Realurls
This server lets you check whether a given URL/domain is the verified official website of a software product, AI tool, or company, and look up an organization's verified official website by name.
verify_url(url): Submit a URL or bare domain and get a verdict:
official,not_official(with the real official domains),insufficient_evidence, orunknown. It judges domain ownership only, never safety.get_official_url(name): Search by product, tool, or company name (e.g. "Ollama", "Claude Code") to retrieve verified official URLs along with the evidence supporting them, or a message that the site could not be confirmed.
Both operations are evidence-backed and based on the Realurls registry, which uses reproducible machine evidence to determine which domain belongs to which organization.
Realurls registry
An open registry of which domain belongs to which organization. Every claim is backed by reproducible machine evidence and delivered straight into the paths AI agents actually use — MCP and a plain HTTP API.
Ownership only, never safety. We would rather say "don't know" than be wrong.
Site: https://realurls.org · API: https://api.realurls.org · MCP: npx -y @realurls/mcp · Signed dataset: latest release
中文说明见 docs/zh/README.md。
Why this exists
AI assistants and search engines increasingly answer "what is X's official site?" and "where do I download X?". In 2026 that path was attacked in public: an SEO-poisoning campaign pushed fake download sites to the top of search results (the Black Cat campaign infected roughly 278,000 machines), security vendors documented lookalike sites impersonating Claude Code and Gemini CLI, and Microsoft confirmed cases where users asking an LLM for a download link were sent to attacker-controlled domains.
The root cause is simple: there is no open, programmable, evidence-backed source of truth for "which domain is really theirs".
The blacklist side is saturated (PhishTank, Phishing.Database, openSquat…). Those answer "is this domain bad?". Realurls answers the other question: "who does this domain belong to?"
Related MCP server: domainintel-mcp
How this differs from a curated list
A list says "trust me, this is the official site". We say "here are five independent pieces of evidence, with the commands — run them yourself".
# Why we say anthropic.com belongs to Anthropic — check it yourself
curl -s https://api.github.com/orgs/anthropics | jq '{name, blog, is_verified}'
# {"name":"Anthropic","blog":"https://anthropic.com","is_verified":true}
# ↑ GitHub already performed a DNS-level domain-control check for usThe full trust model is in TRUST.md; the decision rules are in POLICY.md.
Status
✅ M0 TRUST.md / POLICY.md / policy.py / positive + adversarial regression tests
✅ M1 Evidence pipeline; `python -m src.verify <domain>` end to end
✅ Review fixes entity anchoring / fail-closed domain age / A6 first-party link / A3 list / A7 gov TLD / +6 adversarial cases
✅ M2 220-org survey → 53 entities generated by the pipeline; daily re-verification; reproducible dist/ + cosign signatures
✅ M3 api.realurls.org live; @realurls/mcp on npm; listed in the official MCP Registry
✅ M4 realurls.org evidence pages, category browsing, /builders and /verify; browser extension built (store listing pending)
✅ M5 Scale-out: D1 storage, bulk sources, sharded batch builds, AI review layer, App Store anchor (A9), owner self-attestation,
on-demand examination of anything the API is asked about, remote MCP endpoint, aggregate demandFirst category was AI and developer tools. The registry is now expanding to every software company and open-source project with a real footprint, in reviewed batches. Target: 10,000+ organizations, browsable by category on realurls.org. Precision stays the only hard metric; coverage follows the evidence.
Quick start
pip install -e ".[dev]"
# The project needs no pytest plugins; isolate from any broken third-party plugin in your environment:
PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 pytest tests -q
python -m src.validate # validate entities/: schema, status recomputed from evidence, neutral wording, uniqueness
python -m src.revalidate # daily re-verification (CI runs it; locally use --dry-run --only <domain>)
python -m src.build # entities/ → dist/ (registry.json / domains.json / entities.json / domains.txt / sqlite / manifest)
# Verify one domain end to end and print the full evidence chain with reproduction commands
python -m src.verify anthropic.com
python -m src.verify claude.ai --anchor anthropic.com # propagation from a verified sibling
# Scaling: generate candidate seeds in batches, run the pipeline sharded, review, merge
python -m src.seeds --source github --min-stars 5000 --out-dir seeds --prefix gh # ~2,500 seeds per file
python -m src.build_entities seeds/gh-01.jsonl --shard 0/16 # one of 16 parallel runners
python -m src.review_ai --changed-since origin/main --dry-run # AI audit: flag-only, never promotesThe Build entities from seeds workflow runs the same thing across 16 runners and opens a bot pull request per batch; nothing reaches main before the rules regression and the 200-record manual sample pass.
from src.policy import DomainFacts, Evidence, decide
# Anchor the entity first (here: the result src/anchor.py derives from Wikidata Q116758847), then judge the domain
d = decide(
DomainFacts(domain="anthropic.com", age_days=9104,
expected_github_org="anthropics", expected_wikidata="Q116758847",
anchor_sources=("wikidata:Q116758847/P2037",)),
[
Evidence("A1", {"org": "anthropics", "org_verified": True, "blog": "https://anthropic.com"}),
Evidence("A3", {"registrar": "MarkMonitor Inc.", "remaining_days": 2584,
"locks": ["delete", "transfer", "update"]}),
Evidence("B1", {"qid": "Q116758847"}),
Evidence("B4", {"history_days": 1800}),
],
)
print(d.status, d.confidence, d.reasons)
# verified 0.9303 ['2 independent anchor(s) + 2 independent corroboration(s): meets the verified threshold']
# Without entity anchoring the same evidence is rejected — "proof of control is not proof of ownership"
d = decide(DomainFacts(domain="anthropic.com", age_days=9104), [...])
# provisional rejected=['A1: entity not anchored: …']Repository layout
TRUST.md ← read this first: what we verify, what we don't, how to reproduce, how to dispute
POLICY.md ← human-readable mirror of the decision rules
CHANGELOG.md ← rule changes with their effect on records; API and integration changes
SECURITY.md ← threat model, including threats to this repository itself
entities/ ← data (YAML, one file per entity). Never hand-edited; written only by the pipeline
src/policy.py ← the decision engine: the single source of truth
src/collectors/ ← evidence collectors (they translate the outside world; they never judge)
tests/ ← positive cases + adversarial corpus of ways to fool the rules
api/ ← Cloudflare Worker serving api.realurls.org and realurls.org
mcp/ ← @realurls/mcp server
extension/ ← browser extension (Manifest V3)
docs/zh/ ← Chinese versions of the core documentsContributing
You contribute leads, not data. Open an issue; a bot collects the evidence and decides whether the record qualifies. See CONTRIBUTING.md.
If you control a domain, a single DNS TXT record (A5) overrides any verdict of ours.
License
Data (
entities/,dist/): CC BY-SA 4.0Code (
src/,tests/,api/,mcp/,extension/): MIT
Disclaimer
Realurls judges domain ownership only. It does not judge whether a site is safe, lawful, or any good. A domain marked verified means it really belongs to that organization — not that it is safe. For safety, rely on Google Safe Browsing, VirusTotal and similar services.
Available Tools
2 toolsget_official_urlA
Look up the verified official website for a software product, AI tool, or company by name. Returns verified URLs with the evidence behind them, or says the site could not be confirmed.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Product, tool, or company name, e.g. 'Ollama', 'Claude Code' |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full disclosure burden, and it does well: it reveals that results are 'verified', that evidence accompanies the URLs, and that it has an explicit failure mode ('says the site could not be confirmed'). It stops short of disclosing data freshness, rate limits, or whether it performs live web lookups, but the core behavioral traits are covered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with zero filler. The primary action is front-loaded in the first sentence, and the second sentence efficiently covers both the evidence behavior and the not-confirmed fallback.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter tool with full schema coverage, the description is nearly complete: it states the action, the return payload (verified URLs plus evidence), and the negative case. Minor gaps remain — no explicit routing to verify_url for URL-shaped inputs and no detail on the evidence format — but nothing an agent needs to make the call is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already documents the parameter with an illustrative example ('Ollama', 'Claude Code'). The description echoes 'by name' but adds no format or syntax detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('look up'), a specific resource ('verified official website'), and a precise scope ('software product, AI tool, or company by name'). The 'by name' phrasing cleanly differentiates it from the sibling verify_url, which presumably checks a URL rather than finding one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the use case: fetching a known product/tool/company's official site by name. However, it never explicitly contrasts this with verify_url or tells the agent when to choose one over the other (e.g., 'if you already have a URL, use verify_url instead'). The guidance is present only by inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_urlA
Check whether a URL or domain is the verified official website of a software product, AI tool, or company. Returns official | not_official (with the real official domains) | insufficient_evidence | unknown. Judges ownership only, never safety.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | URL or bare domain, e.g. https://claude-desktop.io/download |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It does well by specifying the exact return categories, noting that not_official comes with the real official domains, and clarifying that the tool judges ownership only and never safety. Some details like error handling or data source are absent, but the core behavior is transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three short sentences with no filler. It front-loads the primary action, then efficiently lists return values, and closes with a one-line scope boundary. Every sentence contributes useful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema, the description is complete: it tells the agent what input to provide, what the tool decides, what outputs are possible, and what the tool intentionally does not do. No additional context is needed to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single parameter, and the schema already explains that url accepts a URL or bare domain with an example. The description adds no new semantic detail beyond restating 'URL or domain,' so it meets the baseline but does not elevate it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Check whether') with a clear resource (URL or domain) and defines the exact judgment being made: verified official website of a software product, AI tool, or company. It also lists the possible return categories, making the tool's purpose unambiguous. It is readily distinguished from the sibling get_official_url, which conceptually retrieves a canonical URL rather than verifying a given one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool—whenever ownership verification of a URL/domain is needed—and explicitly excludes safety judgments. However, it does not mention the sibling tool get_official_url or state when to prefer one tool over the other, so the substitution/alternative guidance is only implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
2 tool updates
v0.0.1- First observed
get_official_url - First observed
verify_url
TDQS
The two tools have clearly distinct inputs and purposes: verify_url checks a given URL/domain against the official record, while get_official_url retrieves the official URL from a product or company name. No ambiguity exists between them.
Both tool names follow the same verb_noun pattern with snake_case: verify_url and get_official_url. The verbs ('verify', 'get') match the respective actions, creating a predictable and consistent naming convention.
With only two tools, the server feels slightly thin even though both tools cover the core domain of official URL verification and lookup. Each tool earns its place, but the small count leaves little room for broader utility or edge-case coverage.
The two tools cover the entire primary workflow: given a name, look up the official URL; given a candidate URL, verify its official status. There are no obvious gaps for a read-only service focused on official website verification.
Maintenance
Related MCP Connectors
MCP tools for AI agents: render URLs to image/PDF, check link health, convert HTML/CSV/JSON.
Search the agentic web. 4,100+ sites, 11 tools incl. check_url + verify_mcp for probe-before-use.
URL intelligence for AI agents and developers. 16 tools, 25 signal weights, 20 free checks.
Check whether a real-world fact can be verified before an agent acts on it. Free, no auth.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceValidates URLs and checks their reputation to help identify AI hallucinations and verify web page authenticity.MIT
- AlicenseAqualityCmaintenanceAn MCP server for domain intelligence — WHOIS, DNS records, SSL certificate inspection, SPF/DMARC validation, security-header audits, and blacklist/reputation checks, callable by AI agents. Powered by domainintel.app; runs server-side, no local setup.799MIT
- AlicenseBqualityAmaintenanceMCP search and evidence tool for AI agents. Rewrites queries, zooms into source domains, and returns sourced answers with metrics.13MIT

Nerq MCP Serverofficial
AlicenseNot gradedqualityCmaintenanceProvides trust scores, comparisons, and search for software entities, AI tools, packages, and MCP servers using Nerq's Trust Score system.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/zhouchungong/realurls-registry'
If you have feedback or need assistance with the MCP directory API, please join our Discord server