugin and uses the
same tools.web.search.openaiCodex restrictions shown above. Authenticate the
Codex app-server first with openclaw models auth login --provider openai.
The parent agent can use any model or runtime; only the bounded search worker
runs through Codex.
Network safety
Managed HTTPweb_search provider calls use OpenClaw’s guarded fetch path,
scoped to the current provider’s own hostname. For that hostname only,
OpenClaw allows Surge, Clash, and sing-box fake-IP DNS answers in
198.18.0.0/15 and fc00::/7. Other private, loopback, link-local, and
metadata destinations remain blocked. Codex Hosted Search is the exception:
its bounded worker delegates network access to Codex app-server’s hosted
web_search tool.
This automatic allowance does not apply to arbitrary web_fetch URLs. For
web_fetch, enable tools.web.fetch.ssrfPolicy.allowRfc2544BenchmarkRange and
tools.web.fetch.ssrfPolicy.allowIpv6UniqueLocalRange explicitly only when your
trusted proxy owns those synthetic ranges.
Config
plugins.entries.<plugin>.config.webSearch.*. Gemini can also reuse
models.providers.google.apiKey and models.providers.google.baseUrl as lower-priority
fallbacks after its dedicated web-search config and GEMINI_API_KEY. See the
provider pages for examples.
Grok can also reuse an xAI OAuth auth profile from openclaw models auth login --provider xai --method oauth; API-key config remains the fallback.
tools.web.search.provider is validated against the web-search provider ids
declared by bundled and installed plugin manifests. A typo such as "brvae"
fails config validation instead of silently falling back to auto-detection. If a
configured provider only has stale plugin evidence, such as a leftover
plugins.entries.<plugin> block after uninstalling a third-party plugin,
OpenClaw keeps startup resilient and reports a warning so you can reinstall the
plugin or run openclaw doctor --fix to clean up the stale config.
web_fetch fallback provider selection is separate:
- choose it with
tools.web.fetch.provider - or omit that field and let OpenClaw auto-detect the first ready web-fetch provider from configured credentials
- non-sandboxed
web_fetchcan use installed plugin providers that declarecontracts.webFetchProviders; sandboxed fetches allow bundled providers and verified official plugin installs, but exclude third-party external plugins - the official Firecrawl plugin is the only bundled
webFetchProviderscontributor today, configured underplugins.entries.firecrawl.config.webFetch.*
openclaw onboard or
openclaw configure --section web, OpenClaw can also ask for:
- the Moonshot API region (
https://api.moonshot.ai/v1orhttps://api.moonshot.cn/v1) - the default Kimi web-search model (defaults to
kimi-k2.6)
x_search, configure plugins.entries.xai.config.xSearch.*. It uses the
same xAI auth profile as chat, or the XAI_API_KEY / plugin web-search
credential used by Grok web search.
Legacy tools.web.x_search.* config is auto-migrated by openclaw doctor --fix.
When you choose Grok during openclaw onboard or openclaw configure --section web,
OpenClaw also offers optional x_search setup with the same credential right
after Grok setup completes. This is a separate follow-up step inside the Grok
path, not a separate top-level web-search provider choice. If you pick another
provider, OpenClaw does not show the x_search prompt.
Storing API keys
- Config file
- Environment variable
Run
openclaw configure --section web or set the key directly:Tool parameters
x_search
x_search queries X (formerly Twitter) posts using xAI and returns
AI-synthesized answers with citations. It accepts natural-language queries and
optional structured filters. OpenClaw constructs the built-in xAI x_search
tool per request rather than keeping it permanently registered, so it is only
active for the turn that actually calls it.
xAI documents
x_search as supporting keyword search, semantic search, user
search, and thread fetch. For per-post engagement stats such as reposts,
replies, bookmarks, or views, prefer a targeted lookup for the exact post URL
or status ID. Broad keyword searches may find the right post but return less
complete per-post metadata. A good pattern is: locate the post first, then
run a second x_search query focused on that exact post.x_search config
Withenabled omitted, x_search is exposed only when the active model’s
provider is xai and xAI credentials resolve. For an active model with a known
non-xAI provider, set plugins.entries.xai.config.xSearch.enabled to true to
opt in to cross-provider use. If the active model provider is missing or
unresolved, the tool stays hidden. Set enabled to false to disable it for
every provider. xAI credentials are always required.
x_search posts to <baseUrl>/responses when
plugins.entries.xai.config.xSearch.baseUrl is set. If that field is omitted,
it falls back to plugins.entries.xai.config.webSearch.baseUrl, then the
public xAI endpoint (https://api.x.ai/v1).
x_search parameters
allowed_x_handles and excluded_x_handles are mutually exclusive.
x_search example
Examples
Tool profiles
If you use tool profiles or allowlists, addweb_search, x_search, or group:web:
Related
- Web Fetch — fetch a URL and extract readable content
- Web Browser — full browser automation for JS-heavy sites
- Grok Search — Grok as the
web_searchprovider - Ollama Web Search — key-free web search through your Ollama host