insane-search escalates a blocked fetch through four phases and stops at the paywall

Four phases, each one waiting for the previous to fail

The retry ladder is the whole design. Each phase runs only if the one before it fails or trips a blocking signal, so the cheap routes are always tried first. Phase 0 covers special public endpoints, platform APIs and feeds, that the plugin cannot discover generically, which means the popular sites get hardcoded knowledge while an ordinary site gets the generic ladder. Phase 1 is a set of lightweight probes: public API readers, syndication gateways, and mobile, `.json`, and `/rss` URL variants. Phase 2 switches transport identity. Phase 3 hands the page to a real headless browser for anything rendered by JavaScript. Then there is the exit, which is not a phase but a refusal: when a login or a paywall is detected the plugin reports authentication required rather than pretending to have read the page. Every response is also scanned for OGP and JSON-LD, so a partial page still yields a title, a summary, or a price.

Phase 2 impersonates a browser rather than swapping a User-Agent

The README is explicit that this is not a header swap. It builds a full browser identity, with a real TLS fingerprint, cookie warming, and a referer chain, and it does so through curl_cffi, trying safari, then chrome, then firefox in that order. Cookie warming means populating cookies the way a browsing session would, and a referer chain means presenting a plausible path into the page instead of a cold hit. There is a second trick in the same list: the plugin watches a real browser's network traffic and reuses the site's own internal JSON, which is how it reaches endpoints that no public page links to. All of this is aimed at 403 responses, WAF rules, and anti-bot or CAPTCHA challenges, and it is the part of the tool where the legal weight sits. The project's own boundary section answers it in one line: the reader is for public content, the routes used are no-auth public endpoints and documented techniques, and whether that is lawful at a given site is the reader's problem.

The install command points at a different repository than this one

You cannot install this repository directly. The documented sequence adds a marketplace hosted somewhere else, then installs one plugin out of it, then reloads.

/plugin marketplace add https://github.com/fivetaku/gptaku_plugins.git
/plugin install insane-search@gptaku-plugins
/reload-plugins

The marketplace lives in the gptaku_plugins repository, and the footer here says this project is part of that collection of Claude Code plugins. So the tree you can read is the plugin source, while what actually loads into your editor arrives through a marketplace index in another repository. Reading the code in this repository is not the same as reviewing the code that runs, and the version of the plugin you get depends on what that other repository publishes. The plugin manifest lives in `.claude-plugin/` at the root here, next to `skills/`, `setup/`, and `assets/`, which is the shape Claude Code expects for a packaged plugin rather than a script you run yourself.

It installs packages into your machine the first time a page is blocked

The zero setup claim has a second half worth reading. The plugin auto-installs what it needs on first use, naming curl_cffi and yt-dlp in the list with an ellipsis after them, and the setup section repeats that there are no commands to learn and no API keys, no signup, and no proxy setup. Nothing asks first. A tool whose whole job is fetching pages will therefore pull new Python packages into your environment at the moment a fetch fails, and the README mentions this once in a bullet and once in a table row about missing tools. That is a supply chain surface attached to an anti-detection stack: the TLS impersonation library, the media downloader, and whatever follows the ellipsis all arrive on demand. A reader who wants to know exactly what lands on the machine has to resolve those dependencies before the first blocked fetch, not after.

It uses whatever xAI credentials are already lying around

The no API keys promise has a qualification attached to it in the same paragraph that explains the X route. Keyword discovery for X goes through free Brave and Yahoo discovery plus tweet-result validation, and then the sentence adds that if xAI credentials are already available, discovery is automatically augmented with the native `x_search`, while the free route stays active and can be forced by setting `INSANE_SEARCH_XAI=off`. Read together, those two sentences say the plugin reads the environment it finds itself in and spends any xAI credentials it discovers, without being configured to do so and without asking. That is a reasonable design for a tool running inside someone else's agent, and it is also the behaviour to be aware of, because an ambient secret gets used the first time somebody searches for posts. Turning it off is a single environment variable, and it is the only knob of this kind the project documents.

The pitch line and the boundary row cancel each other out

The headline says impossible is nothing and that if it is public, insane-search gets in. Two tables later, the same document has a row where the login wall or paywall column is a cross for Claude Code alone and a cross for the plugin as well, annotated that it stops here and says so. That is the honest core of the tool: it escalates across public routes and refuses to cross the line where content stops being public. The same comparison table also makes claims about the default fetcher that nothing here measures, saying it gives up on a 403, stops at an anti-bot challenge, and returns no transcript for a media page. Those are assertions about another product's behaviour, presented in the same table as the plugin's own phases, and the repository holds no benchmark, no test result, and no measurement behind any of them. The one claim the document does support is structural: it keeps trying public routes until one works.

The old flag still drops the body and the new one wraps it

Version v0.16.3, released on 2026-09-08, changed how output is shaped. The new `--json-content` switch returns metadata, the trace, and the wrapped untrusted text in a single fetch, so diagnostics no longer need a second request for the same URL, and the existing `--json` output still omits the body. That last clause is the part to notice: the old flag remains the default way to get structured data and it still leaves the content out, so an integration has to move to the new flag before it can see the text it just paid a round trip for. The word wrapped matters too, since the text arrives labelled untrusted before it is handed to the model. The same release made the PDF parsers lazy, so pdfplumber and pypdf load only when a PDF actually needs extracting rather than during ordinary HTML startup, with PDF extraction and fallback behaviour preserved.

MIT in the license file, acceptable use in another one

The license line reads MIT and then sends you to DISCLAIMER.md for acceptable use and user responsibility terms, which is an unusual split: the grant lives in LICENSE and the rules live in a document the grant does not incorporate. The README also puts the dual use label on it and points at a supported platform list in PLATFORMS.md covering X, Reddit, YouTube, Hacker News, Naver, Coupang, LinkedIn, Medium, Substack, arXiv, GitHub, Stack Overflow, Bluesky, and Mastodon, plus any site with a public page, feed, or `/rss`. Alongside that sit five copies of the README in English, Korean, Chinese, Japanese, and Spanish, a CHANGELOG.md, and a `skills/` directory. The release history is three tags in five days: v0.16.1 on 2026-09-04 masking credentials in logged URLs, v0.16.2 on 2026-09-06 reaching portal hosts through their mobile twin, and v0.16.3 on 2026-09-08, with the branch itself last pushed on 2026-09-28, three weeks later.

Editorial conclusion

Read the terms of the sites you point this at before you install it, since the project itself puts each site's Terms of Service, robots.txt, rate limits, and applicable law on the reader, and says in its own README that a login wall or paywall is where it stops. Then check three things the documentation mentions in passing: the plugin installs curl_cffi and yt-dlp into your machine on first use, it picks up xAI credentials already present in your environment unless you set INSANE_SEARCH_XAI=off, and the code you can read here is not the code the install command pulls, since the marketplace lives in the gptaku_plugins repository.

Frequently asked questions

Official sources

1. fivetaku/insane-search on GitHub
2. License: MIT
3. Project website
4. README
5. Releases