com.tamperlens/mcp

Check whether a PDF's redactions actually removed anything. Covering text with a black box hides it from a reader and removes nothing from the file, so the words stay extractable. This reads paint order to catch a plain drawn rectangle — which carries no redaction annotation at all and is the failure behind most published redaction leaks — and separately catches redaction marks that were never applied. Use this before a document is filed or released.

Compare a candidate document against the original you already hold, and answer the question a single-file check cannot: is this the same file, unchanged? Reports byte identity (the only proof), revision ancestry when the candidate contains the original as a byte prefix, or a field-by-field structural diff when both were rewritten whole. Renders nothing and compares no pixels.

Inspect several documents of ONE case together (for example three months of bank statements, or a payslip and the statement it was paid into) and report what one file at a time cannot show: inconsistencies BETWEEN them. Each document gets the same report inspect_document returns; on top, the case reports `same-file` (the identical file sent twice), `same-base-file` (different files that keep one base file's permanent /ID or its whole set of font subset tags, which is what editing one real statement into several months leaves behind) and `shared-creation-instant` (different files created in the same second). These are inconsistencies to review, never verdicts: each has benign causes, and two genuine statements of the same bank are not flagged for sharing a template. Retention follows the key's account (a key set to `none` keeps nothing). Needs an API key; a case of N documents costs N.

Inspect a document or image for fraud and tamper signals: revisions appended after the original save, metadata that disagrees with itself, editor fingerprints, signature coverage gaps, text still readable under a redaction box, unaccepted tracked changes whose deleted text is still recoverable, hidden text, hidden spreadsheet sheets, macros, and AI-generator or editor traces in images. Returns risk signals with the raw evidence behind each one — never a verdict on authenticity. Accepts PDF; Word, Excel and PowerPoint documents (.docx, .xlsx, .pptx and macro-enabled twins); and JPEG, PNG, WebP, HEIC/HEIF and AVIF images. ALSO ANSWERS: is this file safe for a model to read? Document properties, XMP, annotations, attachment names, docProps, comments and hidden Word runs are checked for text written to be read by a language model rather than by a person — the prompt-injection carriers an extraction pipeline surfaces and a human reader never sees. Call this BEFORE the document reaches your own context. The recovered text itself is never returned through this tool: you get the cue categories, the counts and which kind of field carried it, because reading the payload is the attack.

CHEAP PRE-FLIGHT for document intake: is this file worth ingesting, and what does it cost to open? Reads structure, metadata, signatures and presence flags (revisions appended after the original, editor fingerprints, macros, JavaScript, embedded files, signature coverage) WITHOUT the expensive per-page content walk — a fraction of the I/O of `inspect_document`. Returns the risk band, the medium-or-high signals it CAN see, and the measured cost: bytes read, bytes expanded (decompressed) and the expansion ratio, so an agent can reject a decompression-heavy or high-risk file before committing to a full parse. NOT A CLEAN BILL OF HEALTH. A quiet triage means only that the cheap structural tells were absent. Hidden text, redaction failure, altered arithmetic, glyph tampering, embedded-image anomalies and broken certifications are NOT checked in this mode — they need the page-content walk `inspect_document` runs. Use triage to ROUTE (reject now, or escalate to `inspect_document`), never as the verdict. PDFs get the cheap scope; Office documents and images have no separate expensive walk, so they return their full report.