beeswaxpat/chronoverify-mcp

An MCP server for ChronoVerify. It gives any MCP-compatible AI agent (Claude Desktop, Cursor, Cline, VS Code, and others) the tools to check a photo's capture time and provenance: C2PA Content Credentials, EXIF and XMP metadata, and classical pixel forensics, fused into one verdict (provenance_confirmed, consistent, inconclusive, metadata_anomaly, or manipulation_indicated) with a 0 to 100 confidence.
Provenance-first, not a deepfake or AI-generation detector. Results are investigative triage to support human review, not proof.
ChronoVerify is a C2PA Conformant Validator, listed on the C2PA Conforming Products List (record 019f8a20-6452-7a43-b11b-59d0b0e4a84a; validation of JPEG, PNG, WebP, and AVIF). Details: https://chronoverify.com/compliance#conformance
Source and issues: github.com/beeswaxpat/chronoverify-mcp
Listed on Smithery: https://smithery.ai/servers/beeswaxpat/chronoverify-mcp
> **Get an API key** (the first 100 verifications each month are included): https://chronoverify.com/pricing . Without a key, verify_image uses the free, rate-limited public path. A signed report requires a key.
Install
Add it to your MCP client config. For Claude Desktop (claude_desktop_config.json) or any MCP client:
Omit the env block to use the free public path (verification only; signed reports always need a key).
Tools
verify_image
Verify a photo's capture time and provenance. Takes exactly one of:
- url: a publicly reachable image URL (the server fetches it),
- file_path: an absolute path to a local image, or
- image_base64: base64-encoded image bytes.
Optionally set permalink: true to also store the verdict (never the image) and get back an unlisted, shareable link to it in the permalink field, for citing the result to people or in reports. Keyless links expire after 90 days; links minted with an API key do not expire.
It returns a human-readable summary **and** a typed structured object so an agent can branch on the result without parsing prose:
The verdict enum:
- provenance_confirmed: a trusted C2PA Content Credential validated against the official trust list.
- consistent: metadata holds up and no manipulation signal fired (consistent with an unedited capture, not proof).
- inconclusive: not enough signal to decide.
- metadata_anomaly: the metadata contradicts itself.
- manipulation_indicated: pixel forensics flagged possible editing for human review.
get_signed_report
Generate a signed PDF audit report for one image: the chain-of-custody / compliance record (for example an EU AI Act Article 50 transparency record, an insurance or legal evidence file, or a newsroom audit trail). Takes one of file_path or image_base64 (this endpoint does not fetch URLs) and an optional out_path. Writes the PDF and returns the path. **Requires** CHRONOVERIFY_API_KEY; metered as a premium report unit. The report carries an Ed25519 signature you can verify against the public key at https://chronoverify.com/v1/key.