Branded short links your team controls — and an MCP server your AI agent can use. Sub-10ms global redirects, phishing-resistant by default, attribution that tracks every click back to the human or the agent that created the link.
Marketers & growth teams. Branded short links on your own domain. Click analytics by country, device, and referrer. UTM builder, retargeting pixels (Facebook / Google / TikTok / LinkedIn / Pinterest / GA4), A/B testing, conversion tracking with revenue attribution — without the bit.ly tax.
Developers. A REST API and typed SDK that don't require an account just to try. Anonymous "guest" links work in one curl call. Full OpenAPI 3.1 spec at /openapi.json. Custom domains with auto-SSL via Cloudflare. Webhooks for every event you care about.
AI agents — first-class. Native MCP server at mcp.go2.gg. Every
link can be stamped with agentId / agentRunId, and clicks are joined
back so you can answer "how many sales did Claude Code's links produce?"
Agent-readable surfaces at /AGENTS.md,
/llms.txt,
/.well-known/agent-card.json,
/.well-known/mcp.json.
- Agent-native. First shortener where AI agents are a first-class actor — MCP server, per-agent attribution, run rollups in the dashboard.
- Phishing-resistant. Every destination is checked through Google Safe Browsing + Cloudflare URL Scanner before the link is created; typosquats of QuickBooks, PayPal, Coinbase, Microsoft, and 40+ other brands are blocked at slug-time.
- Sub-10ms global. Runs on Cloudflare Workers — redirects served from the nearest of 300+ edge cities, no cold starts.
- Open source, AGPL-3.0. Every prod commit mirrors to this public repo within 30 seconds. Use the hosted version at go2.gg or self-host on your own Cloudflare account.
1. Add your domain (or use go2.gg). Point a single DNS record at
Cloudflare and your branded short links are live with auto-SSL. Or skip
it and use go2.gg/... — anonymous and account-bound links work out of
the box.
2. Create links — anywhere. From the dashboard, the REST API, or your AI agent via MCP. Add custom slugs, QR codes, retargeting pixels, password protection, and A/B variants per link.
3. See every click. Real-time analytics — geo, device, browser, referrer, UTM. Export to CSV. Your data, your dashboard, no paywall on your own traffic.
Create a link via API:
curl -X POST https://api.go2.gg/api/v1/links \
-H "Authorization: Bearer YOUR_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"destinationUrl": "https://example.com/launch",
"slug": "launch-2026",
"tags": ["marketing"]
}'Wire up an AI agent via MCP (Claude Code, Cursor, etc.):
claude mcp add go2 --transport http https://mcp.go2.gg
# Your agent now has create_link, get_stats, list_agent_runs, …No account? One-line guest link with 24h expiry:
curl -X POST https://api.go2.gg/api/v1/public/links \
-H "Content-Type: application/json" \
-d '{"destinationUrl": "https://example.com"}'
# → { "shortUrl": "https://go2.gg/wq3F2", "expiresAt": "...", "claimable": true }Full reference: go2.gg/docs.
Your visitors won't see phishing or malware on your domain. Three layers of defence run on every link create, every update, and on a rolling 4-hour rescan:
- Google Safe Browsing v4 — destinations are checked against malware, social engineering, and unwanted-software lists before the link is created.
- Cloudflare URL Scanner v2 — second-layer phishing classifier; catches what Safe Browsing hasn't seen yet.
- Brand-typosquat slug guard — rejects Unicode-homoglyph + Levenshtein-near matches of 40+ brand names unless the destination is the brand's verified domain.
Disabled links return HTTP 410 Gone with an explanation page, never
auto-follow. Every redirect carries X-Robots-Tag: noindex so Google
never indexes a slug path. Anyone can report a bad link at
go2.gg/report-abuse — reviewed within
24 hours.
Full policy in SECURITY.md. Security vulnerabilities go to security@go2.gg; abusive content reports to abuse@go2.gg.
Free for 100 links a month, no credit card. Pro ($9/mo) unlocks custom domains, more retention, and Pro features. Business ($49/mo) adds team seats, SSO, A/B testing, and conversion attribution. Full breakdown at go2.gg/pricing.
Want to run Go2 on your own Cloudflare account? Full feature parity, your data stays on your infrastructure, AGPL-3.0 license. Step-by-step in SELF_HOSTING.md — typical setup is 30 minutes including DNS.
We welcome contributions. Start with CONTRIBUTING.md and read the Code of Conduct and Governance.
Local development quick start
pnpm install
cp env.example .env.local
cp env.example apps/web/.env.local
cp env.example apps/api/.env
pnpm dev
# Web → http://localhost:3000
# API → http://localhost:8787Architecture
apps/
├── api/ # Cloudflare Workers + Hono (api.go2.gg)
├── web/ # Next.js on Workers via OpenNext (go2.gg)
├── extension/ # Browser extension (Chrome/Firefox)
└── video/ # Remotion-based video assets
packages/
├── ai/ # AI provider abstraction
├── analytics/ # PostHog + GA4 server-side
├── auth/ # Better Auth config (OAuth + magic-link + OTP)
├── cli/ # Go2 CLI
├── config/ # Shared site / pricing / feature config
├── db/ # Drizzle ORM + D1 adapter
├── email/ # React Email templates
├── logger/ # Axiom + Workers Logs
├── mastra-plugin/ # Mastra agent toolkit plugin
├── mcp-server/ # MCP server implementation
├── payments/ # Stripe adapter
├── sdk/ # Typed JavaScript SDK
└── ui/ # Shadcn/ui primitives
Storage: Cloudflare D1 (SQLite) for primary, KV for the edge link cache, R2 for QR codes and uploads, Analytics Engine for click events, Queues for background jobs, Durable Objects for rate-limiting and A/B test state.
Stack: Hono, Next.js (App Router on Workers via OpenNext), Drizzle ORM, Better Auth, React Email, Stripe.
GNU AGPL v3.0. Plain-English summary in LICENSING.md.
AGPL §13 note. When you run Go2 as a network service, you must offer your users access to your modified source. The hosted version at go2.gg links this repo from the footer; self-hosters should do the same.
Built on Cloudflare Workers, Hono, Next.js, Drizzle, and Better Auth. Made with care by @Rakesh1002.