# ULU

> URL-layer trust and compression for AI agents. Shorten any URL, resolve the short code to get a summary, safety check, content fingerprint, and snapshot. Operated by Thulge Labs from Singapore. Canonical domain `ulu.sg`.

ULU is designed for agents and crawlers, not against them. There are no anti-bot walls on the redirect path, no JavaScript challenges on the API, and every response is structured JSON with stable schemas. The companion application/ld+json + application/ai-context blocks on `https://api.ulu.sg/` carry the same metadata in machine-readable form.

Three hostnames serve distinct roles. `ulu.sg` is the short-URL surface only (`https://ulu.sg/{code}` → 302 to the destination). `api.ulu.sg` hosts the SPA + REST API + this manifest. `mcp.ulu.sg` hosts the MCP server. Use the right host for the right path.

## What this service does

- **Shorten** any URL — http, https, and multiple protocols beyond.
- **Summarise** every shortened link with an async AI summary at shorten time. Cached. Free tier 5 lifetime, Builder 500/mo, Agentic+ unlimited.
- **Risk-check** every link against multiple threat intelligence feeds at shorten time and re-checked daily. Newly-flagged destinations auto-block + fire a `link.flagged` webhook.
- **Snapshot** the destination at share time via signed snapshot tokens (Agentic+ tier). Recipients hit `/r/{token}/{code}` and resolve to the pinned destination even if the live link drifts.
- **Drift-detect** content via a content fingerprint + fuzzy similarity scoring against the destination text. The redirect path serves a content-changed interstitial when drift exceeds the per-workspace threshold.
- **AI-optimized short codes** are available as an opt-in slug style. See the agent guide for the per-call header.

## API endpoints

- [POST /api/v1/anon/links](https://api.ulu.sg/api/v1/anon/links), anonymous shorten, no account, rate-limited per IP via captcha verification.
- [POST /api/v1/links](https://api.ulu.sg/api/v1/links), authenticated shorten. Bearer token in `Authorization`.
- [POST /api/v1/links/batch](https://api.ulu.sg/api/v1/links/batch), batch shorten.
- [GET /api/v1/links/{code}](https://api.ulu.sg/api/v1/links/), resolve. Returns destination + summary + risk_level + content fingerprint + last_checked + protocol + lifecycle metadata.
- [POST /api/v1/reports](https://api.ulu.sg/api/v1/reports), submit a document. Every URL inside gets shortened, the document comes back with substitutions in place, and a structured per-link record is returned.

## MCP server

```
claude mcp add --transport http ulu https://mcp.ulu.sg/mcp/v1 \
  --header "Authorization: Bearer ulu_live_..."
```

MCP server with shortening, resolving, and management tools. Schema ships with a `SKILL.md` so CLI-style lazy-discovery agents don't burn the schema as context overhead.

## Pricing

- **Free**. $0/mo. 100 links/day, 5 lifetime AI summaries, 1 report/day (15 links each, 14-day retention), 1 API key at 20/hr.
- **Builder**. $5/mo (or $55/yr). Unlimited links, 500 AI summaries/mo, 100 links/report, 30-day retention, 1 custom subdomain, 1 API key at 200/hr.
- **Agentic**. $45/mo (or $495/yr). Everything in Builder, unlimited AI, 3 API keys, 1 BYO domain, webhooks, signed snapshots. Hourly rate limit under review.
- **Enterprise**. From $300/mo. Custom contract, unlimited keys + domains, SAML SSO + data residency, DPA + compliance evidence, dedicated support.

Annual saves ~8% on Builder / Agentic (one month free). Charged in your local currency at checkout.

## Notes for agents

- **No anti-bot walls** on the redirect path. `/r/{code}` is a 302 to the destination. No JS challenge, no interstitial except for safety-flagged or drift-flagged links (those are deliberate, not anti-bot).
- **Stable schemas**. Every API surface has machine-generated OpenAPI schemas. We do NOT add fields like `sponsor` or `promoted` to API responses. Enforced in CI.
- **Resolve responses include `last_checked` + a content fingerprint** so you can tell when a destination's content has changed since shorten time. If it has, your agent might want to re-resolve before relying on a cached summary.
- **Free anon endpoint requires a captcha token**. Agents using the anonymous endpoint must pass a captcha. Authenticated agents (Bearer token) skip the captcha entirely.

## Trust posture

- No raw IPs stored. Anonymised at ingestion, then discarded.
- No ads in API or MCP responses. No third-party trackers on the redirect path. No retargeting pixels. Ever.
- GDPR + PDPA (Singapore) compliant. Data export + hard-delete are self-serve.
- Source code under PolyForm Noncommercial 1.0.0. Hosted-service usage governed by https://api.ulu.sg/legal/terms.

## Optional

- [Pricing](https://api.ulu.sg/pricing), full feature × tier matrix.
- [Docs](https://api.ulu.sg/docs), REST API reference.
- [Agent guide](https://api.ulu.sg/agents), MCP server setup, claim flow, structured-resolve examples.

## Status

Features rolling out progressively. BYO domain + per-link click analytics on the roadmap. See https://api.ulu.sg/pricing for the live capability matrix.