Read the C2PA Content Credential embedded in a single image file and report what it declares about the image's origin: whether it asserts AI generation or a real-world capture, and whether that assertion's cryptographic signature still verifies. This reads metadata the file already carries; it does not analyze pixels and cannot detect AI generation on its own. A missing or invalid credential is not evidence the image is human made, an AI image loses its credential the moment it is screenshotted or re-saved. Always read the result's 'what_this_does_not_mean' field before repeating its verdict.

Walk a directory of images and report how many carry a C2PA Content Credential, broken down by verdict (AI_DECLARED, NO_AI_DECLARED, UNKNOWN) and by signer. This reproduces the sweep behind this project's own finding that roughly 96.5% of real images carry no credential at all. It reads only file metadata, never pixels, and touches no network. Returns counts and a capped sample of credentialed files, not a full file listing, so a large directory does not flood the response. If the directory has more images than 'limit', the scan is partial and the result says so explicitly rather than silently truncating.