# io.github.ebadros/sidearm (npm · @sidearmdrm/mcp)

Protect media from AI training, detect AI-generated content, and find stolen work.

- Trust score: 66/100 (medium)
- Change this week: +20
- Registry status: active
- Liveness: live
- Owner verified: no
- Last scored: 2026-08-03

## Components

- npm · `@sidearmdrm/mcp`: 66/100 (this document), [markdown](https://verifymcp.io/servers/ebadros-sidearm/sidearmdrm-mcp.md), [page](https://verifymcp.io/servers/ebadros-sidearm/sidearmdrm-mcp)

## Channel facts

- Registry: `npm`
- Package: `@sidearmdrm/mcp`
- Version: `0.9.2`
- Transport: `stdio`

## Trust breakdown

How this component scores in each security and reliability category. Every signal is checked automatically from public evidence about the published package, including repeated runs of it in an isolated sandbox, and we only credit what we can confirm. Scores are 0–100 per category. Scoring method: https://verifymcp.io/docs/scoring (what has changed: https://verifymcp.io/docs/scoring/changelog)

Scored 2026-08-03.

- **Supply Chain Security**: 87/100
  - No malware found by supply-chain analysis.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
  - No install/post-install scripts declared.
  - Only part of the dependency tree could be resolved (95 of 99), so this covers what we could see, not the whole tree.
- **Provenance & Transparency**: 45/100
  - Source repository is publicly reachable at the declared URL.
  - Provenance check failed: no build-provenance attestation is published.
  - Clear OSI-approved license (MIT).
  - Actively maintained (last published 144 days ago).
  - Disclosure check failed: no security disclosure policy was found in the source repository.
- **Schema Quality & AI Usability**: 81/100
  - AI-judged instruction clarity (excellent).
  - Tool/resource definitions use about 2789 tokens (~103/item across 27 items; 27 tools + 0 resources), lean.
  - Usage-examples check failed: none of the tools include examples.
- **Stability & Change Management**: 0/100
  - Stability not yet verified: not enough scan history yet (needs a 30-day window).
- **Tool Coverage**: 100/100
  - 100% of tools have a non-trivial description (not blank, and not just the tool's name).
  - 100% of tool parameters carry a description.
- **Capabilities**: 100/100
  - Implements a supported MCP spec version (2025-11-25); the latest is 2026-07-28.

**Unverified: 1 category.** A category scored 0 because we could not verify it: a data source with nothing on this package, evidence we could not reach, or a check we could not run. We only credit what we can confirm.

## Install

### Claude

```bash
claude mcp add ebadros-sidearm -- npx -y @sidearmdrm/mcp
```

### Codex

```bash
codex mcp add ebadros-sidearm -- npx -y @sidearmdrm/mcp
```

### opencode

```json
{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "ebadros-sidearm": {
      "type": "local",
      "command": [
        "npx",
        "-y",
        "@sidearmdrm/mcp"
      ],
      "enabled": true
    }
  }
}
```

### OpenClaw

```bash
openclaw mcp add ebadros-sidearm --command npx --arg -y --arg @sidearmdrm/mcp
```

### Hermes

```yaml
mcp_servers:
  ebadros-sidearm:
    command: "npx"
    args: ["-y", "@sidearmdrm/mcp"]
```

### Other

```json
{
  "mcpServers": {
    "ebadros-sidearm": {
      "command": "npx",
      "args": [
        "-y",
        "@sidearmdrm/mcp"
      ]
    }
  }
}
```

## Changelog

Every change recorded for this component, newest first. Days that predate change tracking, or that we cannot explain, say so: "we were watching and nothing happened" and "we were not watching" are different claims.

### 2026-08-02 (score 66, +40)

- [security regression] Provenance: unverified → fail
- [security improvement] Install scripts: unverified → pass
- [security improvement] Known CVEs: unverified → partial
- [security improvement] Malware scan: unverified → pass
- [functional improvement] Dependency health: unverified → partial
- [functional improvement] Maintenance: unverified → pass
- [functional improvement] Schema quality: unverified → excellent
- [functional improvement] License: unverified → pass
- [functional] Licence: MIT

### 2026-08-01 (score 26, +21)

- [security] Stability: Stability not yet verified: not enough scan history yet (needs a 30-day window).
- [functional improvement] Tool coverage: unverified → 100
- [functional improvement] MCP protocol: unverified → pass

### 2026-07-31 (score 5, −41)

- [functional] We updated how we score, so this day's move reflects our rubric, not a change to the server

### 2026-07-27 (score 46)

First indexed and scored.

## MCP tools (27)

### `list_algorithms` (~104 tokens)

List available algorithms for media protection, watermarking, and AI content disruption. Returns algorithm IDs, names, supported media types, and descriptions. Use this to discover valid algorithm IDs before calling run_algorithm. Filter by category (open = research algorithms, proprietary = Sidearm bundles) or media_type (image, video, audio, text, pdf, gif).

Input parameters:

- `category` (string): Filter by algorithm category
- `media_type` (string): Filter by supported media type

### `run_algorithm` (~237 tokens)

Run one or more named algorithms on media. Provide algorithm IDs (from list_algorithms) and either a public media_url or base64-encoded media content. For text, use the text param. Returns a job_id for async processing — use check_job to poll for results. Requires credits.

Input parameters:

- `algorithms` (array, required): Algorithm IDs to run (e.g. ['nightshade', 'glaze']). Use list_algorithms to discover IDs.
- `c2pa_wrap` (boolean): Wrap output in C2PA provenance signing (default: true)
- `filename` (string): Original filename for human-readable output naming
- `media` (string): Base64-encoded media content (alternative to media_url)
- `media_url` (string): Public URL of the media file to process
- `mime` (string): MIME type of the media (e.g. image/png, audio/wav)
- `tags` (array): Tags for organizing and filtering
- `text` (string): Plain text content (for text algorithms like spectra, textmark)
- `webhook_url` (string): URL to receive a POST when the job completes

### `extract_embeddings` (~218 tokens)

Extract raw embedding vectors from media using named embedding algorithms. Returns vectors suitable for downstream similarity search, clustering, or ML pipelines. Provide algorithm IDs (from list_algorithms, e.g. dinov2, clip, phash, chromaprint, clap) and either a public media_url or base64-encoded media. Returns a job_id — use check_job to retrieve the vectors once complete.

Input parameters:

- `algorithms` (array, required): Embedding algorithm IDs to run (e.g. ['dinov2', 'clip'] for images, ['chromaprint', 'clap'] for audio, ['sentence-transformers'] for text). Use list_algorithms to discover IDs with extractable=true.
- `media` (string): Base64-encoded media content (alternative to media_url)
- `media_url` (string): Public URL of the media file to process
- `mime` (string): MIME type of the media (e.g. image/png, audio/wav)
- `text` (string): Plain text content (for sentence-transformers)

### `protect_media` (~210 tokens)

Protect media using a curated preset level. Automatically selects the best combination of algorithms for the given media type. Simpler than run_algorithm — just specify standard or maximum protection. Provide either a public media_url, base64 media, or text content. Returns a job_id — use check_job to poll for results.

Input parameters:

- `filename` (string): Original filename for human-readable output naming
- `level` (string): Protection level: standard (fast, good protection) or maximum (slower, strongest protection). Default: standard
- `media` (string): Base64-encoded media content (alternative to media_url)
- `media_url` (string): Public URL of the media file to protect
- `mime` (string): MIME type (e.g. image/png, audio/wav, text/plain)
- `tags` (array): Tags for organizing and filtering
- `text` (string): Plain text content to protect
- `webhook_url` (string): URL to receive a POST when the job completes

### `check_job` (~67 tokens)

Check the status of an asynchronous job (from run_algorithm, protect_media, or detect_ai). Returns status (queued, processing, completed, failed), progress percentage, and result data including download URLs when complete.

Input parameters:

- `job_id` (string, required): The job ID returned by a previous tool call

### `search_media` (~155 tokens)

Search for similar or matching media across the indexed library. Provide a media_url or base64 media to find matches. Tiers: exact (hash match), quick (perceptual hash), perceptual (visual similarity), compositional (scene structure), full (all tiers). Returns results immediately.

Input parameters:

- `limit` (integer): Maximum results to return (1-100, default: 20)
- `media` (string): Base64-encoded media content to search for
- `media_url` (string): Public URL of the media to search for
- `tags` (array): Restrict search to media with these tags
- `type` (string): Search tier — controls depth vs speed tradeoff. Default: perceptual

### `list_searches` (~65 tokens)

List previous similarity searches performed on your account. Returns a paginated list of past search queries with timestamps and result counts.

Input parameters:

- `cursor` (string): Pagination cursor from a previous response
- `limit` (integer): Results per page (1-100, default: 20)

### `detect_ai` (~137 tokens)

Detect whether media content was generated by AI. Supports images, video, audio, and text/PDF. Runs multiple specialized detection models in parallel for the given media type. Returns a job_id — use check_job to poll for results.

Input parameters:

- `media` (string): Base64-encoded media content to analyze
- `media_url` (string): Public URL of the media to analyze
- `mime` (string): MIME type of the media (e.g. image/png, audio/wav, text/plain)
- `tags` (array): Tags for organizing and filtering
- `text` (string): Plain text content to analyze for AI generation

### `detect_fingerprint` (~137 tokens)

Detect whether media has been previously registered or watermarked. Uses POST /api/v1/detect to compare against your indexed library at varying depth. Tiers: exact (hash match), quick (perceptual hash), perceptual (visual similarity), compositional (scene structure), full (all tiers). Returns results synchronously.

Input parameters:

- `media` (string): Base64-encoded media content to check
- `media_url` (string): Public URL of the media to check
- `tags` (array): Tags to scope the detection to
- `tier` (string): Detection depth — controls thoroughness vs speed. Default: quick

### `detect_membership` (~139 tokens)

Run membership inference to determine whether your protected content was used to train a suspect AI model. Provide content IDs (from your registered media) and the model to test. Methods: pattern (watermark detection), statistical (distribution analysis), combined (both). Returns a job_id — use check_job to poll for results.

Input parameters:

- `content_ids` (array, required): UUIDs of your registered media to test against the suspect model
- `method` (string): Inference method. Default: combined
- `suspect_model` (string, required): Identifier or name of the AI model suspected of training on your content
- `tags` (array): Tags for organizing and filtering

### `register_media` (~139 tokens)

Register and protect media on the Sidearm platform. Modes: register (provenance signing only), search_ready (register + vector indexing), standard (search_ready + watermarks + AI-training poison), maximum (standard + style cloaking + adversarial hardening). Returns the created media object.

Input parameters:

- `expires_at` (string): ISO 8601 datetime when this registration expires
- `media` (string): Base64-encoded media content to register
- `media_url` (string): Public URL of the media to register
- `mode` (string): Protection level. Default: standard
- `tags` (array): Tags for organizing and filtering

### `list_media` (~75 tokens)

List media assets registered to your account. Returns a paginated list with media IDs, types, status, tags, and protection details. Use cursor-based pagination for large libraries.

Input parameters:

- `cursor` (string): Pagination cursor from a previous response
- `limit` (integer): Results per page (1-100, default: 20)

### `get_media` (~47 tokens)

Get details of a specific registered media asset by ID. Returns metadata, protection status, applied algorithms, tags, and storage information.

Input parameters:

- `media_id` (string, required): UUID of the media asset

### `update_media` (~68 tokens)

Update a registered media asset. Currently supports updating the original media URL (e.g., after re-hosting the original file).

Input parameters:

- `media_id` (string, required): UUID of the media asset to update
- `original_media_url` (string, required): New URL for the original (unprotected) media file

### `delete_media` (~49 tokens)

Permanently delete a registered media asset. Removes storage files, vector embeddings, and all associated metadata. This action cannot be undone.

Input parameters:

- `media_id` (string, required): UUID of the media asset to delete

### `get_account` (~37 tokens)

Get your account details — ID, name, email, credit balance, and plan info. Use this to discover your account_id for other endpoints.

### `get_rights` (~79 tokens)

Get rights and provenance information for a registered media asset. Returns { rights: { ai_training_allowed, acquire_license_url, ... }, protocols: { c2pa, schema_org, iptc, tdm, rsl } }. No authentication required — this is the public discovery endpoint.

Input parameters:

- `media_id` (string, required): UUID of the media asset

### `get_billing` (~166 tokens)

Get billing, usage summary, storage stats, and algorithm breakdown for your account. Returns credit balance, protection/storage cost breakdown, per-algorithm usage, billing events, and a link to the Stripe customer portal. Filter by date range, event type, tags, or API token.

Input parameters:

- `account_id` (string): Your account UUID, or "me" to use the authenticated account
- `end_date` (string): Filter events until this ISO 8601 date (inclusive)
- `start_date` (string): Filter events from this ISO 8601 date (inclusive)
- `tags` (string): Comma-separated tags to filter by
- `token_id` (string): Filter events to a specific API token UUID
- `type` (string): Filter by event type

### `get_provenance` (~88 tokens)

Get the full provenance chain for a media asset. Returns every protection algorithm applied (with versions, timings, and metadata), the C2PA manifest, any AI training membership inference results, and every search where this media appeared as a match. Use this to audit the complete history of what has been done to any media item.

Input parameters:

- `media_id` (string, required): UUID of the media asset

### `identify_media` (~113 tokens)

Identify a media asset by its embedded Sidearm fingerprint and extract its C2PA provenance chain. Returns the Sidearm media_id if the asset is registered in your account (null otherwise) and the full ordered C2PA chain (e.g. Nikon Z7II → Adobe Photoshop → sidearm) embedded in the file. Use this to answer 'have I seen this before?' and 'where did this come from?' in one call.

Input parameters:

- `media_url` (string, required): Publicly accessible URL of the media to identify

### `create_share` (~80 tokens)

Create a shareable link for a detection, search, or provenance result. The share starts private (is_public: false). Use publish_share to make it public.

Input parameters:

- `result_id` (string, required): ID of the result (job ID for detection, search ID for search, media ID for provenance)
- `type` (string, required): Type of result to share

### `get_share` (~28 tokens)

Get a shared result by its share ID.

Input parameters:

- `share_id` (string, required): The share ID

### `publish_share` (~34 tokens)

Make a shared result publicly accessible. Sets is_public to true.

Input parameters:

- `share_id` (string, required): The share ID to publish

### `list_deletions` (~50 tokens)

List deletion records for your account. Each record documents a media asset that was permanently deleted.

Input parameters:

- `cursor` (string): Pagination cursor
- `limit` (number): Max results (1–100)

### `get_deletion` (~39 tokens)

Get details of a specific deletion record, including which algorithms were purged and storage status.

Input parameters:

- `deletion_id` (string, required): The deletion record ID

### `search_docs` (~109 tokens)

Search the Sidearm API documentation. Returns relevant sections from the full developer reference covering endpoints, request/response formats, authentication, SDKs, algorithms, and usage examples. Use this to look up how to call an endpoint, understand a concept, or find example code. Omit the query to get the overview and index of available topics.

Input parameters:

- `query` (string): What to look for — e.g. 'authenticate', 'protect media', 'detect AI', 'Node SDK', 'watermark'

### `navigate_ui` (~119 tokens)

Look up how to perform an action in the Sidearm dashboard UI. Returns step-by-step instructions for dashboard operations such as uploading media, running searches, managing API keys, reviewing deals, buying credits, and more. Use this when the user asks how to do something in the dashboard or web app. Omit the query to get an overview of all available pages.

Input parameters:

- `query` (string): What the user wants to do — e.g. 'upload files', 'create API key', 'buy credits', 'accept a deal', 'check usage'

## Diagnostics

Captured diagnostic sections: Provenance, Dependencies. The full working is on the page: https://verifymcp.io/servers/ebadros-sidearm/sidearmdrm-mcp#diagnostics

## Score history

- 2026-08-03: 66
- 2026-08-02: 66
- 2026-08-01: 26
- 2026-07-31: 5
- 2026-07-30: 46
- 2026-07-28: 46
- 2026-07-27: 46

## Links

- npm package: https://www.npmjs.com/package/@sidearmdrm/mcp
- Socket report: https://socket.dev/npm/package/@sidearmdrm/mcp
- Repository: https://github.com/sidearmDRM/mcp-server
- Changelog RSS feed: https://verifymcp.io/servers/ebadros-sidearm/sidearmdrm-mcp/changelog.xml
- Changelog JSON feed: https://verifymcp.io/servers/ebadros-sidearm/sidearmdrm-mcp/changelog.json
- HTML version of this page: https://verifymcp.io/servers/ebadros-sidearm/sidearmdrm-mcp