AI Image Provenance Scanner

Checks for C2PA Content Credentials and known AI-generator metadata fingerprints (Stable Diffusion, ComfyUI, Midjourney, and others). A signal found is a hint, not proof; no signal found doesn't confirm authenticity either — details below.

ℹ️ What does this check, and what are the limits?

C2PA Content Credentials

Content Credentials are the industry standard (backed by Adobe, Google, Microsoft, and the broader Content Authenticity Initiative) for cryptographically attaching provenance data to a file at the moment it's created or edited.

Cryptographic validation, not just presence: a manifest's signature is actually verified, so a forged or tampered-with manifest is reported as invalid, not treated as legitimate just because a manifest exists.
Claim generator identified: the specific tool or service that created or last signed the file, when the manifest declares one.
AI declarations surfaced directly: assertions describing the content as AI-generated, AI-composited, or used in AI training/mining are pulled out and shown plainly, not buried in raw manifest JSON.

AI-Generator Metadata Fingerprints

Most AI image tools in everyday use — especially local, non-hosted ones — don't attach C2PA credentials at all, but many still leave their own fingerprints behind in ordinary file metadata.

EXIF fields: the Software, UserComment, ImageDescription, and Artist tags, where tools like AUTOMATIC1111's Stable Diffusion WebUI write full generation parameters (steps, sampler, CFG scale, seed).
PNG text chunks: ComfyUI embeds its entire workflow graph as JSON directly in the file; Stable Diffusion WebUI writes a parameters chunk with the prompt and settings.
XMP fields: the standardized IPTC DigitalSourceType property, which Midjourney and a growing number of other generators set to explicitly flag AI-generated or AI-composited output.
Not exhaustive, and not proof: new generators appear constantly, and any of this metadata can be stripped or forged in seconds with a tool like exiftool — a match is a real signal, but a miss proves nothing either way.

What this can and can't tell you: a cryptographically-signed C2PA manifest is real, verifiable evidence. Everything else here — EXIF tags, PNG text chunks, XMP fields — is metadata that any AI tool chose to write and anyone can strip or forge with a tool like exiftool in seconds. So: a signal found is a strong hint, not proof; no signal found is not proof the image is authentic or human-made, only that no known fingerprint survived in this copy. This also does not detect Photoshop edits, splicing, or deepfakes — that's a different (and far less reliable) kind of forensic analysis this tool does not attempt.

💡 Show API usage examples (cURL)

Scan an image and get JSON findings

curl -sS -X POST https://devops.majbase.com/ai-image-scanner/api \
    -F "file=@photo.jpg"

Example response

{
  "filename": "photo.jpg",
  "format": "PNG",
  "size_kb": 1842.5,
  "sha256": "a82f3c1e…9d4b",
  "dimensions": "1024x1024",
  "verdict": "unverified_ai_signal",
  "c2pa": {
    "manifest_found": false,
    "validation_state": null,
    "claim_generator": null,
    "ai_assertion": null,
    "error": null
  },
  "metadata_signals": ["ComfyUI", "Stable Diffusion"],
  "exif_texts": {"Software": "…"},
  "png_texts": {"parameters": "…", "workflow": "…"},
  "camera_details": {},
  "camera_metadata_present": false
}

verdict is one of verified_ai, verified_provenance, unverified_manifest, unverified_ai_signal, no_signal. On a server-side error the response is {"error": "…"} with a non-200 status.