v0.1.0

First release.

An MCP server that answers "was this made by AI" from what a file declares
about itself, and whether that declaration still verifies against the bytes.
It reads a signed C2PA manifest. It never infers anything from pixels.

Why it exists

When an image is attached to a model it is decoded to pixels and re-encoded, so
the container metadata never arrives. The model receives an RGB array and cannot
read a manifest at all. Asked "is this AI?", it will tend to guess from visual
artefacts instead, which benchmarks at 18-31% accuracy. This gives it the signed
record to read instead.

Tools

• check_image_provenance(path) - verdict, signature state, and what the file declares
• scan_directory(path) - how many images in a folder carry a credential

Two rules that shape the design

Absence is never evidence. A file with no credential reports UNKNOWN, never
"no AI". Roughly 96.5% of real images carry none, and an AI image loses its the
moment anyone screenshots or re-saves it, so an unmarked AI image and an unmarked
photograph are indistinguishable here. Claims inside a manifest that failed
verification are ignored in both directions.

An error is never "no credential found." Only the manifest-not-found case
returns that. Corrupt, truncated and unreadable files each surface as a distinct
error, because reporting them as clean would be the worst thing this server
could do.

Security

Manifest strings are attacker-controlled and arrive wearing a badge: a field
labelled "signer", next to "signature verified", reads as authoritative when the
signature actually covers the asset's bytes, not the honesty of any string
inside it. Signer and claim_generator are fenced before return.

Every result carries what_this_does_not_mean, so a model relaying it cannot
upgrade a declaration into a detection.