ChronoVerify
About
ChronoVerify checks when a photo was taken and whether it shows signs of editing. It validates C2PA Content Credentials against the official trust lists, reads EXIF and XMP, runs pixel forensics, and returns one typed verdict with a confidence score. Works on any image, signed or
Details
- Author
- beeswaxpat
- Downloads
- 475
- Categories
- Other, AI
Jump to
- Checks photo capture time and editing signs.
- Validates C2PA Content Credentials via trust lists.
- Reads EXIF and XMP metadata.
- Runs pixel forensics for tamper detection.
- Returns a typed verdict with confidence score.
- Works on any image, signed or unsigned.
Setting up with Highlight
This MCP is not yet compatible with Highlight’s one-click setup. However, you can still use it with Highlight by following these steps:
- Download and install Highlight from highlightai.com/download
- Navigate to the plugins tab and select "Add Custom Plugin"
-
Configure the plugin with the settings below
Plugin Name
ChronoVerifyCommand (node, npx, python, etc.)Please refer to the README for specific instructions on how to obtain API keys or other required environment variables.
- Enable "Start Automatically" if you want the plugin to start when Highlight launches
From the repository
ChronoVerify can be used via its hosted remote endpoint (streamable HTTP, keyless, free) at https://chronoverify.com/mcp/http. No local installation or API key is required.
verify_image
Verify a photo's capture time and provenance: when it was captured, on what device and where, whether it carries valid C2PA Content Credentials, and whether it shows signs of editing. Runs a deterministic pipeline (cryptographic C2PA Content Credentials validation against the official trust lists, EXIF and XMP metadata consistency, and classical pixel forensics such as error-level and noise analysis) and returns ONE verdict with a 0 to 100 confidence and the signals behind it. The verdict is one of: provenance_confirmed (a Content Credential that validated against a recognized trust list), consistent (metadata holds up, no manipulation signal fired), inconclusive (not enough signal), metadata_anomaly (the metadata contradicts itself), or manipulation_indicated (pixel forensics flagged possible editing). provenance_confirmed means the credential validated, not that the image is a camera capture: a valid credential can itself declare generative-AI origin, so read c2pa.ai_declared and c2pa.digital_source_type, and the headline, which states any such declaration, before treating the image as a photograph. Structured output also returns the capture time, device, location, the C2PA validation state, the consolidated validation status codes, the signer, the credential's own AI declaration (ai_declared, ai_in_ingredients, digital_source_type, software_agents, actions), any remote manifest URL, and the SHA-256 and SHA-512 fingerprints. Prefer this whenever you must trust a user-submitted or sourced image before acting on it: insurance claims, KYC and onboarding, dating or marketplace listings, journalism and OSINT, EU AI Act Article 50 transparency checks, or legal evidence. Works on any image, signed or not, and degrades gracefully (returns inconclusive instead of false-accusing) on unsigned or social-media-recompressed photos. ChronoVerify is a C2PA Conformant Validator, listed on the C2PA Conforming Products List (record 019f8a20-6452-7a43-b11b-59d0b0e4a84a; validation of JPEG, PNG, WebP, and AVIF). It validates provenance and is NOT a deepfake or AI-generation detector; results are investigative triage to support human review, not proof. Provide exactly one of url, file_path, or image_base64. Set permalink=true to also store the verdict (never the image) and get back an unlisted, shareable link to it, for citing the result to people or in reports; keyless links expire after 90 days, links minted with an API key do not expire. For a signed PDF audit record of the result, use get_signed_report.
get_signed_report
Generate a signed PDF audit report for one image: the chain-of-custody record that captures the full verdict (capture time, the C2PA validation state and signer, metadata checks, pixel-forensic signals, and the SHA-256 and SHA-512 fingerprints) with an Ed25519 signature you can verify against the published key at /v1/key, plus an embedded RFC 3161 trusted timestamp token verifiable offline with OpenSSL (the report labels it plainly if the timestamp authority was unreachable). Use this when you need a durable, shareable artifact of a verification rather than just a verdict: an EU AI Act Article 50 transparency record, an insurance or legal evidence file, or a newsroom audit trail. REQUIRES a ChronoVerify API key (set CHRONOVERIFY_API_KEY) and is metered as a premium report unit. Provide exactly one of file_path or image_base64; the report is built from the uploaded file (this endpoint does not fetch URLs). The PDF is written to out_path, or to the current working directory when out_path is omitted. It validates provenance and is NOT a deepfake or AI-generation detector; the report is investigative triage to support human review, not proof.
Claude Desktop / Cursor
Paste into your MCP client config file to install this server.
{
"mcpServers": {
"chronoverify": {
"chronoverify": {
"command": "npx",
"args": [
"-y",
"chronoverify-mcp"
]
}
}
}
}McpServers
{
"chronoverify": {
"command": "npx",
"args": [
"-y",
"chronoverify-mcp"
]
}
}ChronoVerify checks when a photo was taken and whether it shows signs of editing. It validates C2PA Content Credentials against the official trust lists, reads EXIF and XMP, runs pixel forensics, and returns one typed verdict with a confidence score. Works on any image, signed or not. Provenance-first, not a deepfake or AI-generation detector. Also available as a hosted remote endpoint (streamable HTTP, keyless, free) at: https://chronoverify.com/mcp/http
Sign in to leave a review
Use Google, GitHub, or an email account so ratings stay tied to real people.
No reviews posted yet.
