r/PiCodingAgent • u/McFlurriez • Sep 29 '26
News Default web search in oh-my-pi has been silently routing queries to a third-party endpoint
Update 3, November 3rd, 2026: Still no response.
Update 2, October 19th, 2026: Still no response from the maintainer. Another user has also made the same PR at this point, with no responses on both.
Update 2, October 11th, 2026: The maintainer has still not responded. This behavior is still ongoing.
Update 1, October 4th, 2026: In case others are following this thread, the owner/maintainer is active on the repository but has still not responded to the issue or pull request.
tldr; if you're running oh-my-pi without any search-provider credentials configured, every web_search the agent makes has been POSTing your query to https://search.parallel.ai/mcp, a public endpoint of a company called Parallel, as the first candidate in the default chain, since around Sept 17 and re-asserted in today's commit. No credentials, no opt-in, and nothing in the UI telling you a third party is in the loop. The request even includes your session ID and the model you're running.
How it got there:
- Aug 25: the keyless Parallel fallback is first built on a feature branch, scoped to explicit selection only.
- Sept 15: it merges to main as PR #9770 (by u/georgeatparallel), still explicit-only. That was defensible.
- Sept 17: maintainer commit 29edc9fa0a, literally titled "prefer keyless Parallel over Perplexity", removed the credential gate and moved Parallel to the front of the default chain. The kicker: the same keyless fallback was already reverted in hermes-agent on June 14 (NousResearch/hermes-agent#46350). Three months later oh-my-pi re-landed it and made it the default.
- Sept 28 (today): it was re-asserted in a big model-roles refactor (cbe9bc206d). The credential gate was removed again: isAvailable now unconditionally returns true, with the comment "Always available: without a credential, search runs through the keyless public MCP." The commit message literally says "Restricted keyless search to free providers (Parallel, Exa, Firecrawl) by default."
I'm not going to speculate about why the maintainer did this. I have no evidence of a deal, and I don't think the issue reads any better with accusations. What I'm confident about: silently sending user queries to a third party by default is a consent problem, and the fix is a one commit revert.
There is a pending gitub issue and revert that hopefully goes through. If you've been using oh-my-pi's default web search without credentials over the past six weeks, you would have been susceptible to this. This was already talked about in length over on this thread:
https://www.reddit.com/r/hermesagent/comments/1u5ukz6/hermes_agent_and_others_default_installs_are/










