Purpose
ChronoVerify MCP server provides any MCP-compatible AI agent (such as Claude Desktop, Cursor, Cline, VS Code, etc.) with the ability to verify when a photo was taken and its provenance. It fuses C2PA content credential verification, EXIF and XMP metadata checks, and classic pixel forensics into a single verdict, intended to assist human review rather than serve as conclusive evidence.
Main capabilities
- verify_image: Verifies when a photo was taken and its provenance. You can pass one of the following three: url (the server fetches a publicly accessible image URL), file_path (the absolute path to a local image), or image_base64 (base64-encoded image bytes). You can optionally set permalink: true to save the verdict (the image is never stored) and return a non-public share link for referencing the result with others or in reports. Links generated without a key expire after 90 days; links generated with an API key do not expire. Returns a human-readable summary as well as a typed structured object, so agents can branch directly without parsing text.
- Verdict enum: provenance_confirmed (a trusted C2PA content credential has been verified against the official trust list), consistent (metadata is self-consistent and shows no tampering signals, consistent with an unedited capture, but not proof), inconclusive (insufficient signals to determine), metadata_anomaly (metadata contradicts itself), manipulation_indicated (pixel forensics flags possible editing, requiring human review).
- get_signed_report: Generates a signed PDF audit report for a single image, usable for chain-of-custody/compliance records (e.g., EU AI Act Article 50 transparency records, insurance or legal evidence files, newsroom audit trails). Requires either file_path or image_base64 (this endpoint does not fetch URLs), with optional out_path. Writes the PDF and returns the path. Requires CHRONOVERIFY_API_KEY, metered per premium report unit. The report carries an Ed25519 signature, which can be verified using the public key at https://chronoverify.com/v1/key .
How to use
Add the ChronoVerify MCP server to your MCP client configuration (e.g., Claude Desktop's claude_desktop_config.json or any MCP client). It can be run locally via npx, or use the service hosted at chronoverify.com/mcp/http. Omitting the env block uses the free public path (verification only; signed reports always require a key). To get an API key: the first 100 verifications each month are included, see https://chronoverify.com/pricing。
Example prompts
- "Verify the provenance of /Users/me/Downloads/photo.jpg"
- "When was the photo at this URL taken, and has it been edited?https://example.com/photo.jpg”
- "Verify the C2PA content credential on this image and tell me the signer."
- "Verify this photo and give me a shareable link to the verdict."
- "Generate a signed provenance report for ./evidence/claim-001.jpg and save it to ./reports/"
Applicable scenarios and limitations
Suitable for investigative scenarios that require verifying when an image was taken and its provenance, such as news review, insurance claims, legal evidence organization, and compliance transparency records. Limitations include: the tool is provenance-first, not a deepfake or AI-generated content detector; results are investigative leads intended to assist human review, not proof; get_signed_report does not fetch URLs and only accepts local files or base64 data, and requires an API key; without a key, only basic verification is possible, and signed reports cannot be generated.
Compliance and provenance
ChronoVerify is a C2PA-compliant verifier and has been listed in the C2PA compliance product list (record number 019f8a20-6452-7a43-b11b-59d0b0e4a84a), supporting verification of JPEG, PNG, WebP, and AVIF formats. For compliance details, see https://chronoverify.com/compliance#conformance。项目地址：github.com/beeswaxpat/chronoverify-mcp。已列于 Smithery：https://smithery.ai/servers/beeswaxpat/chronoverify-mcp。
