vxcontrol/pentagi · warning · Retryable

Sploitus API rate limit exceeded (HTTP %d), please try again

Error message

Sploitus API rate limit exceeded (HTTP %d), please try again later

What it means

Sploitus signals rate limiting with HTTP 499 and sometimes 422; the searcher maps both to a Retryable error (delay 0) telling the caller to try again later. This is deliberate: these statuses mean the limit is temporarily exceeded and may clear on retry or by switching to a fallback engine.

Source

Thrown at backend/pkg/tools/searchers/sploitus.go:162

	req.Header.Set("User-Agent", "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36")
	req.Header.Set("sec-ch-ua", `"Not:A-Brand";v="99", "Google Chrome";v="145", "Chromium";v="145"`)
	req.Header.Set("sec-ch-ua-mobile", "?0")
	req.Header.Set("sec-ch-ua-platform", `"macOS"`)
	req.Header.Set("sec-fetch-dest", "empty")
	req.Header.Set("sec-fetch-mode", "cors")
	req.Header.Set("sec-fetch-site", "same-origin")
	req.Header.Set("DNT", "1")

	resp, err := client.Do(req)
	if err != nil {
		return "", Retryable(fmt.Errorf("request to Sploitus failed: %w", err), 0)
	}
	defer resp.Body.Close()

	// Sploitus API returns 499 (and sometimes 422) when its rate limit is temporarily
	// exceeded — a transient condition that may clear on retry.
	if resp.StatusCode == 499 || resp.StatusCode == 422 {
		return "", Retryable(fmt.Errorf("Sploitus API rate limit exceeded (HTTP %d), please try again later", resp.StatusCode), 0)
	}

	if resp.StatusCode != http.StatusOK {
		err := fmt.Errorf("Sploitus API returned HTTP %d", resp.StatusCode)
		if resp.StatusCode == http.StatusTooManyRequests || resp.StatusCode >= 500 {
			return "", Retryable(err, 0)
		}
		return "", Fatal(err)
	}

	var apiResp sploitusResponse
	if err := json.NewDecoder(resp.Body).Decode(&apiResp); err != nil {
		return "", Fatal(fmt.Errorf("failed to decode Sploitus response: %w", err))
	}

	return formatSploitusResults(query, exploitType, limit, apiResp), nil
}

View on GitHub (pinned to ea665308ba)

Solutions

Back off and retry later; the error is already Retryable so the orchestrator fallback chain will try other engines
Reduce search frequency / add spacing between Sploitus queries in agent prompts or orchestration
Route egress through a different IP or proxy if the host IP is rate limited
Ensure other searchers are configured so web_search has fallbacks when Sploitus throttles

Defensive patterns

Strategy: retry

Try / catch

if resp.StatusCode == 499 || resp.StatusCode == 422 {
    // treat as transient: back off, then retry or use fallback engine
    return "", Retryable(fmt.Errorf("Sploitus API rate limit exceeded (HTTP %d)", resp.StatusCode), 0)
}

Prevention

Spread Sploitus queries over time instead of bursting from parallel agents
Keep fallback searchers configured in web_search.go fallbackStrategy
Monitor HTTP 499/422 frequency and alert on sustained throttling
Consider rotating egress IPs if a shared host IP trips limits

When it happens

Trigger: Handle() receives resp.StatusCode 499 or 422 from the POST to the Sploitus API while performing frequent exploit-title searches.

Common situations: Many flows/agents issue web_search calls in a burst, sharing one public IP (container host or corporate egress), tripping Sploitus' per-IP limit; Cloudflare fronting also returns 422 when challenged.

Related errors

AI-assisted analysis of vxcontrol/pentagi@ea665308ba (2026-09-01). Data as JSON: /api/errors/7f8948c77422a95b. Report an issue: GitHub.