Realurls

io.github.zhouchungongPublished by GitHub account zhouchungongv0.1.5Updated Oct 24, 2026

Which domain officially belongs to which software product or company. Ownership only, never safety.

VerifiedSTDIODesktop onlyWeb Search & ScrapingSecurity & Monitoring

Overview

AI-generated overview

A discontinued stdio bridge that let an assistant check which domain officially belongs to a software product or company, and whether a pasted link is the real,

What you can do
Look up the official domain and verified URLs for a named software product or company, with a verdict of official, insufficient evidence or unknown. Check a pasted URL and get a verdict of official, not official (with the real domain) or unknown. Return a ready-to-use sentence for the user alongside each verdict, with URLs only on official results.
When to use it
Only if you want to inspect the archived read-only dataset, code and audits. As a live verification service it is not useful: since 2026-10-05 every answer is unknown and no domain is confirmed as official.
Requirements
Node.js with npx to run the npm package locally, or an MCP host that accepts a server URL. Network access to the remote endpoint; the REALURLS_API environment variable can point at a different API base URL. No account or key is declared.
Before you install
The service is discontinued: every API and MCP answer is unknown, so it cannot confirm any domain as official and nothing in the repository should be treated as current. The service stays up only as a notice until 2027-10-05. It claims ownership only, never safety.

Installation

In SourceWeft

  1. Open Realurls in the dashboard and add it to a workspace.
  2. Enable the server for the chats that should use its tools.

Desktop only via STDIO. STDIO servers start a local process, so they need the SourceWeft desktop host.

Other MCP clients

Follow the launch instructions in the repository.

README

@realurls/mcp

Discontinued on 2026-10-05. Realurls no longer verifies anything: every API and MCP answer is "unknown", and no domain is confirmed as official. Nothing in this repository about a domain should be treated as current. The registry reached 1,000 organizations and every record we audited was correct, but finding the proof that a domain is the real one is slow work per organization, coverage did not grow fast enough to justify it, and no one was relying on the service. What remains is read-only: the final signed dataset (release, CC BY-SA 4.0), the code and rules, and every audit. The service stays up as a notice until 2027-10-05, then is switched off.

MCP server that tells an AI agent which domain officially belongs to which software product or company — so it stops handing users SEO-poisoned lookalike download sites.

Since 0.1.5 this package is a thin stdio bridge to the remote endpoint https://api.realurls.org/mcp: instructions, tool definitions and every answer come from there, so the two ways of installing Realurls can never disagree. Hosts that accept a server URL can use the endpoint directly (Claude Code: claude mcp add --transport http realurls https://api.realurls.org/mcp).

Ownership only. Never a safety judgement. Read TRUST.md for exactly what we do and do not claim.

Tools

toolwhen the agent calls itreturns
get_official_url(name)before giving any download / login / official-site linkofficial + verified URLs, or insufficient_evidence / unknown
verify_url(url)user pastes a link and asks if it's realofficial / not_official (+ the real domain) / insufficient_evidence / unknown

The server ships instructions telling the host to call get_official_url even when it thinks it already knows the URL. In our tests that single line is what makes the difference: without it, agents answer well-known tools from memory and never verify.

Every result also carries say_to_user: the sentence the agent should give for that verdict ("I could not confirm the official site", "X is not a known domain of Y; Y's verified site is …"). Only official results contain URLs the agent may hand out.

Install

Claude Desktop — claude_desktop_config.json:

json
{ "mcpServers": { "realurls": { "command": "npx", "args": ["-y", "@realurls/mcp"] } } }

Claude Code:

bash
claude mcp add realurls -- npx -y @realurls/mcp

Point at a local API during development: REALURLS_API=http://127.0.0.1:8787.

What "official" means

official = the domain has ≥1 anchor (GitHub-verified org, DNS self-attestation, restricted government TLD, …) and ≥2 independent corroborations, all machine-reproducible. Anything less is reported as insufficient evidence — we would rather say "don't know" than be wrong.

Source: mcp/README.md at commit 5ead5c0

Tools

0
SourceWeft has not started this package in its sandbox yet, so its tools are not known.

Version history

1
  1. v0.1.5LatestSep 16, 2026

Score

40% of the applicable checks met

How complete this listing is, computed from the registry entry, the endpoint and public sources. Not a rating of the server and not a statement that it is safe or working today: reachability is a dated check, and no installs or reviews go into the score.

  • Reached in the last 30 days25 pts

    Keep the endpoint answering the MCP handshake; SourceWeft probes it every 30 days.

  • Auth declared10 pts

    Declare the credential headers in the registry entry, or keep the endpoint answering the probe so its auth can be classified.

  • Tools listed15 pts

    Answer tools/list without a credential, or ship a package that starts in a sandbox without one.

  • DescriptionRequired15 pts
  • Logo10 pts
  • Documentation15 pts
  • License10 pts

    Declare a license in the repository or the registry entry.