dsh-our-free-model Says You Need No API Key. It Sends “Bearer public” To OpenCode’s Gateway.

ddsh-our-free-model is a plugin for DeepSeek Harness that took 11,502 stars in 17 days, 7,081 of them in the last four, on one promise: frontier models with no login, no sign-up, no API key and no usage cap. It delivers. What it never says inside the app is whose servers answer.

Two gateways do. The free lane dials OpenCode’s Zen gateway with the literal header Authorization: Bearer public. But OpenCode’s own docs ask you to sign in, add billing details and paste a key. Meanwhile the second lane uses Kilo AI’s public free pool. Its model cards say the upstream may log prompts and use them to improve their services. A third lane unlocks when you star the repo.

None of that is hidden in the README. It’s just not in the picker you choose models from.

Best for anyone who installed this already and wants to know where their prompts went. Not ideal for work you can’t hand to a third party.

Free is a price, not a property. Somebody still pays for the tokens you spend. Ask who. That answer decides what happens to whatever you type.

For dsh-our-free-model, the answer sits in its own README, two scroll-screens past the install instructions. The plugin is a client. It hosts no models. Instead, every answer comes from one of two gateways owned by other companies. A third belongs to the person who wrote the plugin.

So we went and read all of it, then checked the gateways’ own documentation against what the plugin sends them. The results don’t match in one specific place and that mismatch is the thing worth your five minutes.

What It Actually Is

Then hold the fork ratio next to the star count for a second. 221 forks against 11,502 stars works out at 1.9% and anything under about 12% reads as bookmarking rather than building. So people are saving this one rather than running it and changing it.

Figures are from the GitHub API on October 12 at 11:37 AM. Everything else came out of the repository’s own README_EN.md, including every quote below. It runs to roughly 13,000 words and it’s one of the more candid documents we’ve read on a trending repo.

Whose Servers Answer

The README answers this directly. Specifically, its “Where the models come from” section names two public keyless upstreams. It prints the exact endpoints too, with the exact credential sent to each one.

The free lane posts to opencode.ai/zen/v1/chat/completions, /responses or /messages, picked per model. Its credential column then reads Authorization: Bearer public. The repo describes that as a public, key-free allowance and it notes the plugin holds no secret of yours. That part is true. There’s no account pool and no stolen key involved.

Similarly, the Kilo channel posts to api.kilo.ai/api/gateway/chat/completions, though it sends no credential at all. It uses the free slice of Kilo’s listing, the models flagged isFree: true, including an auto-router called kilo-auto/free.

Two other destinations exist and both are harmless. The announcement feed and update manifest come from this repository’s own feed/*.json over raw.githubusercontent.com with jsDelivr as a fallback. Finally, the region check pings api.ipify.org, ipinfo.io or ipapi.co for your own public IP and country code. That’s how it sorts geo-blocked models into a separate group instead of failing you mid-answer.

The App Won’t Tell You

Here’s where the docs earn praise and the product earns a question. Inside the app, though, the upstreams’ names never appear. Not in the picker, not in the settings page, not in the error copy. The one exception is the Kilo badge tooltip, which does mention logging, because that’s information you need while choosing.

So you install this, pick a model and start typing. Nothing on screen says your prompt is heading to OpenCode or to Kilo AI. Still, the repo calls this a naming convention. In practice it means the disclosure lives where the fewest users will ever look.

OpenCode’s Docs Ask For A Key

So we checked the other side. OpenCode Zen is real. Indeed it’s OpenCode’s curated model gateway and it does list a pile of models priced at zero. Big Pickle, Space Bunny Free, LongCat 2.5 Preview Free, MiMo-V2.6-Flash Free, Ling 3.1 Flash Free and Jev 1.13 Free are all on it.

But its setup instructions say to sign in, add billing details and copy an API key into /connect. Nowhere in OpenCode Zen’s documentation is there a public keyless allowance. There’s no documented path where an anonymous client sends the word public as a bearer token and gets frontier models back.

The plugin’s documentation says that lane is metered anyway. It describes the lane fingerprinting clients through x-opencode-* headers and metering usage per session. A disallowed region gets a 403. A spent allowance gets a 429. So something on OpenCode’s side clearly recognises these requests and rations them.

Obviously we won’t call that a terms violation. We haven’t read OpenCode’s terms against it. Neither has anyone else writing about this repo. So here’s the practical consequence instead. An undocumented keyless path is not a product with a roadmap. It’s a door that works until somebody closes it. The plugin’s own known-limitations section concedes the point: the model set and the quota policy belong to the upstream and can change any time.

If you build a workflow on this, build it so that losing the lane costs you an afternoon rather than a project.

Kilo Logs Prompts And Says So

Significantly, the second lane ships a written warning. The README quotes it verbatim from the kilo-auto/free model card: “Prompts may be logged by the upstream provider and used to improve their services. Not suitable for production or sensitive data workloads.”

That’s not VU’s characterisation. That’s the upstream’s own model card, reproduced in the plugin’s docs.

The plugin’s disclaimer then goes further than most vendors would. Basically, free doesn’t mean unlimited and it doesn’t mean private, it says. Never send passwords, keys, personal data or trade secrets through the free lanes, it says. Nothing you wouldn’t hand a stranger. For production and sensitive work, it says to use your own paid API.

Read that twice, because it’s the maintainer telling you the honest scope of their own project. A free lane is for messing about, for throwaway code, for the question you’d happily ask in public. It isn’t for your client’s codebase.

One Model Trades Prompts For The Discount

One more wrinkle turned up in OpenCode’s docs. Their free models actually carry different data terms from each other. Some follow a zero-retention policy. Others may use collected data to improve the model during the free period. Two Nemotron free models carry a trial-use-only label and an instruction not to submit personal or confidential data. And Muse Spark 1.3 Contributor Free earns its discount one way only: you grant permission to train future Meta models on your prompts and completions.

The plugin can’t fix that and it doesn’t pretend to. It just means “the free lane” isn’t one policy. It’s a dozen policies wearing the same label in one dropdown and the plugin’s picker doesn’t surface which is which.

Star The Repo, Unlock A Lane

A third channel exists, called EAC. It runs in the desktop builds only, unlike the other two. The maintainer hosts its gateway rather than a vendor, a host-fingerprint gate seals its credential and the server checks every turn against a GitHub authorization. You earn that authorization by signing into GitHub and starring the repo.

Besides the gate, the disclaimer calls it a shared, co-paid offer. Don’t bypass the gate, don’t resell access, then remember that abuse tightens the lane for everyone. As a funding model for somebody paying real inference bills out of pocket, that’s reasonable enough.

As a signal, however, it wrecks the star count. This repo gained 7,081 stars in four days against 221 forks total. Some unknown share of those stars came from people buying access rather than endorsing code. We rank Fresh Commits on star velocity, so we’ll say it out loud. Here stars work partly as currency. Read the number that way.

That’s a methodology note as much as a criticism. Any repo that rewards a star has taken its star count out of the signal business.

What dsh-our-free-model Gets Right

Although calling this a wrapper would be easy, it would be wrong. There’s real engineering in it.

The model roster re-fetches from upstream on every refresh rather than shipping a frozen snapshot. Say a gateway refuses a model outright with Model is unavailable or a 404 for that id. Then the plugin pulls it from the dropdown and logs the refusal with a timestamp. Failures that say nothing about the model leave it reachable: a 5xx, a 429, a timeout, a dropped connection. If a whole probe round refuses everything, nothing gets hidden, because an empty picker is worse than a stale one.

Thinking effort binds to real numbers instead of a string nobody honours. Light, Balanced and Deep map to output ceilings of 2,048, 8,192 and the model’s full capacity. Some models can’t switch thinking off, MiMo V2.6 among them. There the ladder doubles to 4,096 and 16,384, because thinking and the visible answer compete for one ceiling. Every model card prints the number it’s going to send.

The Parts Worth Keeping Anyway

Three features survive if the free lanes vanish tomorrow.

Firstly, the aggregate tab brings your own keys for 76 providers into the same picker. NVIDIA NIM, OpenRouter and Groq sit alongside Ollama, LM Studio and llama.cpp running locally. Keys live in the plugin’s own 0600 settings file, so nothing leaves the machine. The API echoes hasKey plus a four-character fingerprint rather than the key itself. Test probes a provider’s model listing, so it validates a key without spending a generation.

Secondly, the token savers are measured rather than claimed. Tool-output compaction rewrites tool_result content before the request goes out. The README reports a live run where a 40 KB git diff lost 90% of its bytes. The model still answered about the diff correctly. It never touches error results, never returns a replacement bigger than the input, then it passes the original through if a filter throws.

The local gateway speaks Anthropic’s /v1/messages natively alongside the OpenAI shapes, so Claude Code can point straight at it. The gateway page then generates copy-ready connection recipes from the port that actually bound.

A Push Channel Into Every Install

Two features need their own section. Together they open a live channel from one person’s keyboard into every machine running this.

The announcement center works like this. Basically the owner edits one JSON file and pushes. Every installation picks it up inside one poll cycle. Bodies then render as HTML through a strict allowlist. Items marked urgent open a full-screen modal. OS-level notifications are optional.

The in-app upgrader runs six steps: download, SHA-256 verification, backup, atomic replace, read-back and hot reload. Any failure at all rolls the whole thing back. Since v1.3.2 its trust root is an Ed25519 public key pinned inside the plugin rather than merely HTTPS to the repository, so a manifest has to carry the release key’s signature before anything installs. A poisoned mirror, jsDelivr included, produces a failed upgrade instead of executed code.

The README states the residual risk itself, which we’ll quote the sense of rather than soften: whoever holds the release private key can push arbitrary code, the same trust model as whoever can push the repository. A repository account takeover becomes a failed-upgrade outage for every user rather than direct remote code execution.

That’s a well-considered design and it’s also a thing you should know you’ve accepted. You’ve installed software that updates itself and can be shown full-screen HTML by its author, with the author’s signing key as the thing standing between you and whatever they push next.

Who Else Can Spend Your Quota

This one sits in the known-limitations list too. It’s the sharpest caveat in the document.

The plugin’s HTTP routes authenticate differently depending on how DeepSeek Harness is composed. With a connection service mounted, which covers dsh web and the AIO desktop build, the routes match the kernel’s own /api cookie or token. In minimal compositions without one, you get a structural fence instead, loopback plus same-origin and other local processes can still reach the routes.

That covers /forward/key and /forward/lan/key. So on such a setup, any local process can fetch both keys in one request and then spend your machine’s free quota from another machine entirely. The README says to treat the two keys as local-process-readable files there, at the same trust level as settings.json or to mount a connection service when you need real isolation.

Credit where it’s due, since the forwarding defaults are careful everywhere else. The listener binds loopback only, rejects keyless requests and refuses to bind a routable address at all. LAN access takes an explicit switch, every request including /health then needs a separate network key, keys are minted with crypto and compared with timingSafeEqual, the relay carries five whitelisted paths rather than proxying anything that answers and a request already carrying the hop marker gets a 508 so a relay can’t spin against itself.

The Speed You Should Expect

Patience is the fee. The README publishes its own latency measurements rather than burying them. You want those numbers before you switch your daily driver.

Specifically, nemotron-3.5-lightning-free measured over 30 seconds to first token in one run. mimo-v2.6-flash-free measured 60 to 70 seconds of silence while the lane billed 3,024 reasoning tokens and streamed not one reasoning frame, which ends the turn as a normal stop with nothing visible, which your client then reports as an empty response.

The plugin’s answer to that is heartbeats on the forward endpoint and the relay, which protect the connection rather than the timeout. A stall past 300 seconds still fails against pi-ai’s idle watchdog, because an SSE parser skips comment frames and the watchdog only resets on real content. Their recommendation is to raise the per-call output ceiling past 16k or pick a model the catalogue marks reasoning: false.

“No usage cap” also has an asterisk and again they print it. There’s no balance and no per-token billing to buy, but the lane is metered by session rate, so hammering it surfaces as a 429. The plugin marks the model quota-reached and clears that state on the next probe.

Verified vs Asserted

What You Should Actually Do

If It’s Already Installed

Firstly, open the settings page and look at which lane each model you use sits on. Kilo-badged models carry the logging notice. Then go back through your recent sessions and ask whether anything in them was a key, a credential, a client’s code or a document you don’t own. If so, rotate what can be rotated and stop using the free lanes for that work.

If You’re About To Install It

So decide first what you’ll be asking it. Hobby code, scratch scripts, learning something, throwaway questions: fine, go ahead, this plugin is a competent piece of work. Anything touching a client, an employer or a credential: skip the free lanes and configure the aggregate tab with your own key, which is the same plugin with none of the exposure.

If you’re weighing this against paying for something, read our Claude Pro review for what the paid tier buys you and our piece on GitHub Copilot’s AI training opt-out for how the same question plays out with a vendor that does publish its policy.

The Rule Worth Taking Away

Every free AI lane has somebody upstream paying for inference and that somebody wants one of three things: your data, your eventual money or your attention. None of those is sinister by itself, obviously. Still, all three change what you should send. Ask which one it is before you type, not after.

The relicensing lesson from Alibaba closing Qwen’s source applies here too. What’s generous today is a business decision tomorrow and a lane nobody documented can close without so much as a changelog entry. For tools that hold up over time, our GitHub repos for Claude Code list sticks to things that run on your own keys.

The Part Worth Keeping

dsh-our-free-model is better documented than most paid products. It names its upstreams, quotes the logging notice, publishes its own worst latency numbers, admits that any local process can read its forwarding keys in minimal setups and spells out that its release key is the trust root. That’s rare and it deserves saying.

The gap isn’t honesty. It’s placement. All of that lives in a 13,000-word README while the app shows you a clean dropdown with no vendor names in it and 11,502 people starred the pitch rather than the disclaimer. Free models work. They’re just not free of consequences and the consequences are documented where almost nobody reads.

Charts and Blocks

Four Destinations, Four Different Deals

1.9% Fork Ratio Against Its Own Trending Neighbours