io.github.ebadros/sidearm
NPM · @SIDEARMDRM/MCP · SCANNED AUG 3
Protect media from AI training, detect AI-generated content, and find stolen work.
Available components
How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. How we score →
Supply Chain Security87
- No malware found by supply-chain analysis.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.Partial
- No install/post-install scripts declared.Pass
- Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree. View diagnostics → Partial
Provenance & Transparency45
- Source repository is publicly reachable at the declared URL. View diagnostics → Pass
- Provenance check failed: no build-provenance attestation is published. See how to fix → View diagnostics → Fail
- Clear OSI-approved license (MIT).Pass
- Actively maintained (last published 144 days ago).Pass
- Disclosure check failed: no security disclosure policy was found in the source repository. See how to fix → Fail
Schema Quality & AI Usability81
- AI-judged instruction clarity (excellent).Pass
- Tool/resource definitions use about 2789 tokens (~103/item across 27 items; 27 tools + 0 resources), lean.Pass
- Usage-examples check failed: none of the tools include examples. See how to fix → Fail
Stability & Change Management0
- Stability not yet verified: not enough scan history yet (needs a 30-day window).Unverified
Tool Coverage100
- 100% of tools have a non-trivial description (not blank, and not just the tool's name).Pass
- 100% of tool parameters carry a description.Pass
Capabilities100
- Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.Pass
Unverified: 1 category
A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.
Add this component to your MCP client. Where a client-specific snippet is available, pick your client below and copy it straight into your config; otherwise use the connection detail shown.
npm · @sidearmdrm/mcp
claude mcp add ebadros-sidearm -- npx -y @sidearmdrm/mcp
codex mcp add ebadros-sidearm -- npx -y @sidearmdrm/mcp
{
"$schema": "https://opencode.ai/config.json",
"mcp": {
"ebadros-sidearm": {
"type": "local",
"command": [
"npx",
"-y",
"@sidearmdrm/mcp"
],
"enabled": true
}
}
} openclaw mcp add ebadros-sidearm --command npx --arg -y --arg @sidearmdrm/mcp
mcp_servers:
ebadros-sidearm:
command: "npx"
args: ["-y", "@sidearmdrm/mcp"] {
"mcpServers": {
"ebadros-sidearm": {
"command": "npx",
"args": [
"-y",
"@sidearmdrm/mcp"
]
}
}
} Every change we have recorded for this component, newest first. Security-relevant changes are always shown. ▲ marks a change for the better, ▼ a change for the worse; unmarked changes are neutral.
- 2 Aug 26 +40
- Provenance: unverified → fail ▼ security
- Install scripts: unverified → pass ▲ security
- Known CVEs: unverified → partial ▲ security
- Malware scan: unverified → pass ▲ security
- Dependency health: unverified → partial ▲ functional
- Maintenance: unverified → pass ▲ functional
- Schema quality: unverified → excellent ▲ functional
- License: unverified → pass ▲ functional
- Licence: MIT functional
- 1 Aug 26 +21
- Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window). security
- Tool coverage: unverified → 100 ▲ functional
- MCP protocol: unverified → pass ▲ functional
- 31 Jul 26 −41
- We updated how we score, so this day's move reflects our rubric, not a change to the server See what changed → functional
- 27 Jul 26 46
First indexed and scored.
Diagnostic detail from the automated scan of this channel: what the scanner observed at each step, so you can see exactly where a check passed or failed. It is informational only and never changes the trust score.
Captured 3 Aug 2026 · Analysed npm/@sidearmdrm/[email protected]
Provenance none
Ecosystem: npm · Outcome: none
Dependencies 95 packages
95 packages in the resolved dependency tree · 95 deprecated · 29 stale.
The dependency tree was only partially resolved, so these counts may be incomplete.
The tools this component advertises to a client, with an estimated token cost for each. Expand a tool to see its parameters and schema. The per-tool counts are indicative and are not scored directly; the schema's total context footprint is one signal in Schema Quality & AI Usability.
check_job ~67
Check the status of an asynchronous job (from run_algorithm, protect_media, or detect_ai). Returns status (queued, processing, completed, failed), progress percentage, and result data including download URLs when complete.
| Name | Type | Req | Description |
|---|---|---|---|
| job_id | string | yes | The job ID returned by a previous tool call |
No output schema declared.
No examples provided.
create_share ~80
Create a shareable link for a detection, search, or provenance result. The share starts private (is_public: false). Use publish_share to make it public.
| Name | Type | Req | Description |
|---|---|---|---|
| result_id | string | yes | ID of the result (job ID for detection, search ID for search, media ID for provenance) |
| type | string | yes | Type of result to share |
No output schema declared.
No examples provided.
delete_media ~49
Permanently delete a registered media asset. Removes storage files, vector embeddings, and all associated metadata. This action cannot be undone.
| Name | Type | Req | Description |
|---|---|---|---|
| media_id | string | yes | UUID of the media asset to delete |
No output schema declared.
No examples provided.
detect_ai ~137
Detect whether media content was generated by AI. Supports images, video, audio, and text/PDF. Runs multiple specialized detection models in parallel for the given media type. Returns a job_id — use check_job to poll for results.
| Name | Type | Req | Description |
|---|---|---|---|
| media | string | — | Base64-encoded media content to analyze |
| media_url | string | — | Public URL of the media to analyze |
| mime | string | — | MIME type of the media (e.g. image/png, audio/wav, text/plain) |
| tags | array | — | Tags for organizing and filtering |
| text | string | — | Plain text content to analyze for AI generation |
No output schema declared.
No examples provided.
detect_fingerprint ~137
Detect whether media has been previously registered or watermarked. Uses POST /api/v1/detect to compare against your indexed library at varying depth. Tiers: exact (hash match), quick (perceptual hash), perceptual (visual similarity), compositional (scene structure), full (all tiers). Returns results synchronously.
| Name | Type | Req | Description |
|---|---|---|---|
| media | string | — | Base64-encoded media content to check |
| media_url | string | — | Public URL of the media to check |
| tags | array | — | Tags to scope the detection to |
| tier | string | — | Detection depth — controls thoroughness vs speed. Default: quick |
No output schema declared.
No examples provided.
detect_membership ~139
Run membership inference to determine whether your protected content was used to train a suspect AI model. Provide content IDs (from your registered media) and the model to test. Methods: pattern (watermark detection), statistical (distribution analysis), combined (both). Returns a job_id — use check_job to poll for results.
| Name | Type | Req | Description |
|---|---|---|---|
| content_ids | array | yes | UUIDs of your registered media to test against the suspect model |
| method | string | — | Inference method. Default: combined |
| suspect_model | string | yes | Identifier or name of the AI model suspected of training on your content |
| tags | array | — | Tags for organizing and filtering |
No output schema declared.
No examples provided.
extract_embeddings ~218
Extract raw embedding vectors from media using named embedding algorithms. Returns vectors suitable for downstream similarity search, clustering, or ML pipelines. Provide algorithm IDs (from list_algorithms, e.g. dinov2, clip, phash, chromaprint, clap) and either a public media_url or base64-encoded media. Returns a job_id — use check_job to retrieve the vectors once complete.
| Name | Type | Req | Description |
|---|---|---|---|
| algorithms | array | yes | Embedding algorithm IDs to run (e.g. ['dinov2', 'clip'] for images, ['chromaprint', 'clap'] for audio, ['sentence-transformers'] for text). Use list_algorithms to discover IDs with extractable=true. |
| media | string | — | Base64-encoded media content (alternative to media_url) |
| media_url | string | — | Public URL of the media file to process |
| mime | string | — | MIME type of the media (e.g. image/png, audio/wav) |
| text | string | — | Plain text content (for sentence-transformers) |
No output schema declared.
No examples provided.
get_account ~37
Get your account details — ID, name, email, credit balance, and plan info. Use this to discover your account_id for other endpoints.
Input schema present but exposes no named parameters.
No output schema declared.
No examples provided.
get_billing ~166
Get billing, usage summary, storage stats, and algorithm breakdown for your account. Returns credit balance, protection/storage cost breakdown, per-algorithm usage, billing events, and a link to the Stripe customer portal. Filter by date range, event type, tags, or API token.
| Name | Type | Req | Description |
|---|---|---|---|
| account_id | string | — | Your account UUID, or "me" to use the authenticated account |
| end_date | string | — | Filter events until this ISO 8601 date (inclusive) |
| start_date | string | — | Filter events from this ISO 8601 date (inclusive) |
| tags | string | — | Comma-separated tags to filter by |
| token_id | string | — | Filter events to a specific API token UUID |
| type | string | — | Filter by event type |
No output schema declared.
No examples provided.
get_deletion ~39
Get details of a specific deletion record, including which algorithms were purged and storage status.
| Name | Type | Req | Description |
|---|---|---|---|
| deletion_id | string | yes | The deletion record ID |
No output schema declared.
No examples provided.
get_media ~47
Get details of a specific registered media asset by ID. Returns metadata, protection status, applied algorithms, tags, and storage information.
| Name | Type | Req | Description |
|---|---|---|---|
| media_id | string | yes | UUID of the media asset |
No output schema declared.
No examples provided.
get_provenance ~88
Get the full provenance chain for a media asset. Returns every protection algorithm applied (with versions, timings, and metadata), the C2PA manifest, any AI training membership inference results, and every search where this media appeared as a match. Use this to audit the complete history of what has been done to any media item.
| Name | Type | Req | Description |
|---|---|---|---|
| media_id | string | yes | UUID of the media asset |
No output schema declared.
No examples provided.
get_rights ~79
Get rights and provenance information for a registered media asset. Returns { rights: { ai_training_allowed, acquire_license_url, ... }, protocols: { c2pa, schema_org, iptc, tdm, rsl } }. No authentication required — this is the public discovery endpoint.
| Name | Type | Req | Description |
|---|---|---|---|
| media_id | string | yes | UUID of the media asset |
No output schema declared.
No examples provided.
get_share ~28
Get a shared result by its share ID.
| Name | Type | Req | Description |
|---|---|---|---|
| share_id | string | yes | The share ID |
No output schema declared.
No examples provided.
identify_media ~113
Identify a media asset by its embedded Sidearm fingerprint and extract its C2PA provenance chain. Returns the Sidearm media_id if the asset is registered in your account (null otherwise) and the full ordered C2PA chain (e.g. Nikon Z7II → Adobe Photoshop → sidearm) embedded in the file. Use this to answer 'have I seen this before?' and 'where did this come from?' in one call.
| Name | Type | Req | Description |
|---|---|---|---|
| media_url | string | yes | Publicly accessible URL of the media to identify |
No output schema declared.
No examples provided.
list_algorithms ~104
List available algorithms for media protection, watermarking, and AI content disruption. Returns algorithm IDs, names, supported media types, and descriptions. Use this to discover valid algorithm IDs before calling run_algorithm. Filter by category (open = research algorithms, proprietary = Sidearm bundles) or media_type (image, video, audio, text, pdf, gif).
| Name | Type | Req | Description |
|---|---|---|---|
| category | string | — | Filter by algorithm category |
| media_type | string | — | Filter by supported media type |
No output schema declared.
No examples provided.
list_deletions ~50
List deletion records for your account. Each record documents a media asset that was permanently deleted.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | — | Pagination cursor |
| limit | number | — | Max results (1–100) |
No output schema declared.
No examples provided.
list_media ~75
List media assets registered to your account. Returns a paginated list with media IDs, types, status, tags, and protection details. Use cursor-based pagination for large libraries.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | — | Pagination cursor from a previous response |
| limit | integer | — | Results per page (1-100, default: 20) |
No output schema declared.
No examples provided.
list_searches ~65
List previous similarity searches performed on your account. Returns a paginated list of past search queries with timestamps and result counts.
| Name | Type | Req | Description |
|---|---|---|---|
| cursor | string | — | Pagination cursor from a previous response |
| limit | integer | — | Results per page (1-100, default: 20) |
No output schema declared.
No examples provided.
navigate_ui ~119
Look up how to perform an action in the Sidearm dashboard UI. Returns step-by-step instructions for dashboard operations such as uploading media, running searches, managing API keys, reviewing deals, buying credits, and more. Use this when the user asks how to do something in the dashboard or web app. Omit the query to get an overview of all available pages.
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | — | What the user wants to do — e.g. 'upload files', 'create API key', 'buy credits', 'accept a deal', 'check usage' |
No output schema declared.
No examples provided.
protect_media ~210
Protect media using a curated preset level. Automatically selects the best combination of algorithms for the given media type. Simpler than run_algorithm — just specify standard or maximum protection. Provide either a public media_url, base64 media, or text content. Returns a job_id — use check_job to poll for results.
| Name | Type | Req | Description |
|---|---|---|---|
| filename | string | — | Original filename for human-readable output naming |
| level | string | — | Protection level: standard (fast, good protection) or maximum (slower, strongest protection). Default: standard |
| media | string | — | Base64-encoded media content (alternative to media_url) |
| media_url | string | — | Public URL of the media file to protect |
| mime | string | — | MIME type (e.g. image/png, audio/wav, text/plain) |
| tags | array | — | Tags for organizing and filtering |
| text | string | — | Plain text content to protect |
| webhook_url | string | — | URL to receive a POST when the job completes |
No output schema declared.
No examples provided.
publish_share ~34
Make a shared result publicly accessible. Sets is_public to true.
| Name | Type | Req | Description |
|---|---|---|---|
| share_id | string | yes | The share ID to publish |
No output schema declared.
No examples provided.
register_media ~139
Register and protect media on the Sidearm platform. Modes: register (provenance signing only), search_ready (register + vector indexing), standard (search_ready + watermarks + AI-training poison), maximum (standard + style cloaking + adversarial hardening). Returns the created media object.
| Name | Type | Req | Description |
|---|---|---|---|
| expires_at | string | — | ISO 8601 datetime when this registration expires |
| media | string | — | Base64-encoded media content to register |
| media_url | string | — | Public URL of the media to register |
| mode | string | — | Protection level. Default: standard |
| tags | array | — | Tags for organizing and filtering |
No output schema declared.
No examples provided.
run_algorithm ~237
Run one or more named algorithms on media. Provide algorithm IDs (from list_algorithms) and either a public media_url or base64-encoded media content. For text, use the text param. Returns a job_id for async processing — use check_job to poll for results. Requires credits.
| Name | Type | Req | Description |
|---|---|---|---|
| algorithms | array | yes | Algorithm IDs to run (e.g. ['nightshade', 'glaze']). Use list_algorithms to discover IDs. |
| c2pa_wrap | boolean | — | Wrap output in C2PA provenance signing (default: true) |
| filename | string | — | Original filename for human-readable output naming |
| media | string | — | Base64-encoded media content (alternative to media_url) |
| media_url | string | — | Public URL of the media file to process |
| mime | string | — | MIME type of the media (e.g. image/png, audio/wav) |
| tags | array | — | Tags for organizing and filtering |
| text | string | — | Plain text content (for text algorithms like spectra, textmark) |
| webhook_url | string | — | URL to receive a POST when the job completes |
No output schema declared.
No examples provided.
search_docs ~109
Search the Sidearm API documentation. Returns relevant sections from the full developer reference covering endpoints, request/response formats, authentication, SDKs, algorithms, and usage examples. Use this to look up how to call an endpoint, understand a concept, or find example code. Omit the query to get the overview and index of available topics.
| Name | Type | Req | Description |
|---|---|---|---|
| query | string | — | What to look for — e.g. 'authenticate', 'protect media', 'detect AI', 'Node SDK', 'watermark' |
No output schema declared.
No examples provided.
search_media ~155
Search for similar or matching media across the indexed library. Provide a media_url or base64 media to find matches. Tiers: exact (hash match), quick (perceptual hash), perceptual (visual similarity), compositional (scene structure), full (all tiers). Returns results immediately.
| Name | Type | Req | Description |
|---|---|---|---|
| limit | integer | — | Maximum results to return (1-100, default: 20) |
| media | string | — | Base64-encoded media content to search for |
| media_url | string | — | Public URL of the media to search for |
| tags | array | — | Restrict search to media with these tags |
| type | string | — | Search tier — controls depth vs speed tradeoff. Default: perceptual |
No output schema declared.
No examples provided.
update_media ~68
Update a registered media asset. Currently supports updating the original media URL (e.g., after re-hosting the original file).
| Name | Type | Req | Description |
|---|---|---|---|
| media_id | string | yes | UUID of the media asset to update |
| original_media_url | string | yes | New URL for the original (unprotected) media file |
No output schema declared.
No examples provided.