Overview
An MCP server that reads the C2PA Content Credential embedded in an image and reports what the file declares about its own origin.
Source: github.com/JohannsenLum/is-it-ai-mcp · MIT
Try it before installing anything. ai.johannsenlum.com/is-it-ai runs the same checks in your browser. Drop an image in and see exactly what this server would return. Nothing is uploaded: the file is read locally and there is no server on the other end of that page to receive it.
What it does
It opens an image, reads the C2PA Content Credential embedded inside it if one exists, and reports what that manifest declares about how the image was made. Then it checks the manifest's cryptographic signature against the file's current bytes and reports whether that declaration still verifies, rather than trusting a credential just because one is present.
Why it exists
When you attach an image to a model, the image is decoded to pixels and re-encoded before the model ever sees it. Whatever the file's container carried, including any C2PA manifest, never reaches the model: what it receives is a plain RGB array, indistinguishable from any other array of the same dimensions. It cannot read a manifest at all, not because it declines to, but because the manifest was never in what it was handed. Asked "is this AI?" anyway, it tends to guess from visual artefacts instead, compression patterns, lighting, texture, and published benchmarks put that guess at roughly 18 to 31% accuracy, little better than chance. This server exists to hand the model the signed record to read instead of a pixel array to guess from: it opens the file on disk, before any decoding happens, and returns the actual manifest and its verification status.
The three verdicts
| Verdict | Means | Reachable only when |
|---|---|---|
AI_DECLARED | The file's manifest asserts AI or algorithmic generation | A manifest is present, its signature verifies, and it carries an IPTC digital-source-type marking AI involvement |
NO_AI_DECLARED | The file's manifest asserts a real-world capture | A manifest is present, its signature verifies, and it carries an IPTC digital-source-type marking a capture (camera, film, print, minor edits) |
UNKNOWN | Nothing usable was established | Everything else: no manifest, a broken signature, or a manifest that never recorded a source type |
UNKNOWN is the default answer, by a wide margin
In a scan of 401 real images, only 14 carried a Content Credential at all, and every
one of those was from OpenAI: about 96.5% carried none. Expect UNKNOWN on almost
everything you check.
This isn't a bug in the server, it's the current state of image provenance in the wild. Most tools that produce or edit images never add a credential in the first place, and even when one was added, a screenshot, a re-save, or passing the file through most messaging apps destroys it, because the manifest lives in the file's container, not in its pixels, and each of those steps keeps the pixels and discards the container.
What this cannot tell you
- It does not detect AI from pixels. There is no image analysis here, no model looking at the picture. Every verdict comes from a cryptographically signed text record, or from the absence of one.
- A missing credential is not evidence of anything. An unmarked AI image and an
unmarked photograph are indistinguishable to this tool.
UNKNOWNmeans "no usable record survived," never "no AI was involved." - A valid signature does not make the signer's claims true. The signature proves the manifest hasn't been altered since signing and confirms who signed it. It proves nothing about whether the signer told the truth. Anyone can generate their own certificate, sign their own file, and assert whatever origin they like: it will verify perfectly and still be false.
No credentials, no network calls
Unlike the other two servers on this site, this one asks you for nothing. Canvas needs
a base URL and a personal access token; LinkedIn needs a session cookie in your OS
keyring. is-it-ai-mcp needs neither an account nor an environment variable, and it
never makes a network call of any kind: it only opens a local file you point it at and
runs verification against the bytes already there. Point it at an image and it works,
with nothing to configure first.
Where to go next
Install
Run it with uvx, no credentials to set up, and wire it into Claude Code or Claude Desktop.
Tool reference
check_image_provenance and scan_directory: parameters, return fields, and what each verdict requires.
Source on GitHub
The server itself: Python, FastMCP, MIT licensed. Issues and pull requests welcome.