GLM-5.2 Web Search: Which Z.ai Route Actually Works?

Evan Brooks

AI Infrastructure Editor

Editorial responsibility: GLM52.ai Editorial Team · Published and editorially reviewed July 28, 2026

How we research and review · Report a correction

Disclosed editorial pen name · AI-generated portrait

The short answer from the live test

Use the documented raw Web Search API when your application needs structured documents, Web Search in Chat when it needs a GLM-5.2 answer plus result metadata, and the Remote MCP when a supported coding client uses Coding Plan. All nine archived HTTP calls returned 200, but both generated answers cited a third-party pricing page after the prompt asked for official Z.ai sources. Citation-shaped output still needs claim-level source validation.

Original route diagram rendered from the tested interfaces. The measured evidence screenshot and sanitized data appear below.

“Add web search to GLM-5.2” sounds like one integration task. Z.ai currently exposes several surfaces that solve different parts of it. The raw Search API retrieves ranked records without asking GLM-5.2 to write an answer. Web Search in Chat retrieves records and lets the model synthesize them. The Coding Plan Remote MCP lets a compatible coding agent invoke a hosted search tool.

Treating those surfaces as interchangeable creates three avoidable failures: paying for generation when only documents were needed, depending on a Coding Plan route that is not documented as an application API, and rendering numeric citations without checking what each number actually references.

We tested the three product shapes on July 28, 2026, through a disposable Docker client. This guide publishes the request bodies, the MCP schema observed on the wire, a cost illustration, a source-domain validator, and the limitations of a one-query compatibility test.

Navigate the GLM-5.2 search route test

1. Distinguish the three product surfaces
2. Inspect the nine HTTP observations
3. Copy a raw Search API request
4. Add GLM-5.2 synthesis
5. Audit every answer reference
6. Configure the Coding Plan MCP
7. Respect the documented product boundary
8. Calculate the measured request
9. Troubleshoot each surface
10. Set production gates
11. Resolve route questions
12. Review sources and artifacts

Map the three search surfaces before coding

The Z.ai Web Search guide separates basic retrieval from retrieval-augmented generation. The Remote MCP guide adds a third distribution path for Coding Plan clients. The practical distinction is who owns synthesis and where the entitlement comes from:

Surface	Documented product	What comes back	Best fit
POST /api/paas/v4/web_search	Metered API	Structured titles, URLs, summaries and metadata	Your application ranks, filters or supplies documents to another pipeline
POST /api/paas/v4/chat/completions plus a web_search tool	Metered GLM-5.2 Chat	Model answer, token usage and a response-level web_search result array	A user needs a concise current answer and your application can validate its sources
https://api.z.ai/api/mcp/web_search_prime/mcp	Coding Plan Remote MCP	An MCP tool a compatible client can discover and call	OpenCode, Claude Code, Cline or another eligible coding workflow

The raw endpoint is not “GLM-5.2 with search.” It does not need a model ID because it is a retrieval service. Your code receives records and decides what to do with them.

Chat Search does use model: "glm-5.2". In the tested response, the generated text contained numeric references while the underlying records lived in the top-level web_search array. Preserve both. If an SDK returns only the message text, it may be hiding the evidence needed to resolve those references.

The MCP route is also not a model endpoint. A coding client connects to the server, negotiates an MCP protocol version, discovers web_search_prime, and calls that tool. GLM-5.2—or another model selected in the client—decides when the tool is useful. That is conceptually closer to an agent integration than to a Chat Completion request.

After search selects an acceptable URL, use the GLM-5.2 Web Reader API and MCP test to measure extraction fidelity, option behavior and the model-input boundary.

This page therefore complements the complete GLM-5.2 custom tool loop. A custom function is described and executed by your application; Z.ai’s search surfaces are hosted retrieval products with their own request and quota rules.

Read the nine-call route matrix

The final probe sent one benign query from one host with one account:

GLM-5.2 context window and API pricing official Z.ai documentation

It ran a raw request on the documented general endpoint, an observed raw Coding path, two Chat Search requests, a no-search control, and the four-call MCP handshake/tool sequence. Every archived HTTP call returned 200.

Case	HTTP	Client time	Observable result
Raw Search, general API	200	2.666 s	Five structured results
Raw Search, observed Coding path	200	3.077 s	Five structured results
GLM-5.2 Chat Search, general API	200	5.684 s	Five results; 525 total tokens
GLM-5.2 Chat Search, observed Coding path	200	5.567 s	Five results; 531 total tokens
Coding Chat without Search	200	2.472 s	Exact control marker; 21 tokens
MCP initialize	200	0.867 s	Session returned; protocol negotiated
MCP initialized notification	200	0.809 s	Accepted
MCP tools/list	200	0.812 s	One search tool
MCP tools/call	200	2.587 s	Search content returned

Across the nine calls, median client elapsed time was 2.587 seconds, with a 0.809–5.684 second range. Those numbers describe this run, not a latency benchmark, percentile, availability estimate or SLA. The Chat requests do more work than raw retrieval, while the MCP rows are individual protocol exchanges; comparing them as if they were identical workloads would be misleading.

The raw general and raw Coding requests happened to return the same five public records. That observation is useful for diagnosing an account today, but it does not make the Coding path a published REST contract. The documented boundary matters more than a permissive 200.

Actual evidence view rendered from the sanitized result archive. It is not a Z.ai dashboard and contains no credential, response ID or account identifier.

The probe ran as UID/GID 1000 in a digest-pinned container with a read-only root filesystem, dropped Linux capabilities, 256 MiB memory, one CPU, a 64-PID ceiling and a no-exec temporary filesystem. The host’s known Docker bridge DNS failure required the documented host-network exception for trusted outbound HTTPS. No port was published, every container used --rm, and the post-test task container list was empty.

Use the raw Search API when you need documents

The current Web Search API reference documents search-prime, a result count from 1 through 50, domain and recency filters, and structured result metadata. A minimal request can stay outside an SDK:

export ZAI_API_KEY='replace-in-your-shell'

curl --fail-with-body --silent --show-error \
  https://api.z.ai/api/paas/v4/web_search \
  -H "Authorization: Bearer ${ZAI_API_KEY}" \
  -H 'Content-Type: application/json' \
  --data '{
    "search_engine": "search-prime",
    "search_query": "GLM-5.2 context window official Z.ai",
    "count": 5,
    "search_domain_filter": "docs.z.ai",
    "search_recency_filter": "noLimit",
    "request_id": "docs-glm52-001",
    "user_id": "docs-reader"
  }'

Keep the key in a secret store or process environment, never in a checked-in JSON file. Give request_id an application-specific, non-sensitive value so logs can correlate one search without exposing a user prompt. Use a pseudonymous user_id if the product requires one; do not place an email address or account name there.

A successful response contains search_result entries rather than a model message:

{
  "search_result": [
    {
      "title": "GLM-5.2 - Overview",
      "link": "https://docs.z.ai/guides/llm/glm-5.2",
      "refer": "ref_1",
      "publish_date": null,
      "content": "<search summary>"
    }
  ]
}

Validate each URL, cap summary length, remove unsafe markup, and keep retrieval separate from execution. A search result can contain prompt injection, stale claims or instructions aimed at an agent. It is evidence to inspect, not trusted control text.

Raw retrieval is usually the right primitive for a research index, a source picker, a reranker, or a pipeline that will feed several models. It also lets you discard disallowed domains before paying a model to read them.

Add GLM-5.2 when the application needs synthesis

Web Search in Chat combines retrieval with GLM-5.2 generation. The tested request used the general Chat endpoint and asked the response to expose search records:

import json
import os
import urllib.request

endpoint = "https://api.z.ai/api/paas/v4/chat/completions"
payload = {
    "model": "glm-5.2",
    "messages": [{
        "role": "user",
        "content": (
            "Find official Z.ai pages for the GLM-5.2 context window "
            "and API pricing. Return two concise bullets with references."
        ),
    }],
    "tools": [{
        "type": "web_search",
        "web_search": {
            "enable": True,
            "search_engine": "search-prime",
            "search_result": True,
            "count": 5,
            "search_domain_filter": "docs.z.ai",
            "search_recency_filter": "noLimit",
            "content_size": "medium",
        },
    }],
    "thinking": {"type": "disabled"},
    "temperature": 0,
    "max_tokens": 512,
    "stream": False,
}
request = urllib.request.Request(
    endpoint,
    data=json.dumps(payload).encode(),
    headers={
        "Authorization": f"Bearer {os.environ['ZAI_API_KEY']}",
        "Content-Type": "application/json",
    },
    method="POST",
)
with urllib.request.urlopen(request, timeout=60) as response:
    body = json.load(response)

answer = body["choices"][0]["message"]["content"]
results = body.get("web_search", [])
print(answer)
print(json.dumps(results, indent=2))

The Chat Completion reference currently names Web Search in its tools union and documents the response-level result array. Its visible generated schema text also shows only function in one nearby tools.type enum. That internal documentation mismatch is a reason to test the exact payload against your route and pin a regression fixture—not a reason to invent an undocumented interpretation.

Set search_result: true whenever the application must inspect citations. If only the prose is retained, a reference such as [4] becomes decorative punctuation rather than traceable evidence.

Treat citations as data that need validation

Both tested Chat responses returned five result records and three numeric reference tokens. The prompt explicitly asked for official Z.ai pages. In both answers, the pricing sentence cited [4]; result four was a Requesty page, not z.ai or docs.z.ai.

The official Z.ai pricing page independently matched the numbers on the capture date. The model’s price happened to be correct, but its cited source violated the requested authority policy. This does not establish a general search-quality problem. It establishes one operational rule: a reference marker cannot validate itself.

Resolve every marker to its returned record and apply a source policy before rendering:

import re
from urllib.parse import urlparse

def approved_zai_source(url: str) -> bool:
    host = (urlparse(url).hostname or "").lower().rstrip(".")
    return host == "z.ai" or host.endswith(".z.ai")

def audit_numeric_references(answer: str, results: list[dict]) -> list[dict]:
    findings = []
    for token in sorted(set(re.findall(r"\[(\d+)\]", answer))):
        index = int(token) - 1
        result = results[index] if 0 <= index < len(results) else None
        url = result.get("link", "") if result else ""
        findings.append({
            "reference": f"[{token}]",
            "resolved": result is not None,
            "url": url,
            "approved": bool(result) and approved_zai_source(url),
        })
    return findings

findings = audit_numeric_references(answer, results)
if not findings or any(not row["approved"] for row in findings):
    raise RuntimeError("answer failed the official-source citation policy")

Domain approval is only one layer. A production verifier should also reject missing references, malformed or redirected URLs, stale pages for time-sensitive claims, a source that does not support the nearby sentence, and authority mismatch—for example, a reseller page cited as the model vendor’s official price.

When validation fails, do not quietly remove the citation and keep the sentence. Regenerate from approved records, replace the claim with a verified first-party fact, or tell the user that the available sources did not meet the policy.

Connect Coding Plan through the Remote MCP

Z.ai describes Web Search MCP as an exclusive Remote MCP for GLM Coding Plan users. The current Coding Plan overview says all plan tiers include the service in a combined MCP call pool: 100 monthly calls for Lite, 1,000 for Pro and 4,000 for Max on the page checked for this article. Verify current entitlements in your account before relying on those figures.

The official OpenCode shape is:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "web-search-prime": {
      "type": "remote",
      "url": "https://api.z.ai/api/mcp/web_search_prime/mcp",
      "headers": {
        "Authorization": "Bearer {env:ZAI_API_KEY}"
      }
    }
  }
}

The {env:ZAI_API_KEY} substitution is an OpenCode configuration feature; do not replace it with a literal key in a file you may commit or share. For the complete model provider and two-access-mode setup, follow the tested GLM-5.2 OpenCode guide.

At the protocol level, our client requested MCP 2025-03-26. The server returned 2024-11-05 and a session header. After the initialized notification, tools/list exposed exactly one tool:

{
  "name": "web_search_prime",
  "inputSchema": {
    "type": "object",
    "properties": {
      "search_query": {"type": "string"},
      "search_domain_filter": {"type": "string"},
      "search_recency_filter": {"type": "string"},
      "content_size": {"type": "string"},
      "location": {"type": "string"}
    },
    "required": ["search_query"],
    "additionalProperties": false
  }
}

The current prose documentation calls the tool webSearchPrime, while the live tools/list response used web_search_prime. Let the client discover the server’s tool name instead of hard-coding the prose spelling. Likewise, continue with the protocol version returned by initialization rather than assuming the version requested.

Separate documented access from observed compatibility

The API introduction separates the general API base from the Coding Plan base. The raw Web Search reference documents:

https://api.z.ai/api/paas/v4/web_search

The Coding Plan search documentation instead publishes the Remote MCP URL. Our account returned 200 for raw Search and Chat Search under the Coding API base too, but those rows remain observed compatibility, not a recommendation or entitlement claim.

An endpoint can be reachable because of account history, gateway reuse, a rollout or an implementation detail. None of those conditions is a durable product contract. Build metered application traffic against the documented general API. Use the documented Remote MCP inside supported Coding Plan clients and workflows. If a Z.ai support response grants another route to your account, preserve that written scope and add a canary.

The same distinction applies across the site’s 11-client GLM-5.2 agent matrix and Coding Plan versus API versus self-hosting decision guide: a credential that authenticates is not proof that every endpoint is included in the product you bought.

Relevant access decision

Choose the search product before choosing the key

Use the metered API for an application backend and Coding Plan for an eligible coding-client workflow. Confirm current search price, MCP allowance, model access and usage policy in your own account before production use.

Compare Z.ai GLM access →

Affiliate disclosure: This is an affiliate link. If you subscribe or purchase API access, GLM52.ai may receive a commission or credit. The relationship did not change the route matrix, source-policy failure, pricing arithmetic, or recommendation to follow documented product boundaries.

Calculate the metered request’s dominant cost

On July 28, 2026, Z.ai’s public price table listed GLM-5.2 at $1.40 per million input tokens, $0.26 per million cached input tokens, and $4.40 per million output tokens. Web Search was $0.01 per use.

The general Chat Search response reported 444 prompt tokens, zero cached tokens and 81 completion tokens:

model = (444 × $1.40 / 1,000,000)
      + ( 81 × $4.40 / 1,000,000)
      = $0.000978

one Web Search use + model = $0.010978
search share               = 91.09%
1,000 same-shape requests  = $10.978

For this small answer, the search call dominated the illustration. Longer generation, larger retrieved context, retries, caching and future prices change the ratio. The estimate excludes tax, credits, minimums and plan entitlements; it is reproducible arithmetic, not a bill or price guarantee.

If repeated static context surrounds every search prompt, the GLM-5.2 prompt-caching guide explains how to inspect cached-token telemetry. Use the interactive API cost calculator for different input and output volumes. Neither optimization removes the fixed per-use search component shown on the captured price page.

Diagnose Search API, Chat and MCP failures

A 401 or invalid-key response

Confirm the Authorization header is exactly Bearer <key> and contains no extra quotes or newline. Check which product issued the key: a Coding Plan credential is not automatically a metered API credential. Test only the documented endpoint for that product. If the key was ever logged or committed, revoke it rather than continuing to debug with a compromised secret.

Raw search returns an empty array

Remove an over-narrow domain filter, shorten the query, change the recency window from oneDay to noLimit, and verify that count is between 1 and 50. An empty result is not permission to fabricate an answer; report that retrieval did not produce evidence.

Chat responds but exposes no citations

Check that the request actually included the web_search tool and set search_result: true. Inspect the complete response object for the top-level web_search array. A message without mapped records should be labeled uncited even if it mentions a URL in prose.

Search results are present but the answer is stale

Apply a recency filter, ask for publication dates, and validate them in application code. A recently retrieved page can still repeat an old claim. For prices, limits and model capabilities, prefer first-party pages and store the verification date beside the fact.

MCP connects but the tool is missing

Complete initialize, retain the returned session header, send notifications/initialized, and then call tools/list. Negotiate the server’s returned protocol version. Confirm the current endpoint ends in /web_search_prime/mcp, because older SSE examples and older search paths still appear in parts of the documentation.

MCP calls fail after working earlier

Check the combined monthly MCP allowance, account activation, client HTTP-MCP support and proxy timeouts. Log sanitized JSON-RPC error codes, not Authorization headers or session IDs. Avoid a tight automatic retry loop: quota failures and invalid credentials are not transient network errors.

A coding route returns 200, so can the application depend on it?

No. Record the observation, but compare it with the current product documentation and your account contract. The safe deployment target is the documented route. “It accepted my request once” is a useful troubleshooting clue, not a policy grant.

Promote search only after these acceptance tests

A production integration should pass a versioned query set rather than one demo:

• positive queries with known first-party answers and negative queries with no acceptable evidence;
• exact reference-to-result mapping, including missing and out-of-range markers;
• domain, redirect, publication-date and claim-support checks;
• hostile page text that tries to override model or tool instructions;
• duplicate, empty, malformed and unusually large result records;
• separate raw retrieval, model generation and MCP quota/cost telemetry;
• endpoint, model ID, protocol version and client version recorded per run;
• hard caps for result count, summary size, output tokens, retries, wall time and spend;
• graceful behavior when Search succeeds but generation fails, and vice versa;
• credentials, response IDs, session IDs and private prompts excluded from public logs;
• current pricing and product entitlement rechecked before launch.

Also test the final user task. HTTP 200, a non-empty array and a fluent answer are transport or shape checks; none proves that the answer is current, that the citations support it, or that the user can safely act on it.

If the result becomes part of an autonomous agent, apply the permission and loop limits from the GLM-5.2 tool-calling implementation. Retrieval should inform a decision, never expand what the agent is authorized to do.

Answers to route-selection questions

Is Web Search built into GLM-5.2?

Z.ai exposes Web Search in Chat as a hosted tool alongside GLM-5.2. The raw Search API is a separate retrieval service, and the Coding Plan service is a Remote MCP. Saying only “built in” hides the endpoint, billing and client differences that matter in production.

Does raw Web Search require model: "glm-5.2"?

No. The documented raw request selects search-prime and sends a search query; it does not select a language model. Add GLM-5.2 through Chat Search or your own post-retrieval generation step when synthesis is needed.

Can Coding Plan Web Search be called outside a coding client?

The documented Coding Plan route is a Remote MCP for compatible coding clients and eligible workflows. A low-level MCP test is useful for verification, but it does not broaden the plan’s usage policy. Use the general metered API for an application backend.

Are numeric references enough for trustworthy answers?

No. The tested answers contained references, yet one claim mapped to a domain excluded by the prompt. Resolve markers against the returned records and validate the source at claim level.

Did this test rank search quality or reliability?

No. It used one query, one account, one key, one host and one date. It verified request compatibility, response shapes, one citation-policy failure, MCP negotiation and reproducible cost arithmetic. A quality or uptime claim needs a larger, blinded and repeated test set.

Evidence ledger and first-party references

The evidence was captured July 28, 2026. The two preliminary development executions stopped in local sanitization after making remote calls and may have consumed allowance; they are excluded from the nine-call final statistics. The final archive contains public result titles and URLs, short generated answers, schemas, timings, token counts and hashes. It omits the key, Authorization header, response IDs, session IDs, account data and model reasoning.

• Download the sanitized route data.
• Z.ai Web Search product guide.
• Z.ai raw Web Search API reference.
• Z.ai Chat Completion API reference.
• Z.ai API base and authentication introduction.
• Z.ai Coding Plan Web Search MCP guide.
• Z.ai Coding Plan overview and MCP allowances.
• Z.ai model and tool pricing.
• Z.ai GLM-5.2 model guide.

The public file is derived from the fuller repository evidence so readers can reproduce the displayed route matrix without receiving credentials or private response metadata. Re-run against your own account, current documentation and approved sources before relying on any route in production.

About the editorial role

Evan Brooks

AI Infrastructure Editor

Evan Brooks serves as GLM52.ai’s disclosed editorial pen name for infrastructure, deployment, and training guides. The role examines checkpoint size, memory math, provider limits, implementation evidence, and operational risk. The GLM52.ai Editorial Team produces and fact-checks every article under this byline.

The GLM52.ai Editorial Team accepts responsibility for this article. Read our editorial policy or request a correction.

An AI image tool created this portrait. It does not depict a real individual.