io.github.beeswaxpat/chronoverify
NPM · CHRONOVERIFY-MCP
Verify a photo's capture time and provenance: C2PA validation, EXIF/XMP, and pixel forensics.
Available components
Last scanned (1 hour ago)
Scores higher than 55% of npm servers
Category Security
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score → Why this is hard to score →
Supply Chain Security81
- No malware found by supply-chain analysis.Pass
- CVE check failed: a known high-severity CVE affects zod 3.25.76, a direct dependency. A fixed version is available. View diagnostics → Fail
- No install/post-install scripts declared.Pass
- 30 of 93 dependencies flagged as unhealthy. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 88 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability66
- AI-judged instruction clarity (excellent).Pass
- Context-footprint check failed: tool/resource definitions use about 986 tokens (~493/item across 2 items; 2 tools + 0 resources), over budget; trim descriptions and params. See how to fix → Fail
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management100
- No destabilizing schema changes in the last 30 days.Pass
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
- Structured output schemas are declared (100% of tools); any adoption earns full credit.Pass
Tool Safety100
- No prompt-injection markers were found in the server instructions, tool names or descriptions we captured.Pass
- We read all 2 captured tool definition(s), and no name or description among them implies an irreversible operation.Pass
- An AI judge read all 2 captured unit(s) of tool text and found none that tries to manipulate the model reading it.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 4 Nov 26 0
- Package version: 0.1.8 → 0.1.9 functional
- 3 Nov 26 0
- Stability: 0.97 → pass security
- Security disclosure: unverified → fail ▼ functional
- 2 Nov 26 0
- Stability: pass → 0.97 functional
- 1 Nov 26 0
- Security disclosure: fail → unverified ▼ functional
- 30 Oct 26 0
- Security disclosure: unverified → fail ▼ functional
- 29 Oct 26 0
- Security disclosure: fail → unverified ▼ functional
- Package version: 0.1.8 → 0.1.9 functional
- 27 Oct 26 0
- Stability: 0.97 → pass security
- 26 Oct 26 0
- Stability: pass → 0.97 functional
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 5 Nov 2026 · Analysed npm/chronoverify-mcp@0.1.9
Provenance No attestation
The registry publishes no build provenance for this version, so there is nothing to verify.
| Result | No attestation |
|---|---|
| Ecosystem | npm |
Background: How many MCP packages publish verified provenance →
Vulnerabilities 1 finding
| ID | CVE | Severity | Vector | Fix available |
|---|---|---|---|---|
| GHSA-mrhx-c7xc-m3w5 | CVE-2023-54404 | high | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | yes |
Background: What a vulnerability scan can and cannot prove →
Dependencies 93 packages
| Packages resolved | 93 |
|---|---|
| Stale | 30 |
| Tree resolution | Complete |
Background: SBOMs and build attestations, explained →
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability. A tool's description is untrusted text the model reads on every call, which is what makes this list a security surface and not just an inventory: how tool poisoning works →
get_signed_report Get a signed provenance report ~325
Generate a signed PDF audit report for one image: the chain-of-custody record that captures the full verdict (capture time, the C2PA validation state and signer, metadata checks, pixel-forensic signals, and the SHA-256 and SHA-512 fingerprints) with an Ed25519 signature you can verify against the published key at /v1/key, plus an embedded RFC 3161 trusted timestamp token verifiable offline with OpenSSL (the report labels it plainly if the timestamp authority was unreachable). Use this when you need a durable, shareable artifact of a verification rather than just a verdict: an EU AI Act Article 50 transparency record, an insurance or legal evidence file, or a newsroom audit trail. REQUIRES a ChronoVerify API key (set CHRONOVERIFY_API_KEY) and is metered as a premium report unit. Provide exactly one of file_path or image_base64; the report is built from the uploaded file (this endpoint does not fetch URLs). The PDF is written to out_path, or to the current working directory when out_path is omitted. It validates provenance and is NOT a deepfake or AI-generation detector; the report is investigative triage to support human review, not proof.
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | – | Absolute path to a local image file to report on. |
| image_base64 | string | – | Base64-encoded image bytes (no data: prefix). |
| out_path | string | – | Where to write the PDF. Defaults to ./chronoverify-<fingerprint>.pdf in the current directory. |
| Name | Type | Req | Description |
|---|---|---|---|
| bytes | number | yes | Size of the PDF in bytes. |
| content_type | string | yes | – |
| saved_path | string | yes | Absolute path the signed PDF was written to. |
| signature_key_url | string | yes | Where to fetch the public key to verify the report's signature. |
No examples provided.
verify_image Verify image provenance ~661
Verify a photo's capture time and provenance: when it was captured, on what device and where, whether it carries valid C2PA Content Credentials, and whether it shows signs of editing. Runs a deterministic pipeline (cryptographic C2PA Content Credentials validation against the official trust lists, EXIF and XMP metadata consistency, and classical pixel forensics such as error-level and noise analysis) and returns ONE verdict with a 0 to 100 confidence and the signals behind it. The verdict is one of: provenance_confirmed (a Content Credential that validated against a recognized trust list), consistent (metadata holds up, no manipulation signal fired), inconclusive (not enough signal), metadata_anomaly (the metadata contradicts itself), or manipulation_indicated (pixel forensics flagged possible editing). provenance_confirmed means the credential validated, not that the image is a camera capture: a valid credential can itself declare generative-AI origin, so read c2pa.ai_declared and c2pa.digital_source_type, and the headline, which states any such declaration, before treating the image as a photograph. Structured output also returns the capture time, device, location, the C2PA validation state, the consolidated validation status codes, the signer, the credential's own AI declaration (ai_declared, ai_in_ingredients, digital_source_type, software_agents, actions), any remote manifest URL, and the SHA-256 and SHA-512 fingerprints. Prefer this whenever you must trust a user-submitted or sourced image before acting on it: insurance claims, KYC and onboarding, dating or marketplace listings, journalism and OSINT, EU AI Act Article 50 transparency checks, or legal evidence. Works on any image, signed or not, and degrades gracefully (returns inconclusive instead of false-accusing) on unsigned or social-media-recompressed photos. ChronoVerify is a C2PA Conformant Validator, listed on the C2PA Conforming Products List (record 019f8a20-6452-7a43-b11b-59d0b0e4a84a; validation o…
| Name | Type | Req | Description |
|---|---|---|---|
| file_path | string | – | Absolute path to a local image file to verify. |
| image_base64 | string | – | Base64-encoded image bytes (no data: prefix). |
| permalink | boolean | – | Also store the verdict (never the image) and return an unlisted, shareable link to it in the permalink field. Keyless links expire after 90 days; links minted with an API key do not expire. |
| url | string | – | A publicly reachable image URL; the server fetches it. |
| Name | Type | Req | Description |
|---|---|---|---|
| c2pa | object | yes | – |
| capture_device | object | yes | – |
| capture_location | object | yes | – |
| capture_time | object | yes | – |
| confidence | number | yes | 0 to 100 confidence in the verdict. |
| headline | string | yes | One-line plain-language verdict. |
| integrity | object | yes | – |
| limits | string | yes | Plain-language statement of what the verdict does and does not mean. |
| permalink | – | yes | Present only when the request set permalink=true. The image itself is never stored. |
| schema_version | string | yes | Response schema version, currently 'v1'. |
| source | string | yes | Attribution string for the result. |
| summary | string | yes | – |
| verdict | string | yes | The single fused verdict. |
No examples provided.
How do I install the io.github.beeswaxpat/chronoverify MCP server?
io.github.beeswaxpat/chronoverify runs locally as an npm package, launched with npx -y chronoverify-mcp. Ready-made configuration for Claude, Cursor, VS Code, Codex and 5 more is on this page, copied from each client's own documentation.
npm · chronoverify-mcp
claude mcp add beeswaxpat-chronoverify -- npx -y chronoverify-mcp
What is the io.github.beeswaxpat/chronoverify MCP server?
io.github.beeswaxpat/chronoverify is an MCP server listed in the public MCP registry as io.github.beeswaxpat/chronoverify. Verify a photo's capture time and provenance: C2PA validation, EXIF/XMP, and pixel forensics. This page covers its npm package (chronoverify-mcp).
Is the io.github.beeswaxpat/chronoverify MCP server safe to use?
io.github.beeswaxpat/chronoverify scores 77 out of 100 on VerifyMCP. We recorded 1 known advisory against it as of 5 November 2026. It declares no install or post-install scripts. That is a record of what we were able to check automatically, not an endorsement. The category breakdown on this page shows every signal behind the number, including the ones we could not confirm.
What tools does the io.github.beeswaxpat/chronoverify MCP server expose?
io.github.beeswaxpat/chronoverify exposes 2 tools: verify_image, get_signed_report. Their descriptions and schemas cost roughly 986 tokens of context every time the server is loaded.
Is the io.github.beeswaxpat/chronoverify MCP server still maintained?
io.github.beeswaxpat/chronoverify is still listed as active in the MCP registry. We last reached this channel on 5 November 2026. Those dates come from our own scans of the registry and the channel itself, not from anything the publisher announced.
What licence is the io.github.beeswaxpat/chronoverify MCP server under?
io.github.beeswaxpat/chronoverify declares the MIT licence, which is OSI-approved. That covers the source only, and says nothing about the cost of any service it calls.