Stop Making Your AI Agents Hallucinate URLs: Deterministic Link Integrity by Construction

How a 4B-parameter model running locally produced a 20-source research report from LinkedIn — with zero broken links — by removing URLs from the model's context entirely.

The Problem Every Agent Team Knows

If you have ever built an agent that cites sources, you know the failure mode. The model returns a confident, detailed answer. The links look plausible. Then someone clicks.

The page doesn't exist. The URL points to a homepage instead of the article. The path was assembled from fragments of training data, stitched into something that looks like a link and isn't.

This is URL hallucination, and it persists at scale in 2026 because the usual mitigations treat symptoms: prompt engineering ("please only give real URLs"), retries, post-hoc link checkers that catch broken links after the user already saw them. None of these change the fundamental condition: as long as URL strings live inside the model's context, the model can generate — and eventually will generate — a URL that was never real.

A Different Architecture: URLs the Model Never Sees

Safe Search MCP is built on a single principle: a URL should never exist as a string in the model's context.

Instead of feeding raw links to the model, the pipeline works like this:

1. A search layer queries standard public web indexes (Google, Bing, Exa, Parallel).
2. Retrieved sources are converted into opaque references — tokens. The model sees tokens, never the URL strings themselves.
3. The model reasons over the content of sources and composes its answer, citing tokens.
4. At the output stage, the pipeline resolves tokens back into the exact URLs returned by the index — not rewritten by the model at any point.

The model's job is understanding and synthesis. The pipeline's job is identity. Neither is asked to do the other's job.

Proof of Concept: 20 Real LinkedIn Posts From a 4B Model

The test case was deliberately hostile: LinkedIn is aggressively closed to external retrieval. The task: find 20 recent LinkedIn posts (not profiles, not job listings) where someone is urgently hiring a software developer.

The run: a 4B-parameter model, running locally, through the Safe Search MCP pipeline. One task. Two search queries.

The result: a 20-post report with live, verified deep links — produced by a model that never saw a single URL string.

artefact

What makes this result structural, not lucky:

• The model could not hallucinate a URL, because it had no URLs to hallucinate from. It cited tokens; the pipeline resolved them.
• The date integrity is externally verifiable. LinkedIn post IDs encode their creation timestamps (Snowflake IDs — the creation date is recoverable from the ID itself with one line of arithmetic). Every post date in the report matches the timestamp encoded in its ID. Twenty internally consistent 19-digit identifiers are not something a model invents from memory.
• The model reported its own epistemic state honestly. Asked about the links, it described them as "placeholders" — because from inside its context, that's exactly what they are. It knew what it knew and said what it didn't.

What This Architecture Does Not Do

No product is honest without stated limits. Here are this one's:

• It is not a better search engine. It uses the same public indexes everyone uses. If the index doesn't have it, the pipeline doesn't either. The contribution is not retrieval; it is identity preservation.
• The model cannot reason about URL shape. Because it sees tokens, it cannot filter "posts, not job listings" by looking at the link. The fix is structural: each token ships with structured metadata (source type, domain, date), so the model can reason about class without ever touching the string. Version 1 of the test exposed this limitation; it is a design boundary, not a bug.
• It does not unlock closed platforms. It reached LinkedIn posts through what public indexes expose — not through private access. Coverage depends on what the indexes can see.

Why Small Models Matter Here

The pipeline's integrity does not depend on model capability, attention, context length, or instruction-following. That is why a 4B model suffices: the architecture absorbs what would otherwise require model strength. This has a practical consequence — link integrity becomes a property of the pipeline, not of the model's diligence. Swap the model, fine-tune it, run it on a laptop: the guarantee holds because it is enforced outside the model.

For teams deploying agents on-premise, on small models, or in privacy-sensitive environments, this is the difference between "usually works" and "cannot fail."

The Deeper Point: From "Usually Right" to "Cannot Be Wrong"

Most of the industry is closing the URL-hallucination gap with better models and better browsing tools — pushing 30% broken links down to 5%, probabilistically. That progress is real, and it is bounded: anything probabilistic has a tail.

The approach here removes the mechanism of failure instead of shrinking its probability. The distinction matters wherever "almost never" is not acceptable: audit trails, compliance contexts, financial and legal research, any workflow where a fabricated link costs more than a missing one.

What's Next

Safe Search MCP runs remotelly, works with small open models, and keeps source URLs outside model context end-to-end.

If you are building agents that must cite sources they can be trusted to cite — I consult on exactly this class of architecture.