How do I use c2pa-mcp?

1. Click on "Install Server". 2. Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state. 3. In the chat, type @ followed by the MCP server name and your instructions, e.g., "@c2pa-mcp verify the image at ~/Downloads/sample.jpg" That's it! The server will respond to your query, and you can continue using it as needed. Here is a step-by-step guide with screenshots.

c2pa-mcp

by harelrech

Overview Schema Source Related Servers Score Discussions Admin

TypeScript

Local

c2pa-mcp

An MCP server that verifies C2PA Content Credentials and returns an LLM-ready verdict.

Point any MCP client (Claude Desktop, Claude Code, Cursor, ...) at a local file or a URL and get back a plain-language answer: is this image/video/audio trusted, valid, tampered, or unsigned? Who signed it? Is it AI-generated? What's its edit history and provenance lineage?

Built by c2paviewer.com. Verification runs locally on the official C2PA Rust engine via @contentauth/c2pa-node. Files never leave your machine.

Read-only. This server verifies and inspects Content Credentials. It does not sign or create them.

Install

No global install needed. Add it to your MCP client config and it runs via npx:

{
  "mcpServers": {
    "c2pa": {
      "command": "npx",
      "args": ["-y", "@c2paviewer/c2pa-mcp"]
    }
  }
}

Claude Desktop: Settings → Developer → Edit Config, add the block above.
Claude Code: claude mcp add c2pa -- npx -y @c2paviewer/c2pa-mcp
Cursor / others: add the same mcpServers entry to the client's MCP config.

Requires Node.js 18+.

First run: the underlying engine (@contentauth/c2pa-node) downloads a ~18MB native binary on first install. On a slow connection this can outlast an MCP client's startup timeout — if the very first launch seems to hang, let the download finish and relaunch; subsequent runs are instant.

Related MCP server: MCP Content Credentials Server

Tools

Tool	What it does
`verify_c2pa_file`	Verify a local image/video/audio/PDF by path.
`verify_c2pa_url`	Download a public https media URL and verify it (SSRF-guarded).
`scan_c2pa_directory`	Audit a folder: which files have credentials, their verdict, signer, AI status.
`c2pa_info`	Report engine version, supported media types, and trust-list status.

Each verify tool returns a human-readable summary plus a structured digest:

{
  "verdict": "invalid",            // trusted | valid_untrusted | valid_trust_unknown | invalid | no_credentials
  "summary": "Content Credentials are INVALID: an integrity or signature check failed ...",
  "signer": { "name": "Example Signer", "trusted": false },
  "aiGenerated": { "isAI": true, "tools": ["DALL-E"], "digitalSourceTypes": ["...trainedAlgorithmicMedia"] },
  "provenance": [ { "depth": 0, "title": "This file", "relationship": "This file", "verdict": "invalid" } ],
  "edits": [ { "label": "Created", "agent": "Photoshop", "when": "...", "detail": "" } ],
  "watermarks": [ { "kind": "synthid", "assertionLabel": "...", "algorithm": "" } ],
  "issues": [ { "code": "assertion.dataHash.mismatch", "severity": "error",
               "explanation": "The media content was changed after it was signed. ..." } ],
  "trust": { "evaluated": true, "listSource": "https://.../C2PA-TRUST-LIST.pem" }
}

Pass "includeRaw": true to also get the full raw manifest store.

Trust list

To report a signer as trusted (not just cryptographically valid), the server checks the signing certificate against two trust lists, fetched live and cached (24h TTL) so decisions stay current without a release:

the official C2PA Conformance Program list (going-forward signers), and
the legacy CAI Interim Trust List (frozen Jan 2026, but still the only list that recognizes pre-conformance signers — Adobe, Leica, Truepic, Canon, Samsung, and most real-world content today).

Both are on by default; without the ITL, mainstream signed content would read as valid_untrusted.

If the trust lists can't be fetched, the server degrades loudly: verification still runs, but the verdict becomes valid_trust_unknown and trust.evaluated is false with a reason. It never silently treats an unknown signer as trusted, and never silently uses a stale snapshot.

Environment overrides:

Variable	Default	Purpose
`C2PA_TRUST_LIST_URL`	conformance + ITL	Comma-separated PEM URLs. Replaces the defaults (conformance list + Interim Trust List).
`C2PA_TRUST_TTL_SECONDS`	`86400`	Cache lifetime for the fetched trust list.
`C2PA_MAX_FETCH_BYTES`	`104857600`	Max download size for `verify_c2pa_url` (100 MB).
`C2PA_MAX_FILE_BYTES`	`524288000`	Max size of a local file the file/scan tools will verify (500 MB).
`C2PA_ALLOWED_ROOTS`	(unset)	Comma/semicolon-separated absolute paths. When set, `verify_c2pa_file` and `scan_c2pa_directory` refuse any path outside these roots.

Security

Local processing. Files are read and verified on your machine; nothing is uploaded.
SSRF-guarded URL fetching. verify_c2pa_url allows only public https, pins the resolved IP against DNS rebinding, re-validates every redirect, sends no cookies or auth, and enforces a content-type allowlist plus size cap.
Local path safety. The file/scan tools reject remote file:// and UNC paths, resolve symlinks before the allowed-roots check, and return a generic error for inaccessible paths.
Set C2PA_ALLOWED_ROOTS in any untrusted context. The file/scan tools expose the host filesystem by design, so a prompt-injected model could point them anywhere. Confining them to a specific directory is the single most important hardening setting.
Trust integrity. Trust lists are fetched over HTTPS (integrity rests on TLS and the upstream sources); the cache is per-user (0700/0600, ownership-checked) and bound to the configured URL set.

Limitations

Experimental. Not legal evidence. C2PA tooling and trust infrastructure are still evolving. Do not rely on these verdicts for legal, compliance, or safety-critical decisions.
Watermarks are reported as declared, not pixel-verified. A synthid entry means the manifest declares a SynthID watermark; confirming the signal in the pixels requires the vendor's detector.
AI-generation reflects what the manifest declares via IPTC digitalSourceType. Absence of an AI declaration is not proof the content is not AI-generated.

Troubleshooting

Every verification fails with "Verification engine failed to load". The native @contentauth/c2pa-node binary was interrupted or corrupted during install (common on slow/unreliable connections). Run c2pa_info — it reports engine: FAILED: <reason> when this happens. Fix: reinstall the dependency (delete node_modules/@contentauth/c2pa-node and reinstall, or npm cache clean --force then re-run). Checksum/retry hardening of that download lives in the upstream @contentauth/c2pa-node postinstall script, which this project doesn't control.
verify_c2pa_url fails with "timed out after ...ms". The fetch exceeded C2PA_FETCH_TIMEOUT_MS (default 30000). Raise it if you're verifying URLs from a slow host.

Development

npm install
npm run build
npm test          # builds, then runs unit + end-to-end tests (network needed for the trust list)

License

Source code is dual-licensed under MIT or Apache-2.0, at your option.

The test images under test/fixtures/ are redistributed unmodified from c2pa-org/public-testfiles and are licensed separately under CC BY-SA 4.0.

Note: if you publish under an unscoped name instead of @c2paviewer/c2pa-mcp, change name in package.json and the args in the install block above; nothing else depends on the package name.

Available Tools

4 tools

c2pa_infoC2PA engine and trust-list infoA

Report the verification engine version, the media types this server can verify, and the active trust-list configuration. Use this to check capabilities before verifying.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

TDQS

A4.6/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It clearly states what information is reported (version, media types, trust-list), implying a read-only, non-destructive operation. While it does not explicitly declare safety, 'Report' suggests no side effects. A score of 4 is appropriate as it is clear but could be more explicit about being read-only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loading the key information ('Report the verification engine version, the media types this server can verify, and the active trust-list configuration') followed by a usage hint. Every sentence adds value with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no parameters and no output schema, the description reasonably covers what the tool does. However, it does not describe the output format or structure (e.g., JSON, fields), which would help the agent interpret results. Slight gap prevents a 5.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters with 100% coverage, so the baseline is 4. The description adds meaning by specifying the content of the report (version, media types, trust-list), which complements the empty schema. No further parameter detail is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool reports 'verification engine version, media types this server can verify, and active trust-list configuration'. The verb 'Report' clearly indicates a read operation, and the resource is well-defined. It also distinguishes from sibling tools (verify_c2pa_file, verify_c2pa_url, scan_c2pa_directory) which perform verification actions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes 'Use this to check capabilities before verifying', providing explicit guidance on when to use the tool (before verification). Given the sibling tools are verification-focused, this advice is highly actionable and clarifies context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scan_c2pa_directoryScan a directory for C2PA content credentialsA

Audit a folder of media files: report which ones carry C2PA Content Credentials, their verdict, signer, and whether each is AI-generated. Non-recursive. Use this to triage a directory of images/videos at once.

ParametersJSON Schema

Name	Required	Description	Default
`maxFiles`	No	Maximum number of media files to scan (default 200, max 1000).
`directory`	Yes	Path (or file:// URI) to the directory to scan.

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It discloses non-recursiveness and the output fields (C2PA presence, verdict, signer, AI-generation). It implies a read-only audit, but does not explicitly state no modifications or permissions needed. Slightly under-disclosed, but still useful.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no wasted words. First sentence defines output scope, second sentence adds usage context and a key behavioral constraint. Highly efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description specifies the outputs (C2PA credentials, verdict, signer, AI-generated) without an output schema, which is adequate. Parameter count is low and well-documented in schema. Sibling tools provide context. Could mention whether it only scans media files or include a brief example, but overall complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with clear descriptions for both parameters (maxFiles with default and max, directory as path or URI). The tool description adds no further parameter-level details beyond the 'non-recursive' behavioral note, which is already stated. Baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool audits a folder of media files and reports C2PA credentials, verdict, signer, and AI-generation status. It specifies non-recursive behavior, distinguishing it from sibling tools that operate on single files or URLs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes an explicit usage directive ('Use this to triage a directory of images/videos at once'), providing clear context. It lacks explicit when-not-to-use guidance or alternatives, but sibling names imply differentiation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_c2pa_fileVerify C2PA content credentials in a local fileA

Verify the C2PA Content Credentials (provenance) of a local image, video, audio, or PDF file. Returns a plain-language verdict (trusted / valid_untrusted / invalid / no_credentials), the signer, whether the content is AI-generated, its edit history, provenance lineage, and any validation issues. Use this when you have a file path on disk. The file is read locally and never uploaded.

ParametersJSON Schema

Name	Required	Description	Default
`path`	Yes	Absolute or relative path (or file:// URI) to the media file to verify.
`includeRaw`	No	If true, include the full raw C2PA manifest store in the structured result. Defaults to false.

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, but the description discloses that the file is read locally and never uploaded, and enumerates the output fields (verdict, signer, AI-generated, etc.), which adds behavioral context beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the tool's action and outputs, followed by usage guidance. No redundancy or unnecessary details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two parameters and no output schema or annotations, the description provides a good overview of the return values and privacy aspect. Could elaborate on the format of edit history or lineage, but overall sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameters are already well-documented. The description adds usage context ('Use this when you have a file path') but does not significantly augment the schema's parameter explanations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: verifying C2PA content credentials of local files. It lists outputs and differentiates from verify_c2pa_url by specifying local file path usage.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance to use when there is a file path on disk, and notes the file is read locally and never uploaded. Does not explicitly mention when not to use or list alternatives, but context is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

verify_c2pa_urlVerify C2PA content credentials at a URLA

Download a remote image, video, audio, or PDF over https and verify its C2PA Content Credentials. Returns the same plain-language verdict, signer, AI-generation status, lineage, and issues as verify_c2pa_file. Use this for a web URL. Only public https URLs are allowed (private/internal hosts are refused).

ParametersJSON Schema

Name	Required	Description	Default
`url`	Yes	Public https URL of the media file to verify.
`includeRaw`	No	If true, include the full raw C2PA manifest store in the structured result. Defaults to false.

TDQS

A4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden. It discloses network access (downloading) and URL restrictions. It mentions output equivalence with verify_c2pa_file, giving insight into return format. However, it lacks details on failure modes, size limits, or performance characteristics, leaving some gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three concise sentences, each serving a purpose: action, output, usage direction, and constraint. No wasted words, and the most important info is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given two parameters, no output schema, and no annotations, the description covers the main behavioral points (network access, URL constraint, output similarity). It is sufficient for a tool that parallels an existing one. Minor omission: no mention of error handling or default for includeRaw (though schema covers it).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds context by linking includeRaw to the sibling's behavior, but does not elaborate beyond what the schema provides. Adequate but not enhanced.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool downloads a remote file over https and verifies C2PA credentials. It lists supported media types and explicitly distinguishes from sibling verify_c2pa_file by saying 'Use this for a web URL.' The title and description align well.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance: 'Use this for a web URL' and notes that only public https URLs are allowed, with private/internal hosts refused. This helps the agent decide when to use this tool. However, it does not directly mention alternatives like c2pa_info or scan_c2pa_directory, but the sibling context is available.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

4 tool updatesv0.1.3Jul 29, 2026
- First observedc2pa_info
- First observedscan_c2pa_directory
- First observedverify_c2pa_file
- First observedverify_c2pa_url

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A4.3/5.0

Disambiguation5/5

Each tool has a clearly distinct purpose: local file verification, remote URL verification, directory scanning, and server info. No overlap in functionality.

Naming Consistency4/5

Three tools use a consistent verb_c2pa_noun pattern, but c2pa_info deviates by omitting a verb. Still predictable and readable.

Tool Count4/5

Four tools is on the lower end but appropriate for a focused verification server. Each tool serves a clear role without redundancy.

Completeness5/5

Covers all primary verification workflows: local file, remote URL, batch scanning, and capabilities. No obvious gaps for a verification-only tool.

Maintenance

ActivitySlowing

ResponsivenessResponsive

Resources

Need Help?

Related Servers

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Lumethic Photo Verification AOAuth
com.lumethic
Verify photos are real camera captures, not AI: C2PA and RAW+JPEG forensics. OAuth or API key.
Image & Video Processing Security
322
Blue Cap Evidence Verify A
io.soundiq
Verify structured evidence and return machine-verifiable provenance, assurance, and receipts.
Security Legal & Compliance
31
oathlayer A
io.github.oathlayer
Verify AI outputs against real sources. Returns a trust signal and permanent doc number.
Search Documentation Access
12
unmarking A
ing.unmark
Inspect and remove C2PA content credentials from AI-generated images, video and audio. Free, no key.
Multimedia Processing Image & Video Processing
21

Related MCP Servers

URL Reputation and Validity
Web Scraping Search Security
prismon
A
license
Not graded
quality
D
maintenance
Validates URLs and checks their reputation to help identify AI hallucinations and verify web page authenticity.
Updated a year ago (2025-05-29 02:23 UTC)
MIT
MCP Content Credentials Server
Image & Video Processing Security
noga7
A
license
A
quality
D
maintenance
Enables reading and verifying C2PA Content Credentials from images and videos through both embedded manifests and invisible watermarks. Supports direct filesystem access, URL checking, and provides structured provenance data including creator identity, AI generation info, and content authenticity.
Updated 9 months ago (2025-12-12 08:02 UTC)
2
MIT
Groundcheck
AI & Machine Learning RAG Systems Search
beepboop2025
A
license
A
quality
B
maintenance
Verifies factual claims against live sources and returns a verdict, confidence score, and citations for any agent to use before stating uncertain facts.
Updated 5 days ago (2026-09-03 09:04 UTC)
6
MIT
chronoverify-mcp
Image & Video Processing Security
beeswaxpat
A
license
A
quality
B
maintenance
Provides MCP-compatible AI agents with a verify_image tool to check a photo's capture time and provenance using C2PA, EXIF, XMP metadata, and pixel forensics, returning a verdict and confidence score.
Updated 8 days ago (2026-08-31 15:08 UTC)
1
40
2
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/harelrech/c2pa-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server