Realurls Registry MCP Server

Realurls registry

An open registry of which domain belongs to which organization. Every claim is backed by reproducible machine evidence and delivered straight into the paths AI agents actually use — MCP and a plain HTTP API.

Ownership only, never safety. We would rather say "don't know" than be wrong.

Site: https://realurls.org · API: https://api.realurls.org · MCP: npx -y @realurls/mcp · Signed dataset: latest release

中文说明见 docs/zh/README.md。

---

Why this exists

AI assistants and search engines increasingly answer "what is X's official site?" and "where do I download X?". In 2026 that path was attacked in public: an SEO-poisoning campaign pushed fake download sites to the top of search results (the Black Cat campaign infected roughly 278,000 machines), security vendors documented lookalike sites impersonating Claude Code and Gemini CLI, and Microsoft confirmed cases where users asking an LLM for a download link were sent to attacker-controlled domains.

The root cause is simple: there is no open, programmable, evidence-backed source of truth for "which domain is really theirs".

The blacklist side is saturated (PhishTank, Phishing.Database, openSquat…). Those answer "is this domain bad?". Realurls answers the other question: "who does this domain belong to?"

How this differs from a curated list

A list says "trust me, this is the official site". We say "here are five independent pieces of evidence, with the commands — run them yourself".

# Why we say anthropic.com belongs to Anthropic — check it yourself
curl -s https://api.github.com/orgs/anthropics | jq '{name, blog, is_verified}'
# {"name":"Anthropic","blog":"https://anthropic.com","is_verified":true}
#  ↑ GitHub already performed a DNS-level domain-control check for us

The full trust model is in TRUST.md; the decision rules are in POLICY.md.

Status

✅ M0  TRUST.md / POLICY.md / policy.py / positive + adversarial regression tests
✅ M1  Evidence pipeline; `python -m src.verify <domain>` end to end
✅ Review fixes  entity anchoring / fail-closed domain age / A6 first-party link / A3 list / A7 gov TLD / +6 adversarial cases
✅ M2  220-org survey → 53 entities generated by the pipeline; daily re-verification; reproducible dist/ + cosign signatures
✅ M3  api.realurls.org live; @realurls/mcp on npm; listed in the official MCP Registry
✅ M4  realurls.org evidence pages, category browsing, /builders and /verify; browser extension built (store listing pending)
✅ M5  Scale-out: D1 storage, bulk sources, sharded batch builds, AI review layer, App Store anchor (A9), owner self-attestation,
       on-demand examination of anything the API is asked about, remote MCP endpoint, aggregate demand

First category was AI and developer tools. The registry is now expanding to every software company and open-source project with a real footprint, in reviewed batches. Target: 10,000+ organizations, browsable by category on realurls.org. Precision stays the only hard metric; coverage follows the evidence.

Quick start

pip install -e ".[dev]"

# The project needs no pytest plugins; isolate from any broken third-party plugin in your environment:
PYTEST_DISABLE_PLUGIN_AUTOLOAD=1 pytest tests -q

python -m src.validate      # validate entities/: schema, status recomputed from evidence, neutral wording, uniqueness
python -m src.revalidate    # daily re-verification (CI runs it; locally use --dry-run --only <domain>)
python -m src.build         # entities/ → dist/ (registry.json / domains.json / entities.json / domains.txt / sqlite / manifest)

# Verify one domain end to end and print the full evidence chain with reproduction commands
python -m src.verify anthropic.com
python -m src.verify claude.ai --anchor anthropic.com     # propagation from a verified sibling

# Scaling: generate candidate seeds in batches, run the pipeline sharded, review, merge
python -m src.seeds --source github --min-stars 5000 --out-dir seeds --prefix gh   # ~2,500 seeds per file
python -m src.build_entities seeds/gh-01.jsonl --shard 0/16                          # one of 16 parallel runners
python -m src.review_ai --changed-since origin/main --dry-run                        # AI audit: flag-only, never promotes

The Build entities from seeds workflow runs the same thing across 16 runners and opens a bot pull request per batch; nothing reaches main before the rules regression and the 200-record manual sample pass.

from src.policy import DomainFacts, Evidence, decide

# Anchor the entity first (here: the result src/anchor.py derives from Wikidata Q116758847), then judge the domain
d = decide(
    DomainFacts(domain="anthropic.com", age_days=9104,
                expected_github_org="anthropics", expected_wikidata="Q116758847",
                anchor_sources=("wikidata:Q116758847/P2037",)),
    [
        Evidence("A1", {"org": "anthropics", "org_verified": True, "blog": "https://anthropic.com"}),
        Evidence("A3", {"registrar": "MarkMonitor Inc.", "remaining_days": 2584,
                        "locks": ["delete", "transfer", "update"]}),
        Evidence("B1", {"qid": "Q116758847"}),
        Evidence("B4", {"history_days": 1800}),
    ],
)
print(d.status, d.confidence, d.reasons)
# verified 0.9303 ['2 independent anchor(s) + 2 independent corroboration(s): meets the verified threshold']

# Without entity anchoring the same evidence is rejected — "proof of control is not proof of ownership"
d = decide(DomainFacts(domain="anthropic.com", age_days=9104), [...])
# provisional  rejected=['A1: entity not anchored: …']

Repository layout

TRUST.md              ← read this first: what we verify, what we don't, how to reproduce, how to dispute
POLICY.md             ← human-readable mirror of the decision rules
CHANGELOG.md          ← rule changes with their effect on records; API and integration changes
SECURITY.md           ← threat model, including threats to this repository itself
entities/             ← data (YAML, one file per entity). Never hand-edited; written only by the pipeline
src/policy.py         ← the decision engine: the single source of truth
src/collectors/       ← evidence collectors (they translate the outside world; they never judge)
tests/                ← positive cases + adversarial corpus of ways to fool the rules
api/                  ← Cloudflare Worker serving api.realurls.org and realurls.org
mcp/                  ← @realurls/mcp server
extension/            ← browser extension (Manifest V3)
docs/zh/              ← Chinese versions of the core documents

Contributing

You contribute leads, not data. Open an issue; a bot collects the evidence and decides whether the record qualifies. See CONTRIBUTING.md.

If you control a domain, a single DNS TXT record (A5) overrides any verdict of ours.

License

• Data (entities/, dist/): CC BY-SA 4.0
• Code (src/, tests/, api/, mcp/, extension/): MIT

Disclaimer

Realurls judges domain ownership only. It does not judge whether a site is safe, lawful, or any good. A domain marked verified means it really belongs to that organization — not that it is safe. For safety, rely on Google Safe Browsing, VirusTotal and similar services.