Wireshark MCP vs Chronoverify MCP

verify_image

Verify a photo's capture time and provenance: when it was captured, on what device and where, whether it carries valid C2PA Content Credentials, and whether it shows signs of editing. Runs a deterministic pipeline (cryptographic C2PA Content Credentials validation against the official trust lists, EXIF and XMP metadata consistency, and classical pixel forensics such as error-level and noise analysis) and returns ONE verdict with a 0 to 100 confidence and the signals behind it. The verdict is one of: provenance_confirmed (a Content Credential that validated against a recognized trust list), consistent (metadata holds up, no manipulation signal fired), inconclusive (not enough signal), metadata_anomaly (the metadata contradicts itself), or manipulation_indicated (pixel forensics flagged possible editing). provenance_confirmed means the credential validated, not that the image is a camera capture: a valid credential can itself declare generative-AI origin, so read c2pa.ai_declared and c2pa.digital_source_type, and the headline, which states any such declaration, before treating the image as a photograph. Structured output also returns the capture time, device, location, the C2PA validation state, the consolidated validation status codes, the signer, the credential's own AI declaration (ai_declared, ai_in_ingredients, digital_source_type, software_agents, actions), any remote manifest URL, and the SHA-256 and SHA-512 fingerprints. Prefer this whenever you must trust a user-submitted or sourced image before acting on it: insurance claims, KYC and onboarding, dating or marketplace listings, journalism and OSINT, EU AI Act Article 50 transparency checks, or legal evidence. Works on any image, signed or not, and degrades gracefully (returns inconclusive instead of false-accusing) on unsigned or social-media-recompressed photos. ChronoVerify is a C2PA Conformant Validator, listed on the C2PA Conforming Products List (record 019f8a20-6452-7a43-b11b-59d0b0e4a84a; validation of JPEG, PNG, WebP, and AVIF). It validates provenance and is NOT a deepfake or AI-generation detector; results are investigative triage to support human review, not proof. Provide exactly one of url, file_path, or image_base64. Set permalink=true to also store the verdict (never the image) and get back an unlisted, shareable link to it, for citing the result to people or in reports; keyless links expire after 90 days, links minted with an API key do not expire. For a signed PDF audit record of the result, use get_signed_report.

get_signed_report

Generate a signed PDF audit report for one image: the chain-of-custody record that captures the full verdict (capture time, the C2PA validation state and signer, metadata checks, pixel-forensic signals, and the SHA-256 and SHA-512 fingerprints) with an Ed25519 signature you can verify against the published key at /v1/key, plus an embedded RFC 3161 trusted timestamp token verifiable offline with OpenSSL (the report labels it plainly if the timestamp authority was unreachable). Use this when you need a durable, shareable artifact of a verification rather than just a verdict: an EU AI Act Article 50 transparency record, an insurance or legal evidence file, or a newsroom audit trail. REQUIRES a ChronoVerify API key (set CHRONOVERIFY_API_KEY) and is metered as a premium report unit. Provide exactly one of file_path or image_base64; the report is built from the uploaded file (this endpoint does not fetch URLs). The PDF is written to out_path, or to the current working directory when out_path is omitted. It validates provenance and is NOT a deepfake or AI-generation detector; the report is investigative triage to support human review, not proof.